{"playbook_version":2,"artifacts":[{"id":"artifact_1","type":"ip","value":"172.16.0.5","is_critical":true,"osint_result":{"source":"Network Analysis","verdict":"internal","details":"172.16.0.5 is a private/internal IP address (RFC 1918). This is an internal network address and cannot be looked up in external threat intelligence. Investigate internal logs for activity from this host."}},{"id":"artifact_2","type":"ip","value":"138.68.45.114","is_critical":false,"osint_result":{"source":"AbuseIPDB","verdict":"clean","details":"IP 138.68.45.114 has 0% abuse confidence score. Located in corporate network range."}},{"id":"artifact_3","type":"domain","value":"suspicious-domain.com","is_critical":true,"osint_result":{"source":"VirusTotal","verdict":"clean","details":"0/94 security vendors flagged this domain. Registered for 5+ years."}},{"id":"artifact_4","type":"url","value":"http://suspicious-domain.com/malicious.exe","is_critical":false,"osint_result":{"source":"URLScan.io","verdict":"clean","details":"URL belongs to legitimate service with valid SSL certificate."}}],"expected_actions":["close_alert"],"expected_verdict":"false_positive","expected_category":"unknown","analysis_notes":""}