{"playbook_version":2,"checkedArtifacts":["ip-192.168.1.101","ip-203.0.113.45","hash-abc123de","domain-malicious-ex"],"selectedActions":["block_ip","isolate_host","block_hash","collect_forensics","reset_credentials"],"verdict":"true_positive","conclusion":"On 2023-10-01 at 14:23:45 UTC, the Security Operations Center detected a process execution event on internal workstation DESKTOP-1A2B3C (192.168.1.101) associated with user account jdoe. The executed process (hash: abc123def456ghi789jkl012mno345pq) initiated outbound communication to external IP 203.0.113.45 and resolved domain malicious-example.com.\nGiven the active outbound connection, the incident is assessed as a High-Severity True Positive. The affected endpoint was isolated to prevent lateral movement, and the associated IP, domain, and file hash were blocked at perimeter and endpoint controls. User credentials for jdoe are under review pending validation of potential compromise.","submitted_at":"2026-02-12T04:18:58.336Z"}