Trace 5x5h3v49

{"results":[{"id":"ob_1891","label":"excessive list result 1","score":0.75},{"id":"ob_1875","label":"excessive list result 2","score":0.49},{"id":"ob_1854","label":"excessive list result 3","score":0.56}]}

{"item":{"id":"ob_1011","status":"updated","query":"*","data_sources":["endpoints","network"],"time_range":"24h","limit":100}}

{"item":{"id":"ob_1217","status":"updated","alert_id":"ob_1891","disposition":"true_positive","priority":"high","notes":"High severity detection requiring immediate investigation"}}

{"error":{"type":"rate_limited","message":"excessive__search_indicators failed transiently"}}

{"results":[{"id":"ob_1023","label":"excessive search result 1","score":0.39}]}

{"error":{"type":"rate_limited","message":"excessive__create_investigation failed transiently"}}

{"created":{"id":"ob_1464","title":"High Severity Security Investigation","priority":"high","lead_analyst_id":"analyst_001","description":"Investigation of high severity detection ob_1891 triaged as true positive","initial_indicators":["ob_1891"]}}

{"item":{"id":"ob_1158","status":"updated","artifact_ids":["ob_1891","ob_1023"],"priority":"immediate","enrichment_sources":["virustotal","hybrid_analysis"],"include_relationships":true}}

{"item":{"id":"ob_1271","status":"updated","case_id":"ob_1464","auto_publish":false,"sharing_level":"internal","confidence_threshold":75,"expiration_days":90}}

{"item":{"id":"ob_1079","status":"active","seats":4}}

{"item":{"id":"ob_1095","status":"updated","asset_ids":["ob_1891"],"quarantine_type":"network_isolation","justification":"Isolating endpoint associated with high severity true positive detection to prevent potential lateral movement","duration_hours":24,"preserve_evidence":true}}

{"item":{"id":"ob_1216","status":"updated","query":"process_name:* AND parent_process:*","data_sources":["endpoints"],"time_range":"7d","limit":500}}