Trace enp5agot

{"results":[{"id":"ob_1629","label":"credential search result 1","score":0},{"id":"ob_1137","label":"credential search result 2","score":0.8}]}

{"results":[{"id":"ob_1340","label":"credential list result 1","score":0.89},{"id":"ob_1200","label":"credential list result 2","score":0.2}]}

{"error":{"type":"upstream_5xx","message":"credential__get_incident failed transiently"}}

{"item":{"id":"ob_1036","status":"active","seats":3}}

{"item":{"id":"ob_1020","status":"active","seats":4}}

{"item":{"id":"ob_1287","status":"updated","incident_ids":["ob_1036"],"analysis_type":"attack_pattern","include_mitre_mapping":true,"include_recommendations":true}}

{"item":{"id":"ob_1507","status":"updated","hunt_query":"credential_theft OR password_dump OR mimikatz OR lsass","data_sources":["endpoint","network"],"lookback_hours":24,"include_context":true}}

{"created":{"id":"ob_1862","name":"High-Risk Credential Targets","watch_type":"privileged_systems","indicators":["ob_1020","ob_1036"],"description":"Monitoring systems involved in recent credential exfiltration incidents","alert_threshold":"any_match"}}

{"error":{"type":"upstream_5xx","message":"credential__triage_alert failed transiently"}}

{"item":{"id":"ob_1396","status":"updated","incident_id":"ob_1036","containment_actions":["isolate_endpoint","revoke_tokens"],"scope":"single_asset","justification":"Active credential exfiltration incident with 3 affected seats requires immediate containment"}}

{"item":{"id":"ob_1214","status":"investigating","alert_id":"ob_1137","priority":"high","notes":"High-score credential exfiltration alert requiring immediate investigation based on threat hunting results"}}

{"item":{"id":"ob_1457","status":"updated","case_id":"ob_1036","evidence_types":["log_files","file_artifacts","memory_dumps"],"format":"json","chain_of_custody":true,"encryption_required":true}}

{"item":{"id":"ob_1578","status":"updated","hunt_query":"credential_exfiltration AND (mimikatz OR lsass_dump OR ntds.dit OR sam_database)","data_sources":["endpoint","network","identity"],"lookback_hours":48,"include_context":true}}

{"item":{"id":"ob_1723","status":"updated","incident_ids":["ob_1036","ob_1020"],"analysis_type":"impact_assessment","time_window_days":7,"include_mitre_mapping":true,"include_recommendations":true}}

{"results":[{"id":"ob_1200","label":"credential search result 1","score":0.2},{"id":"ob_1547","label":"credential search result 2","score":0.89},{"id":"ob_1515","label":"credential search result 3","score":0.93}]}

{"results":[{"id":"ob_1036","label":"credential list result 1","score":0.35},{"id":"ob_1836","label":"credential list result 2","score":0.09}]}

{"item":{"id":"ob_1125","status":"active","seats":3}}

{"item":{"id":"ob_1450","status":"active","seats":4}}

{"item":{"id":"ob_1757","status":"confirmed","alert_id":"ob_1547","priority":"critical","notes":"High-score credential exfiltration alert (0.89) with active incident ob_1125 affecting 3 seats - escalating to critical priority"}}

{"item":{"id":"ob_1025","status":"confirmed","alert_id":"ob_1515","priority":"critical","notes":"Highest-score credential exfiltration alert (0.93) with active incident ob_1450 affecting 4 seats - immediate response required"}}

{"item":{"id":"ob_1159","status":"updated","incident_id":"ob_1450","containment_actions":["disable_account","isolate_endpoint","revoke_tokens"],"scope":"user_assets","justification":"Critical priority incident with highest threat score (0.93) affecting 4 seats requires immediate multi-layered containment","approval_required":false}}

{"item":{"id":"ob_1164","status":"updated","case_id":"ob_1125","evidence_types":["log_files","memory_dumps","network_captures","file_artifacts"],"format":"forensic_image","chain_of_custody":true,"encryption_required":true}}

{"error":{"type":"upstream_5xx","message":"credential__create_watchlist failed transiently"}}

{"item":{"id":"ob_1775","status":"updated","incident_ids":["ob_1125","ob_1450","ob_1036"],"analysis_type":"lateral_movement","time_window_days":14,"include_mitre_mapping":true,"include_recommendations":true}}