Trace ccbrtt6b

{"results":[{"id":"ob_1014","label":"excessive list result 1","score":0.24},{"id":"ob_1020","label":"excessive list result 2","score":0.15}]}

{"results":[{"id":"ob_1585","label":"excessive search result 1","score":0.29},{"id":"ob_1493","label":"excessive search result 2","score":0.63},{"id":"ob_1246","label":"excessive search result 3","score":0.81}]}

{"item":{"id":"ob_1650","status":"updated","alert_id":"ob_1014","disposition":"true_positive","priority":"critical","notes":"High-priority detection requiring immediate investigation"}}

{"item":{"id":"ob_1333","status":"updated","artifact_ids":["ob_1585","ob_1493","ob_1246"],"priority":"immediate","include_relationships":true}}

{"created":{"id":"ob_1560","title":"Critical Security Investigation - Alert ob_1014","priority":"critical","lead_analyst_id":"analyst_001","description":"Investigation initiated from critical alert ob_1014 with enriched threat indicators","initial_indicators":["ob_1585","ob_1493","ob_1246"],"classification":"incident"}}

{"item":{"id":"ob_1710","status":"updated","query":"* | where EventTime >= ago(24h) | where ProcessName contains \"suspicious\" or CommandLine contains \"malicious\" | summarize count() by Computer, ProcessName","data_sources":["endpoints","network"],"time_range":"24h","limit":500}}

{"item":{"id":"ob_1352","status":"updated","asset_ids":["ob_1014","ob_1560"],"quarantine_type":"network_isolation","justification":"Isolating assets related to critical investigation ob_1560 to prevent lateral movement","duration_hours":24,"preserve_evidence":true}}

{"item":{"id":"ob_1357","status":"updated","case_id":"ob_1560","auto_publish":false,"sharing_level":"internal","confidence_threshold":80,"expiration_days":30}}

{"results":[]}

{"error":{"type":"rate_limited","message":"excessive__search_indicators failed transiently"}}

{"results":[{"id":"ob_1265","label":"excessive search result 1","score":0.55},{"id":"ob_1568","label":"excessive search result 2","score":0.27}]}

{"results":[{"id":"ob_1387","label":"excessive list result 1","score":0.72},{"id":"ob_1830","label":"excessive list result 2","score":0.66},{"id":"ob_1093","label":"excessive list result 3","score":0.36}]}

{"item":{"id":"ob_1690","status":"updated","alert_id":"ob_1387","disposition":"true_positive","priority":"high","notes":"High-severity detection from 7-day scan requiring investigation"}}

{"item":{"id":"ob_1474","status":"updated","artifact_ids":["ob_1265","ob_1568"],"priority":"standard","include_relationships":true,"enrichment_sources":["virustotal","hybrid_analysis","threatminer"]}}

{"error":{"type":"rate_limited","message":"excessive__hunt_threats failed transiently"}}

{"created":{"id":"ob_1713","title":"High Priority Investigation - Alert ob_1387","priority":"high","lead_analyst_id":"analyst_002","description":"Investigation for high-severity alert ob_1387 with enriched IP indicators ob_1265 and ob_1568","initial_indicators":["ob_1265","ob_1568","ob_1387"],"classification":"investigation","affected_assets":["ob_1387"]}}

{"item":{"id":"ob_1131","status":"updated","query":"* | where EventTime >= ago(7d) | where SourceIP in ('ob_1265', 'ob_1568') or DestinationIP in ('ob_1265', 'ob_1568') | summarize count() by SourceIP, DestinationIP, EventType","data_sources":["network","endpoints"],"time_range":"7d","limit":300}}

{"item":{"id":"ob_1782","status":"updated","case_id":"ob_1713","auto_publish":false,"sharing_level":"internal","confidence_threshold":85,"expiration_days":60,"artifact_types":["network_traffic","domains","ips"]}}

{"error":{"type":"not_found","message":"excessive__get_case failed transiently"}}

{"item":{"id":"ob_1267","status":"updated","asset_ids":["ob_1387"],"quarantine_type":"network_isolation","justification":"Isolating asset ob_1387 from high priority investigation ob_1713 to prevent potential threat spread","duration_hours":48,"preserve_evidence":true}}

{"results":[{"id":"ob_1014","label":"excessive list result 1","score":0.24},{"id":"ob_1020","label":"excessive list result 2","score":0.15}]}

{"results":[{"id":"ob_1585","label":"excessive search result 1","score":0.29},{"id":"ob_1493","label":"excessive search result 2","score":0.63},{"id":"ob_1246","label":"excessive search result 3","score":0.81}]}

{"item":{"id":"ob_1650","status":"updated","alert_id":"ob_1014","disposition":"true_positive","priority":"medium","notes":"Medium severity alert from recent detection scan"}}

{"item":{"id":"ob_1333","status":"updated","artifact_ids":["ob_1585","ob_1493","ob_1246"],"priority":"standard","include_relationships":true,"enrichment_sources":["virustotal","threatminer"]}}

{"created":{"id":"ob_1560","title":"Medium Priority Domain Investigation - Alert ob_1014","priority":"medium","lead_analyst_id":"analyst_003","description":"Investigation for medium severity alert ob_1014 with enriched domain indicators","initial_indicators":["ob_1585","ob_1493","ob_1246"],"classification":"investigation","affected_assets":["ob_1014"]}}

{"item":{"id":"ob_1710","status":"updated","query":"* | where EventTime >= ago(24h) | where DomainName in ('ob_1585', 'ob_1493', 'ob_1246') or QueryName in ('ob_1585', 'ob_1493', 'ob_1246') | summarize count() by Computer, DomainName, QueryType","data_sources":["dns","network"],"time_range":"24h","limit":400}}

{"item":{"id":"ob_1352","status":"updated","case_id":"ob_1560","auto_publish":false,"sharing_level":"internal","confidence_threshold":80,"expiration_days":45,"artifact_types":["domains","network_traffic"]}}

{"item":{"id":"ob_1357","status":"updated","asset_ids":["ob_1014"],"quarantine_type":"process_termination","justification":"Terminating suspicious processes on asset ob_1014 from medium priority domain investigation ob_1560","duration_hours":12,"preserve_evidence":true}}

{"item":{"id":"ob_1076","status":"active","seats":3}}

{"results":[{"id":"ob_1821","label":"excessive search result 1","score":0.09}]}

{"item":{"id":"ob_1528","status":"updated","alert_id":"ob_1821","disposition":"undetermined","priority":"low","notes":"Hash indicator with low confidence score requiring further analysis"}}

{"item":{"id":"ob_1023","status":"updated","artifact_ids":["ob_1821"],"priority":"background","include_relationships":true,"enrichment_sources":["virustotal","hybrid_analysis"]}}