{"playbook_version":2,"artifacts":[{"id":"artifact_1","type":"ip","value":"192.0.2.44","is_critical":true,"osint_result":{"source":"AbuseIPDB","verdict":"malicious","details":"IP previously associated with crypto mining pools"}},{"id":"artifact_2","type":"request_body","value":"function: crypto_mine","is_critical":true,"osint_result":{"source":"Internal Monitoring","verdict":"internal","details":"Unexpected function parameter for crypto mining detected"}}],"expected_actions":["isolate_host","block_ip","disable_function"],"expected_verdict":"true_positive","expected_category":"resource_hijacking","analysis_notes":"The execution of a Lambda function for crypto mining suggests resource hijacking, especially given the IP’s history."}