{"playbook_version":2,"artifacts":[{"id":"artifact_1","type":"ip","value":"192.168.50.25","is_critical":false,"osint_result":{"source":"Internal Monitoring","verdict":"internal","details":"Internal IP address executing regsvr32"}},{"id":"artifact_2","type":"command","value":"regsvr32 /s /n /u /i:http://internal-server.com/update.dll scrobj.dll","is_critical":false,"osint_result":{"source":"Pattern Analysis","verdict":"clean","details":"Regsvr32 command used for legitimate software update"}},{"id":"artifact_3","type":"url","value":"http://internal-server.com/update.dll","is_critical":false,"osint_result":{"source":"Internal Monitoring","verdict":"clean","details":"Internal URL used for software updates"}}],"expected_actions":["close_alert"],"expected_verdict":"false_positive","expected_category":"suspicious_activity","analysis_notes":"Regsvr32 detected from internal source, consistent with legitimate software update processes."}