{"playbook_version":2,"artifacts":[{"id":"artifact_1","type":"email","value":"alerts@trustedsource.com","is_critical":true,"osint_result":{"source":"Email Reputation","verdict":"malicious","details":"Sender domain is 3 days old and associated with phishing campaigns."}},{"id":"artifact_2","type":"email","value":"user@example.com","is_critical":false,"osint_result":{"source":"Email Reputation","verdict":"malicious","details":"Sender domain is 5 days old and associated with phishing campaigns."}},{"id":"artifact_3","type":"hash","value":"d41d8cd98f00b204e9800998ecf8427e","is_critical":null,"osint_result":{"source":"VirusTotal","verdict":"malicious","details":"60/72 security vendors identified this file as malware."}}],"expected_actions":["block_sender","reset_credentials"],"expected_verdict":"true_positive","expected_category":"phishing","analysis_notes":"Alert type indicates phishing"}