{"playbook_version":2,"checkedArtifacts":["artifact_1","artifact_2","artifact_3"],"selectedActions":["block_ip","reset_credentials"],"verdict":"true_positive","conclusion":"Confirmed phishing incident involving a spoofed banking domain and malicious credential-harvesting URL. \nIOCs (IP, URL, sender domain) were enriched via OSINT and validated as malicious. \nActivity mapped to MITRE ATT&CK T1566. \nContainment actions included blocking the IP/domain and forcing credential reset for the affected user.\nVerdict: True Positive.\n","submitted_at":"2026-01-28T15:04:50.937Z"}