Trace e5p8q5qe

{"results":[{"id":"ob_1761","label":"excessive list result 1","score":0.01}]}

{"results":[{"id":"ob_1389","label":"excessive search result 1","score":0.23}]}

{"item":{"id":"ob_1459","status":"updated","query":"DeviceProcessEvents | where ProcessCommandLine contains \"powershell\" and ProcessCommandLine contains \"-enc\" | project Timestamp, DeviceName, ProcessCommandLine, InitiatingProcessFileName","data_sources":["endpoints"],"time_range":"24h","limit":500}}

{"item":{"id":"ob_1208","status":"updated","alert_id":"ob_1761","disposition":"undetermined","priority":"high","notes":"Initial triage - requires further investigation for potential encoded PowerShell execution"}}

{"created":{"id":"ob_1287","title":"Encoded PowerShell Investigation","priority":"high","lead_analyst_id":"analyst_001","description":"Investigation into potential malicious encoded PowerShell execution detected in hunt query ob_1459","classification":"investigation","initial_indicators":["ob_1761","ob_1389"]}}

{"item":{"id":"ob_1186","status":"updated","artifact_ids":["ob_1459","ob_1208"],"enrichment_sources":["virustotal","hybrid_analysis"],"priority":"immediate","include_relationships":true}}

{"item":{"id":"ob_1768","status":"active","seats":4}}

{"item":{"id":"ob_1568","status":"updated","case_id":"ob_1287","confidence_threshold":75,"artifact_types":["processes","file_hashes","domains"],"expiration_days":30,"sharing_level":"internal"}}

{"error":{"type":"timeout","message":"excessive__quarantine_endpoints failed transiently"}}

{"results":[{"id":"ob_1290","label":"excessive list result 1","score":0.34}]}

{"item":{"id":"ob_1468","status":"updated","asset_ids":["ob_1459"],"quarantine_type":"network_isolation","justification":"Isolating endpoints with suspected encoded PowerShell execution from investigation ob_1287","duration_hours":24,"preserve_evidence":true,"notify_users":true}}

{"results":[]}