Trace fa4scobz

{"results":[{"id":"ob_1436","label":"excessive list result 1","score":0.95},{"id":"ob_1096","label":"excessive list result 2","score":0.41}]}

{"error":{"type":"rate_limited","message":"excessive__search_indicators failed transiently"}}

{"item":{"id":"ob_1378","status":"updated","query":"DeviceEvents | where ActionType contains \"PowerShell\" | where ProcessCommandLine contains \"encoded\" | limit 100","data_sources":["endpoints"],"time_range":"24h"}}

{"item":{"id":"ob_1292","status":"updated","alert_id":"ob_1436","disposition":"true_positive","priority":"critical","notes":"High confidence detection requiring immediate investigation"}}

{"results":[]}

{"item":{"id":"ob_1061","status":"updated","asset_ids":["endpoint_001"],"quarantine_type":"network_isolation","justification":"Critical security alert ob_1436 triaged as true positive with PowerShell encoded command activity detected","duration_hours":24,"preserve_evidence":true}}

{"error":{"type":"timeout","message":"excessive__enrich_artifacts failed transiently"}}

{"item":{"id":"ob_1307","status":"updated","case_id":"ob_1292","auto_publish":false,"sharing_level":"internal","artifact_types":["network_traffic","file_hashes","processes","domains"],"confidence_threshold":80,"expiration_days":90}}

{"item":{"id":"ob_1274","status":"active","seats":3}}

{"results":[{"id":"ob_1327","label":"excessive search result 1","score":0.12},{"id":"ob_1638","label":"excessive search result 2","score":0.26}]}

{"results":[{"id":"ob_1652","label":"excessive list result 1","score":0.32}]}

{"error":{"type":"not_found","message":"excessive__hunt_threats failed transiently"}}

{"item":{"id":"ob_1061","status":"updated","artifact_ids":["ob_1436","ob_1378"],"priority":"immediate","enrichment_sources":["virustotal","hybrid_analysis"],"include_relationships":true}}

{"item":{"id":"ob_1765","status":"updated","query":"SecurityEvent | where EventID == 4688 | where CommandLine contains \"powershell\" and CommandLine contains \"-enc\" | summarize count() by Computer, CommandLine | limit 50","data_sources":["endpoints","network"],"time_range":"7d"}}

{"item":{"id":"ob_1847","status":"updated","alert_id":"ob_1652","disposition":"undetermined","priority":"high","notes":"New high-severity detection requiring investigation alongside existing PowerShell encoded command incident"}}

{"created":{"id":"ob_1686","title":"Extended PowerShell Threat Analysis","priority":"high","lead_analyst_id":"analyst_001","description":"Follow-up investigation to analyze broader PowerShell encoded command patterns identified through extended threat hunting","classification":"investigation","initial_indicators":["ob_1652","ob_1765"],"affected_assets":["endpoint_001"]}}

{"error":{"type":"rate_limited","message":"excessive__generate_iocs failed transiently"}}

{"item":{"id":"ob_1702","status":"active","seats":4}}

{"error":{"type":"rate_limited","message":"excessive__generate_iocs failed transiently"}}

{"error":{"type":"upstream_5xx","message":"excessive__quarantine_endpoints failed transiently"}}

{"results":[{"id":"ob_1436","label":"excessive search result 1","score":0.95},{"id":"ob_1096","label":"excessive search result 2","score":0.41}]}

{"error":{"type":"rate_limited","message":"excessive__list_detections failed transiently"}}

{"item":{"id":"ob_1378","status":"updated","query":"DeviceEvents | where ActionType contains \"PowerShell\" | where ProcessCommandLine contains \"encoded\" or ProcessCommandLine contains \"-enc\" | project Timestamp, DeviceName, ProcessCommandLine, AccountName | limit 200","data_sources":["endpoints"],"time_range":"24h"}}

{"item":{"id":"ob_1292","status":"updated","alert_id":"ob_1096","disposition":"undetermined","priority":"medium","notes":"Medium confidence indicator from domain search requiring further analysis in context of ongoing PowerShell investigation"}}

{"results":[]}

{"created":{"id":"ob_1061","title":"Comprehensive PowerShell Threat Campaign Analysis","priority":"critical","lead_analyst_id":"analyst_001","description":"Consolidated investigation of all PowerShell encoded command activities and related indicators identified across multiple detection cycles","classification":"incident","initial_indicators":["ob_1436","ob_1096","ob_1378","ob_1765"],"affected_assets":["endpoint_001"]}}

{"error":{"type":"timeout","message":"excessive__generate_iocs failed transiently"}}

{"item":{"id":"ob_1307","status":"updated","asset_ids":["endpoint_001"],"quarantine_type":"full_isolation","justification":"Comprehensive PowerShell threat campaign analysis case ob_1061 requires maximum containment due to critical priority and multiple related indicators","duration_hours":72,"preserve_evidence":true}}

{"item":{"id":"ob_1735","status":"active","seats":4}}

{"error":{"type":"rate_limited","message":"excessive__search_indicators failed transiently"}}

{"item":{"id":"ob_1223","status":"updated","query":"DeviceEvents | where ActionType contains \"PowerShell\" | where ProcessCommandLine contains \"encoded\" or ProcessCommandLine contains \"-enc\" | summarize EventCount=count() by DeviceName, ProcessCommandLine, AccountName | order by EventCount desc | limit 100","data_sources":["endpoints","network"],"time_range":"7d"}}

{"results":[{"id":"ob_1299","label":"excessive list result 1","score":0.79},{"id":"ob_1067","label":"excessive list result 2","score":0.99},{"id":"ob_1483","label":"excessive list result 3","score":0.78}]}