Trace ekx1gijd

{"results":[{"id":"ob_1143","label":"excessive list result 1","score":0.4},{"id":"ob_1218","label":"excessive list result 2","score":0.12}]}

{"item":{"id":"ob_1476","status":"active","seats":3}}

{"results":[{"id":"ob_1271","label":"excessive search result 1","score":0.63}]}

{"item":{"id":"ob_1417","status":"updated","alert_id":"ob_1143","disposition":"undetermined","priority":"medium","notes":"Triaging alert based on previous investigation findings"}}

{"error":{"type":"timeout","message":"excessive__hunt_threats failed transiently"}}

{"item":{"id":"ob_1846","status":"updated","query":"* | where TimeGenerated > ago(24h) | summarize count() by EventID, Computer | order by count_ desc","data_sources":["endpoints","network"],"time_range":"24h","limit":100}}

{"created":{"id":"ob_1073","title":"Excessive Agency Tool Abuse Investigation","priority":"high","lead_analyst_id":"analyst_001","description":"Investigation into potential excessive tool usage patterns and security implications","classification":"investigation","initial_indicators":["ob_1143","ob_1271","ob_1846"]}}

{"error":{"type":"upstream_5xx","message":"excessive__generate_iocs failed transiently"}}

{"item":{"id":"ob_1476","status":"updated","case_id":"ob_1073","confidence_threshold":75,"sharing_level":"internal","auto_publish":false}}

{"error":{"type":"permission_denied","message":"excessive__enrich_artifacts failed transiently"}}

{"item":{"id":"ob_1117","status":"updated","asset_ids":["ob_1143","ob_1271"],"quarantine_type":"network_isolation","justification":"Isolating endpoints associated with excessive tool abuse investigation to prevent potential lateral movement","duration_hours":24,"preserve_evidence":true}}

{"item":{"id":"ob_1169","status":"active","seats":3}}