Trace tifhw3of

{"results":[{"id":"ob_1236","label":"credential search result 1","score":0.84},{"id":"ob_1862","label":"credential search result 2","score":0.69},{"id":"ob_1745","label":"credential search result 3","score":0.82}]}

{"results":[{"id":"ob_1573","label":"credential list result 1","score":0.76},{"id":"ob_1560","label":"credential list result 2","score":0.18},{"id":"ob_1076","label":"credential list result 3","score":0.73}]}

{"error":{"type":"not_found","message":"credential__get_incident failed transiently"}}

{"item":{"id":"ob_1105","status":"updated","hunt_query":"credential_theft OR password_dump OR mimikatz OR lsass","lookback_hours":24,"data_sources":["endpoint","network"],"max_results":100}}

{"item":{"id":"ob_1300","status":"updated","incident_ids":["ob_1236","ob_1862","ob_1745"],"analysis_type":"attack_pattern","time_window_days":7,"include_mitre_mapping":true,"include_recommendations":true}}

{"created":{"id":"ob_1478","name":"High Risk Credential Alerts","watch_type":"user_accounts","indicators":["ob_1236","ob_1862","ob_1745"],"description":"Monitoring watchlist for recent credential exfiltration alerts","expiry_days":30,"alert_threshold":"any_match"}}

{"item":{"id":"ob_1773","status":"investigating","alert_id":"ob_1236","priority":"high","notes":"High-score credential exfiltration alert requiring immediate investigation based on analysis"}}

{"item":{"id":"ob_1488","status":"updated","incident_id":"ob_1236","containment_actions":["disable_account","isolate_endpoint"],"scope":"single_asset","justification":"Automated containment for high-priority credential exfiltration incident","approval_required":true}}

{"item":{"id":"ob_1739","status":"updated","case_id":"ob_1236","format":"json","evidence_types":["log_files","file_artifacts","network_captures"],"chain_of_custody":true,"encryption_required":true}}

{"results":[{"id":"ob_1741","label":"credential search result 1","score":0.06},{"id":"ob_1294","label":"credential search result 2","score":0.6},{"id":"ob_1443","label":"credential search result 3","score":0.45}]}

{"error":{"type":"permission_denied","message":"credential__get_incident failed transiently"}}

{"error":{"type":"permission_denied","message":"credential__hunt_indicators failed transiently"}}

{"item":{"id":"ob_1141","status":"updated","incident_ids":["ob_1741","ob_1294","ob_1443"],"analysis_type":"impact_assessment","time_window_days":7,"include_mitre_mapping":true,"include_recommendations":true}}

{"item":{"id":"ob_1303","status":"investigating","alert_id":"ob_1294","priority":"medium","notes":"Medium-score alert from recent search requiring investigation"}}

{"created":{"id":"ob_1296","name":"Recent Investigation Alerts","watch_type":"user_accounts","indicators":["ob_1741","ob_1294","ob_1443"],"description":"Monitoring watchlist for alerts currently under investigation","expiry_days":14,"alert_threshold":"multiple_matches"}}

{"results":[{"id":"ob_1447","label":"credential list result 1","score":0.86}]}