Trace fvnyd1nc

{"results":[{"id":"ob_1474","label":"excessive list result 1","score":0.38},{"id":"ob_1255","label":"excessive list result 2","score":0.1},{"id":"ob_1161","label":"excessive list result 3","score":0.92}]}

{"results":[{"id":"ob_1025","label":"excessive search result 1","score":0.88},{"id":"ob_1091","label":"excessive search result 2","score":0.16},{"id":"ob_1296","label":"excessive search result 3","score":0.91}]}

{"item":{"id":"ob_1743","status":"updated","alert_id":"ob_1161","disposition":"true_positive","priority":"high","notes":"High-scoring detection requiring immediate investigation"}}

{"error":{"type":"permission_denied","message":"excessive__enrich_artifacts failed transiently"}}

{"item":{"id":"ob_1548","status":"updated","artifact_ids":["ob_1025","ob_1296"],"priority":"immediate","include_relationships":true}}

{"item":{"id":"ob_1118","status":"updated","query":"* | where confidence > 0.8","data_sources":["endpoints","network"],"time_range":"24h","limit":100}}

{"created":{"id":"ob_1224","title":"High-Priority Security Investigation","priority":"high","lead_analyst_id":"analyst_001","description":"Investigation based on high-scoring detections and enriched threat intelligence","classification":"investigation","initial_indicators":["ob_1025","ob_1296"]}}

{"results":[]}

{"item":{"id":"ob_1283","status":"active","seats":3}}

{"item":{"id":"ob_1710","status":"updated","case_id":"ob_1224","auto_publish":false,"sharing_level":"internal","confidence_threshold":80,"expiration_days":90}}

{"results":[{"id":"ob_1211","label":"excessive list result 1","score":0.12},{"id":"ob_1739","label":"excessive list result 2","score":0.08}]}

{"results":[{"id":"ob_1178","label":"excessive search result 1","score":0.25},{"id":"ob_1321","label":"excessive search result 2","score":0.78}]}

{"item":{"id":"ob_1749","status":"updated","alert_id":"ob_1321","disposition":"true_positive","priority":"critical","notes":"High-scoring APT-related hash indicator requiring immediate escalation","escalate_to_case":true}}

{"item":{"id":"ob_1086","status":"updated","query":"* | where indicator_type == 'hash' and confidence > 0.75 and malware_family contains 'APT'","data_sources":["endpoints","network","dns"],"time_range":"7d","limit":250}}

{"item":{"id":"ob_1780","status":"updated","artifact_ids":["ob_1321","ob_1178"],"priority":"immediate","enrichment_sources":["virustotal","hybrid_analysis","recorded_future"],"include_relationships":true}}

{"error":{"type":"rate_limited","message":"excessive__create_investigation failed transiently"}}

{"created":{"id":"ob_1220","title":"APT Hash Indicator Investigation","priority":"critical","lead_analyst_id":"analyst_002","description":"Investigation of high-confidence APT-related hash indicators with threat hunting correlation","classification":"incident","initial_indicators":["ob_1321","ob_1178"],"affected_assets":["endpoint_001","endpoint_002"]}}

{"item":{"id":"ob_1271","status":"updated","asset_ids":["endpoint_001","endpoint_002"],"quarantine_type":"full_isolation","justification":"Critical APT-related hash indicators detected with high confidence scores requiring immediate containment","duration_hours":48,"preserve_evidence":true,"notify_users":true}}

{"item":{"id":"ob_1645","status":"active","seats":3}}

{"item":{"id":"ob_1199","status":"updated","case_id":"ob_1220","auto_publish":false,"sharing_level":"internal","confidence_threshold":85,"expiration_days":60,"artifact_types":["file_hashes","network_traffic","domains","ips"]}}