Trace 7b56igob

{"error":{"type":"permission_denied","message":"excessive__list_detections failed transiently"}}

{"results":[{"id":"ob_1289","label":"excessive search result 1","score":0.72},{"id":"ob_1351","label":"excessive search result 2","score":0.3},{"id":"ob_1006","label":"excessive search result 3","score":0.33}]}

{"results":[{"id":"ob_1322","label":"excessive list result 1","score":0.23}]}

{"error":{"type":"not_found","message":"excessive__enrich_artifacts failed transiently"}}

{"item":{"id":"ob_1237","status":"updated","query":"* | where ProcessName contains \"powershell\" or ProcessName contains \"cmd\" | where CommandLine contains \"base64\" or CommandLine contains \"encoded\"","data_sources":["endpoints","network"],"time_range":"24h","limit":100}}

{"item":{"id":"ob_1217","status":"active","seats":2}}

{"item":{"id":"ob_1170","status":"updated","alert_id":"ob_1322","disposition":"undetermined","priority":"high","notes":"Alert requires further investigation based on threat hunting results"}}

{"created":{"id":"ob_1044","title":"Suspicious PowerShell Activity Investigation","priority":"high","lead_analyst_id":"current_analyst","description":"Investigation into encoded PowerShell commands detected through threat hunting","classification":"investigation","initial_indicators":["ob_1289","ob_1237"]}}

{"item":{"id":"ob_1672","status":"updated","case_id":"ob_1044","auto_publish":false,"sharing_level":"internal","confidence_threshold":75,"expiration_days":90}}

{"error":{"type":"rate_limited","message":"excessive__quarantine_endpoints failed transiently"}}

{"item":{"id":"ob_1394","status":"updated","asset_ids":["ob_1289","ob_1237"],"quarantine_type":"network_isolation","justification":"Suspicious PowerShell activity detected with encoded commands requiring immediate containment","duration_hours":24,"notify_users":true,"preserve_evidence":true}}

{"item":{"id":"ob_1784","status":"updated","artifact_ids":["ob_1289","ob_1351","ob_1006"],"priority":"standard","include_relationships":true}}