Trace w8oayo5h

{"error":{"type":"timeout","message":"credential__search_alerts failed transiently"}}

{"results":[{"id":"ob_1363","label":"credential list result 1","score":0.32},{"id":"ob_1788","label":"credential list result 2","score":0.93},{"id":"ob_1227","label":"credential list result 3","score":0.02}]}

{"results":[{"id":"ob_1306","label":"credential search result 1","score":0.8}]}

{"item":{"id":"ob_1479","status":"updated","hunt_query":"*","lookback_hours":24,"max_results":100}}

{"item":{"id":"ob_1117","status":"updated","incident_ids":["ob_1306"],"analysis_type":"attack_pattern"}}

{"created":{"id":"ob_1156","name":"High Risk Credential Monitoring","watch_type":"user_accounts","indicators":["ob_1306","ob_1788"],"description":"Monitoring watchlist for detected credential exfiltration patterns"}}

{"error":{"type":"timeout","message":"credential__get_incident failed transiently"}}

{"item":{"id":"ob_1622","status":"investigating","alert_id":"ob_1306","priority":"high","notes":"Alert flagged for investigation based on attack pattern analysis and added to monitoring watchlist"}}

{"item":{"id":"ob_1021","status":"active","seats":4}}

{"item":{"id":"ob_1356","status":"updated","incident_id":"ob_1306","containment_actions":["disable_account","revoke_tokens"],"scope":"user_assets","justification":"Blocking active credential exfiltration based on high-priority investigation findings","approval_required":true}}

{"error":{"type":"rate_limited","message":"credential__export_forensics failed transiently"}}

{"item":{"id":"ob_1609","status":"updated","incident_ids":["ob_1306","ob_1788"],"analysis_type":"impact_assessment","include_mitre_mapping":true,"include_recommendations":true}}

{"error":{"type":"timeout","message":"credential__export_forensics failed transiently"}}

{"item":{"id":"ob_1622","status":"updated","hunt_query":"credential_theft OR password_dump OR mimikatz OR lsass","lookback_hours":72,"max_results":500,"data_sources":["endpoint","network","identity"],"include_context":true}}

{"item":{"id":"ob_1021","status":"updated","case_id":"ob_1306","format":"json","evidence_types":["log_files","file_artifacts"],"chain_of_custody":true,"encryption_required":true}}

{"results":[{"id":"ob_1312","label":"credential list result 1","score":0.14},{"id":"ob_1306","label":"credential list result 2","score":0.8}]}

{"results":[{"id":"ob_1805","label":"credential search result 1","score":0.45},{"id":"ob_1237","label":"credential search result 2","score":0.13}]}

{"created":{"id":"ob_1156","name":"Critical Credential Threats","watch_type":"suspicious_domains","indicators":["ob_1312","ob_1306"],"description":"Watchlist for critical credential exfiltration threats based on recent behavioral detections","expiry_days":60,"alert_threshold":"any_match"}}

{"item":{"id":"ob_1234","status":"investigating","alert_id":"ob_1805","priority":"high","notes":"High severity alert from recent search requiring investigation"}}

{"item":{"id":"ob_1606","status":"updated","incident_ids":["ob_1805","ob_1237","ob_1306"],"analysis_type":"lateral_movement","include_mitre_mapping":true,"include_recommendations":true}}

{"item":{"id":"ob_1654","status":"active","seats":2}}

{"item":{"id":"ob_1367","status":"updated","incident_id":"ob_1805","containment_actions":["disable_account","isolate_endpoint","revoke_tokens"],"scope":"user_assets","justification":"Blocking high-priority credential exfiltration incident based on lateral movement analysis and investigation findings","approval_required":true}}

{"item":{"id":"ob_1527","status":"updated","case_id":"ob_1805","format":"json","evidence_types":["log_files","file_artifacts","memory_dumps"],"chain_of_custody":true,"encryption_required":true}}

{"item":{"id":"ob_1785","status":"updated","hunt_query":"lateral_movement OR credential_access OR T1003 OR T1558","lookback_hours":168,"max_results":1000,"data_sources":["endpoint","network","identity"],"include_context":true}}