{"playbook_version":2,"artifacts":[{"id":"artifact_1","type":"ip","value":"203.0.113.100","is_critical":false,"osint_result":{"source":"URLScan","verdict":"clean","details":"No malicious activity associated with this IP"}},{"id":"artifact_2","type":"hash","value":"a1b2c3d4e5f67890abcdef1234567890","is_critical":false,"osint_result":{"source":"VirusTotal","verdict":"clean","details":"File hash matches legitimate Microsoft Office update"}},{"id":"artifact_3","type":"command","value":"C:\\Program Files\\Microsoft Office\\root\\Office16\\EXCEL.EXE /x","is_critical":false,"osint_result":{"source":"Pattern Analysis","verdict":"clean","details":"Excel macro execution as part of an update process"}},{"id":"artifact_4","type":"ip","value":"10.0.0.5","is_critical":false,"osint_result":{"source":"Internal","verdict":"internal","details":"Internal IP address of the HR department machine"}}],"expected_actions":["close_alert"],"expected_verdict":"false_positive","expected_category":"malware","analysis_notes":"Upon review, the macro execution was identified as part of a routine update, leading to a false positive."}