{"entities":[{"entityId":"bucket:corp-documents","type":"bucket","normalizedValue":"corp-documents","aliases":["corp-documents"],"observationRefs":["EVT-0209","EVT-0206","EVT-0216","EVT-0210","EVT-0199","EVT-0215","EVT-0194","EVT-0204","EVT-0191","EVT-0208","EVT-0198","EVT-0202","EVT-0203","EVT-0220","EVT-0217","EVT-0197","EVT-0218","EVT-0219","EVT-0205","EVT-0200","EVT-0192","EVT-0214","EVT-0195","EVT-0201","EVT-0213","EVT-0196","EVT-0207","EVT-0211","EVT-0212","EVT-0193"],"relationshipRefs":[],"firstObserved":"2026-06-10T08:50:44.249433Z","lastObserved":"2026-06-13T05:39:45.933394Z","degree":0},{"entityId":"bucket:ext-drop-xf9q2","type":"bucket","normalizedValue":"ext-drop-xf9q2","aliases":["ext-drop-xf9q2"],"observationRefs":["EVT-0238"],"relationshipRefs":["rel_9b04eaf1d95b73db"],"firstObserved":"2026-06-10T18:18:44Z","lastObserved":"2026-06-10T18:18:44Z","degree":1},{"entityId":"cloud_object:corp-documents/Client_Proposal_Acme.docx","type":"cloud_object","normalizedValue":"corp-documents/Client_Proposal_Acme.docx","aliases":["corp-documents/Client_Proposal_Acme.docx"],"observationRefs":["EVT-0199","EVT-0202","EVT-0220","EVT-0218","EVT-0214","EVT-0207"],"relationshipRefs":[],"firstObserved":"2026-06-10T12:18:41.520558Z","lastObserved":"2026-06-12T22:59:45.883199Z","degree":0},{"entityId":"cloud_object:corp-documents/HR_Policy_Update.pdf","type":"cloud_object","normalizedValue":"corp-documents/HR_Policy_Update.pdf","aliases":["corp-documents/HR_Policy_Update.pdf"],"observationRefs":["EVT-0192","EVT-0201","EVT-0213"],"relationshipRefs":[],"firstObserved":"2026-06-12T09:04:13.235052Z","lastObserved":"2026-06-12T15:48:17.786338Z","degree":0},{"entityId":"cloud_object:corp-documents/Meeting_Notes_Jun10.docx","type":"cloud_object","normalizedValue":"corp-documents/Meeting_Notes_Jun10.docx","aliases":["corp-documents/Meeting_Notes_Jun10.docx"],"observationRefs":["EVT-0215","EVT-0208","EVT-0197","EVT-0212","EVT-0193"],"relationshipRefs":[],"firstObserved":"2026-06-10T12:29:17.435280Z","lastObserved":"2026-06-13T05:39:45.933394Z","degree":0},{"entityId":"cloud_object:corp-documents/Product_Roadmap_v3.pptx","type":"cloud_object","normalizedValue":"corp-documents/Product_Roadmap_v3.pptx","aliases":["corp-documents/Product_Roadmap_v3.pptx"],"observationRefs":["EVT-0194","EVT-0191","EVT-0198","EVT-0203","EVT-0200","EVT-0211"],"relationshipRefs":[],"firstObserved":"2026-06-10T20:42:23.024628Z","lastObserved":"2026-06-13T02:42:29.565021Z","degree":0},{"entityId":"cloud_object:corp-documents/Q2_Budget_Draft.xlsx","type":"cloud_object","normalizedValue":"corp-documents/Q2_Budget_Draft.xlsx","aliases":["corp-documents/Q2_Budget_Draft.xlsx"],"observationRefs":["EVT-0216","EVT-0210","EVT-0217","EVT-0205","EVT-0195","EVT-0196"],"relationshipRefs":[],"firstObserved":"2026-06-10T09:51:41.372814Z","lastObserved":"2026-06-12T22:00:13.327519Z","degree":0},{"entityId":"cloud_object:corp-documents/Team_OKRs_2026.xlsx","type":"cloud_object","normalizedValue":"corp-documents/Team_OKRs_2026.xlsx","aliases":["corp-documents/Team_OKRs_2026.xlsx"],"observationRefs":["EVT-0209","EVT-0206","EVT-0204","EVT-0219"],"relationshipRefs":[],"firstObserved":"2026-06-10T08:50:44.249433Z","lastObserved":"2026-06-12T00:13:31.309003Z","degree":0},{"entityId":"cloud_object:ext-drop-xf9q2/backup_archive.zip","type":"cloud_object","normalizedValue":"ext-drop-xf9q2/backup_archive.zip","aliases":["ext-drop-xf9q2/backup_archive.zip"],"observationRefs":["EVT-0238"],"relationshipRefs":["rel_9b04eaf1d95b73db"],"firstObserved":"2026-06-10T18:18:44Z","lastObserved":"2026-06-10T18:18:44Z","degree":1},{"entityId":"endpoint:10.0.1.11:25","type":"endpoint","normalizedValue":"10.0.1.11:25","aliases":["10.0.1.11:25"],"observationRefs":["EVT-0120"],"relationshipRefs":[],"firstObserved":"2026-06-13T02:45:58.680196Z","lastObserved":"2026-06-13T02:45:58.680196Z","degree":0},{"entityId":"endpoint:10.0.1.16:25","type":"endpoint","normalizedValue":"10.0.1.16:25","aliases":["10.0.1.16:25"],"observationRefs":["EVT-0121"],"relationshipRefs":[],"firstObserved":"2026-06-12T12:02:46.441429Z","lastObserved":"2026-06-12T12:02:46.441429Z","degree":0},{"entityId":"endpoint:10.0.1.17:443","type":"endpoint","normalizedValue":"10.0.1.17:443","aliases":["10.0.1.17:443"],"observationRefs":["EVT-0132"],"relationshipRefs":[],"firstObserved":"2026-06-10T19:20:59.796200Z","lastObserved":"2026-06-10T19:20:59.796200Z","degree":0},{"entityId":"endpoint:10.0.1.17:53","type":"endpoint","normalizedValue":"10.0.1.17:53","aliases":["10.0.1.17:53"],"observationRefs":["EVT-0076"],"relationshipRefs":[],"firstObserved":"2026-06-10T17:00:41.935055Z","lastObserved":"2026-06-10T17:00:41.935055Z","degree":0},{"entityId":"endpoint:10.0.1.18:22","type":"endpoint","normalizedValue":"10.0.1.18:22","aliases":["10.0.1.18:22"],"observationRefs":["EVT-0130"],"relationshipRefs":[],"firstObserved":"2026-06-10T10:21:25.734447Z","lastObserved":"2026-06-10T10:21:25.734447Z","degree":0},{"entityId":"endpoint:10.0.1.18:80","type":"endpoint","normalizedValue":"10.0.1.18:80","aliases":["10.0.1.18:80"],"observationRefs":["EVT-0093","EVT-0117"],"relationshipRefs":[],"firstObserved":"2026-06-11T20:36:15.876223Z","lastObserved":"2026-06-11T21:27:27.580114Z","degree":0},{"entityId":"endpoint:10.0.1.22:22","type":"endpoint","normalizedValue":"10.0.1.22:22","aliases":["10.0.1.22:22"],"observationRefs":["EVT-0113"],"relationshipRefs":[],"firstObserved":"2026-06-12T00:57:06.986281Z","lastObserved":"2026-06-12T00:57:06.986281Z","degree":0},{"entityId":"endpoint:10.0.1.22:445","type":"endpoint","normalizedValue":"10.0.1.22:445","aliases":["10.0.1.22:445"],"observationRefs":["EVT-0231"],"relationshipRefs":["rel_e01f16b7077efdad"],"firstObserved":"2026-06-10T13:11:33Z","lastObserved":"2026-06-10T13:11:33Z","degree":1},{"entityId":"endpoint:10.0.1.25:443","type":"endpoint","normalizedValue":"10.0.1.25:443","aliases":["10.0.1.25:443"],"observationRefs":["EVT-0067"],"relationshipRefs":[],"firstObserved":"2026-06-11T03:18:15.219184Z","lastObserved":"2026-06-11T03:18:15.219184Z","degree":0},{"entityId":"endpoint:10.0.1.26:443","type":"endpoint","normalizedValue":"10.0.1.26:443","aliases":["10.0.1.26:443"],"observationRefs":["EVT-0127"],"relationshipRefs":[],"firstObserved":"2026-06-11T15:04:19.669750Z","lastObserved":"2026-06-11T15:04:19.669750Z","degree":0},{"entityId":"endpoint:10.0.1.26:53","type":"endpoint","normalizedValue":"10.0.1.26:53","aliases":["10.0.1.26:53"],"observationRefs":["EVT-0131"],"relationshipRefs":[],"firstObserved":"2026-06-10T21:27:34.395616Z","lastObserved":"2026-06-10T21:27:34.395616Z","degree":0},{"entityId":"endpoint:10.0.1.26:80","type":"endpoint","normalizedValue":"10.0.1.26:80","aliases":["10.0.1.26:80"],"observationRefs":["EVT-0064"],"relationshipRefs":[],"firstObserved":"2026-06-12T23:58:44.972517Z","lastObserved":"2026-06-12T23:58:44.972517Z","degree":0},{"entityId":"endpoint:10.0.1.28:22","type":"endpoint","normalizedValue":"10.0.1.28:22","aliases":["10.0.1.28:22"],"observationRefs":["EVT-0077"],"relationshipRefs":[],"firstObserved":"2026-06-12T08:06:15.898200Z","lastObserved":"2026-06-12T08:06:15.898200Z","degree":0},{"entityId":"endpoint:10.0.1.28:80","type":"endpoint","normalizedValue":"10.0.1.28:80","aliases":["10.0.1.28:80"],"observationRefs":["EVT-0139"],"relationshipRefs":[],"firstObserved":"2026-06-10T20:27:01.216356Z","lastObserved":"2026-06-10T20:27:01.216356Z","degree":0},{"entityId":"endpoint:10.0.1.29:443","type":"endpoint","normalizedValue":"10.0.1.29:443","aliases":["10.0.1.29:443"],"observationRefs":["EVT-0086"],"relationshipRefs":[],"firstObserved":"2026-06-12T23:13:04.715288Z","lastObserved":"2026-06-12T23:13:04.715288Z","degree":0},{"entityId":"endpoint:10.0.2.10:443","type":"endpoint","normalizedValue":"10.0.2.10:443","aliases":["10.0.2.10:443"],"observationRefs":["EVT-0091"],"relationshipRefs":[],"firstObserved":"2026-06-11T06:43:39.266514Z","lastObserved":"2026-06-11T06:43:39.266514Z","degree":0},{"entityId":"endpoint:10.0.2.10:80","type":"endpoint","normalizedValue":"10.0.2.10:80","aliases":["10.0.2.10:80"],"observationRefs":["EVT-0098"],"relationshipRefs":[],"firstObserved":"2026-06-11T20:51:38.739876Z","lastObserved":"2026-06-11T20:51:38.739876Z","degree":0},{"entityId":"endpoint:10.0.2.12:53","type":"endpoint","normalizedValue":"10.0.2.12:53","aliases":["10.0.2.12:53"],"observationRefs":["EVT-0122"],"relationshipRefs":[],"firstObserved":"2026-06-12T22:21:21.756883Z","lastObserved":"2026-06-12T22:21:21.756883Z","degree":0},{"entityId":"endpoint:10.0.2.14:443","type":"endpoint","normalizedValue":"10.0.2.14:443","aliases":["10.0.2.14:443"],"observationRefs":["EVT-0138"],"relationshipRefs":[],"firstObserved":"2026-06-13T05:07:38.576349Z","lastObserved":"2026-06-13T05:07:38.576349Z","degree":0},{"entityId":"endpoint:10.0.2.16:443","type":"endpoint","normalizedValue":"10.0.2.16:443","aliases":["10.0.2.16:443"],"observationRefs":["EVT-0100"],"relationshipRefs":[],"firstObserved":"2026-06-11T03:59:42.264363Z","lastObserved":"2026-06-11T03:59:42.264363Z","degree":0},{"entityId":"endpoint:10.0.2.17:22","type":"endpoint","normalizedValue":"10.0.2.17:22","aliases":["10.0.2.17:22"],"observationRefs":["EVT-0095"],"relationshipRefs":[],"firstObserved":"2026-06-10T11:22:19.206032Z","lastObserved":"2026-06-10T11:22:19.206032Z","degree":0},{"entityId":"endpoint:10.0.2.17:443","type":"endpoint","normalizedValue":"10.0.2.17:443","aliases":["10.0.2.17:443"],"observationRefs":["EVT-0124"],"relationshipRefs":[],"firstObserved":"2026-06-11T08:08:55.989392Z","lastObserved":"2026-06-11T08:08:55.989392Z","degree":0},{"entityId":"endpoint:10.0.2.19:53","type":"endpoint","normalizedValue":"10.0.2.19:53","aliases":["10.0.2.19:53"],"observationRefs":["EVT-0061"],"relationshipRefs":[],"firstObserved":"2026-06-12T11:39:04.098916Z","lastObserved":"2026-06-12T11:39:04.098916Z","degree":0},{"entityId":"endpoint:10.0.2.20:53","type":"endpoint","normalizedValue":"10.0.2.20:53","aliases":["10.0.2.20:53"],"observationRefs":["EVT-0062"],"relationshipRefs":[],"firstObserved":"2026-06-12T06:00:13.395631Z","lastObserved":"2026-06-12T06:00:13.395631Z","degree":0},{"entityId":"endpoint:10.0.2.21:443","type":"endpoint","normalizedValue":"10.0.2.21:443","aliases":["10.0.2.21:443"],"observationRefs":["EVT-0134"],"relationshipRefs":[],"firstObserved":"2026-06-11T21:15:40.924019Z","lastObserved":"2026-06-11T21:15:40.924019Z","degree":0},{"entityId":"endpoint:10.0.2.22:80","type":"endpoint","normalizedValue":"10.0.2.22:80","aliases":["10.0.2.22:80"],"observationRefs":["EVT-0072"],"relationshipRefs":[],"firstObserved":"2026-06-10T19:14:27.673088Z","lastObserved":"2026-06-10T19:14:27.673088Z","degree":0},{"entityId":"endpoint:10.0.2.24:25","type":"endpoint","normalizedValue":"10.0.2.24:25","aliases":["10.0.2.24:25"],"observationRefs":["EVT-0065"],"relationshipRefs":[],"firstObserved":"2026-06-11T23:37:02.311519Z","lastObserved":"2026-06-11T23:37:02.311519Z","degree":0},{"entityId":"endpoint:10.0.2.26:22","type":"endpoint","normalizedValue":"10.0.2.26:22","aliases":["10.0.2.26:22"],"observationRefs":["EVT-0069"],"relationshipRefs":[],"firstObserved":"2026-06-13T02:16:28.485202Z","lastObserved":"2026-06-13T02:16:28.485202Z","degree":0},{"entityId":"endpoint:10.0.2.27:443","type":"endpoint","normalizedValue":"10.0.2.27:443","aliases":["10.0.2.27:443"],"observationRefs":["EVT-0101"],"relationshipRefs":[],"firstObserved":"2026-06-12T01:12:07.786552Z","lastObserved":"2026-06-12T01:12:07.786552Z","degree":0},{"entityId":"endpoint:10.0.2.28:25","type":"endpoint","normalizedValue":"10.0.2.28:25","aliases":["10.0.2.28:25"],"observationRefs":["EVT-0125"],"relationshipRefs":[],"firstObserved":"2026-06-10T08:58:58.486989Z","lastObserved":"2026-06-10T08:58:58.486989Z","degree":0},{"entityId":"endpoint:10.0.2.29:443","type":"endpoint","normalizedValue":"10.0.2.29:443","aliases":["10.0.2.29:443"],"observationRefs":["EVT-0129","EVT-0114"],"relationshipRefs":[],"firstObserved":"2026-06-11T19:57:16.622968Z","lastObserved":"2026-06-12T07:55:54.736700Z","degree":0},{"entityId":"endpoint:10.0.3.10:25","type":"endpoint","normalizedValue":"10.0.3.10:25","aliases":["10.0.3.10:25"],"observationRefs":["EVT-0102"],"relationshipRefs":[],"firstObserved":"2026-06-11T23:58:24.349240Z","lastObserved":"2026-06-11T23:58:24.349240Z","degree":0},{"entityId":"endpoint:10.0.3.10:80","type":"endpoint","normalizedValue":"10.0.3.10:80","aliases":["10.0.3.10:80"],"observationRefs":["EVT-0112"],"relationshipRefs":[],"firstObserved":"2026-06-11T04:44:54.143200Z","lastObserved":"2026-06-11T04:44:54.143200Z","degree":0},{"entityId":"endpoint:10.0.3.11:443","type":"endpoint","normalizedValue":"10.0.3.11:443","aliases":["10.0.3.11:443"],"observationRefs":["EVT-0123","EVT-0118","EVT-0074"],"relationshipRefs":[],"firstObserved":"2026-06-10T11:11:11.437561Z","lastObserved":"2026-06-12T03:11:52.825935Z","degree":0},{"entityId":"endpoint:10.0.3.13:25","type":"endpoint","normalizedValue":"10.0.3.13:25","aliases":["10.0.3.13:25"],"observationRefs":["EVT-0136"],"relationshipRefs":[],"firstObserved":"2026-06-12T00:36:20.944073Z","lastObserved":"2026-06-12T00:36:20.944073Z","degree":0},{"entityId":"endpoint:10.0.3.14:443","type":"endpoint","normalizedValue":"10.0.3.14:443","aliases":["10.0.3.14:443"],"observationRefs":["EVT-0107","EVT-0109"],"relationshipRefs":[],"firstObserved":"2026-06-12T10:30:57.120501Z","lastObserved":"2026-06-13T04:21:51.608932Z","degree":0},{"entityId":"endpoint:10.0.3.18:25","type":"endpoint","normalizedValue":"10.0.3.18:25","aliases":["10.0.3.18:25"],"observationRefs":["EVT-0116"],"relationshipRefs":[],"firstObserved":"2026-06-12T21:43:29.098438Z","lastObserved":"2026-06-12T21:43:29.098438Z","degree":0},{"entityId":"endpoint:10.0.3.18:53","type":"endpoint","normalizedValue":"10.0.3.18:53","aliases":["10.0.3.18:53"],"observationRefs":["EVT-0128"],"relationshipRefs":[],"firstObserved":"2026-06-11T12:31:15.304298Z","lastObserved":"2026-06-11T12:31:15.304298Z","degree":0},{"entityId":"endpoint:10.0.3.27:443","type":"endpoint","normalizedValue":"10.0.3.27:443","aliases":["10.0.3.27:443"],"observationRefs":["EVT-0106"],"relationshipRefs":[],"firstObserved":"2026-06-12T22:45:45.706980Z","lastObserved":"2026-06-12T22:45:45.706980Z","degree":0},{"entityId":"endpoint:10.0.3.27:53","type":"endpoint","normalizedValue":"10.0.3.27:53","aliases":["10.0.3.27:53"],"observationRefs":["EVT-0137"],"relationshipRefs":[],"firstObserved":"2026-06-11T14:45:34.167799Z","lastObserved":"2026-06-11T14:45:34.167799Z","degree":0},{"entityId":"endpoint:10.0.3.29:443","type":"endpoint","normalizedValue":"10.0.3.29:443","aliases":["10.0.3.29:443"],"observationRefs":["EVT-0087"],"relationshipRefs":[],"firstObserved":"2026-06-13T02:11:29.423126Z","lastObserved":"2026-06-13T02:11:29.423126Z","degree":0},{"entityId":"endpoint:10.0.4.12:22","type":"endpoint","normalizedValue":"10.0.4.12:22","aliases":["10.0.4.12:22"],"observationRefs":["EVT-0099"],"relationshipRefs":[],"firstObserved":"2026-06-11T14:41:08.113530Z","lastObserved":"2026-06-11T14:41:08.113530Z","degree":0},{"entityId":"endpoint:10.0.4.13:443","type":"endpoint","normalizedValue":"10.0.4.13:443","aliases":["10.0.4.13:443"],"observationRefs":["EVT-0140"],"relationshipRefs":[],"firstObserved":"2026-06-10T15:39:12.340248Z","lastObserved":"2026-06-10T15:39:12.340248Z","degree":0},{"entityId":"endpoint:10.0.4.13:53","type":"endpoint","normalizedValue":"10.0.4.13:53","aliases":["10.0.4.13:53"],"observationRefs":["EVT-0070"],"relationshipRefs":[],"firstObserved":"2026-06-11T09:31:48.790384Z","lastObserved":"2026-06-11T09:31:48.790384Z","degree":0},{"entityId":"endpoint:10.0.4.14:443","type":"endpoint","normalizedValue":"10.0.4.14:443","aliases":["10.0.4.14:443"],"observationRefs":["EVT-0080","EVT-0063","EVT-0104"],"relationshipRefs":[],"firstObserved":"2026-06-11T07:06:05.683843Z","lastObserved":"2026-06-12T03:16:40.664293Z","degree":0},{"entityId":"endpoint:10.0.4.15:443","type":"endpoint","normalizedValue":"10.0.4.15:443","aliases":["10.0.4.15:443"],"observationRefs":["EVT-0071"],"relationshipRefs":[],"firstObserved":"2026-06-10T16:00:22.055696Z","lastObserved":"2026-06-10T16:00:22.055696Z","degree":0},{"entityId":"endpoint:10.0.4.17:80","type":"endpoint","normalizedValue":"10.0.4.17:80","aliases":["10.0.4.17:80"],"observationRefs":["EVT-0135"],"relationshipRefs":[],"firstObserved":"2026-06-12T04:00:39.646550Z","lastObserved":"2026-06-12T04:00:39.646550Z","degree":0},{"entityId":"endpoint:10.0.4.18:22","type":"endpoint","normalizedValue":"10.0.4.18:22","aliases":["10.0.4.18:22"],"observationRefs":["EVT-0090"],"relationshipRefs":[],"firstObserved":"2026-06-12T18:01:04.842883Z","lastObserved":"2026-06-12T18:01:04.842883Z","degree":0},{"entityId":"endpoint:10.0.4.18:443","type":"endpoint","normalizedValue":"10.0.4.18:443","aliases":["10.0.4.18:443"],"observationRefs":["EVT-0115"],"relationshipRefs":[],"firstObserved":"2026-06-12T05:12:48.010418Z","lastObserved":"2026-06-12T05:12:48.010418Z","degree":0},{"entityId":"endpoint:10.0.4.20:443","type":"endpoint","normalizedValue":"10.0.4.20:443","aliases":["10.0.4.20:443"],"observationRefs":["EVT-0133"],"relationshipRefs":[],"firstObserved":"2026-06-12T18:53:52.382561Z","lastObserved":"2026-06-12T18:53:52.382561Z","degree":0},{"entityId":"endpoint:10.0.4.20:53","type":"endpoint","normalizedValue":"10.0.4.20:53","aliases":["10.0.4.20:53"],"observationRefs":["EVT-0094"],"relationshipRefs":[],"firstObserved":"2026-06-10T19:10:05.788416Z","lastObserved":"2026-06-10T19:10:05.788416Z","degree":0},{"entityId":"endpoint:10.0.4.21:80","type":"endpoint","normalizedValue":"10.0.4.21:80","aliases":["10.0.4.21:80"],"observationRefs":["EVT-0096"],"relationshipRefs":[],"firstObserved":"2026-06-10T20:46:42.214912Z","lastObserved":"2026-06-10T20:46:42.214912Z","degree":0},{"entityId":"endpoint:10.0.4.22:25","type":"endpoint","normalizedValue":"10.0.4.22:25","aliases":["10.0.4.22:25"],"observationRefs":["EVT-0084"],"relationshipRefs":[],"firstObserved":"2026-06-10T19:41:12.690494Z","lastObserved":"2026-06-10T19:41:12.690494Z","degree":0},{"entityId":"endpoint:10.0.4.23:22","type":"endpoint","normalizedValue":"10.0.4.23:22","aliases":["10.0.4.23:22"],"observationRefs":["EVT-0085"],"relationshipRefs":[],"firstObserved":"2026-06-13T07:24:21.751627Z","lastObserved":"2026-06-13T07:24:21.751627Z","degree":0},{"entityId":"endpoint:10.0.4.23:443","type":"endpoint","normalizedValue":"10.0.4.23:443","aliases":["10.0.4.23:443"],"observationRefs":["EVT-0088","EVT-0092"],"relationshipRefs":[],"firstObserved":"2026-06-10T19:03:40.932454Z","lastObserved":"2026-06-12T09:04:10.147368Z","degree":0},{"entityId":"endpoint:10.0.4.24:53","type":"endpoint","normalizedValue":"10.0.4.24:53","aliases":["10.0.4.24:53"],"observationRefs":["EVT-0073"],"relationshipRefs":[],"firstObserved":"2026-06-12T18:10:52.596043Z","lastObserved":"2026-06-12T18:10:52.596043Z","degree":0},{"entityId":"endpoint:10.0.4.26:443","type":"endpoint","normalizedValue":"10.0.4.26:443","aliases":["10.0.4.26:443"],"observationRefs":["EVT-0111"],"relationshipRefs":[],"firstObserved":"2026-06-12T23:22:21.189980Z","lastObserved":"2026-06-12T23:22:21.189980Z","degree":0},{"entityId":"endpoint:10.0.5.10:22","type":"endpoint","normalizedValue":"10.0.5.10:22","aliases":["10.0.5.10:22"],"observationRefs":["EVT-0103"],"relationshipRefs":[],"firstObserved":"2026-06-13T06:54:52.808353Z","lastObserved":"2026-06-13T06:54:52.808353Z","degree":0},{"entityId":"endpoint:10.0.5.13:80","type":"endpoint","normalizedValue":"10.0.5.13:80","aliases":["10.0.5.13:80"],"observationRefs":["EVT-0068"],"relationshipRefs":[],"firstObserved":"2026-06-12T04:40:04.900779Z","lastObserved":"2026-06-12T04:40:04.900779Z","degree":0},{"entityId":"endpoint:10.0.5.16:22","type":"endpoint","normalizedValue":"10.0.5.16:22","aliases":["10.0.5.16:22"],"observationRefs":["EVT-0083"],"relationshipRefs":[],"firstObserved":"2026-06-12T12:16:29.046088Z","lastObserved":"2026-06-12T12:16:29.046088Z","degree":0},{"entityId":"endpoint:10.0.5.16:25","type":"endpoint","normalizedValue":"10.0.5.16:25","aliases":["10.0.5.16:25"],"observationRefs":["EVT-0097"],"relationshipRefs":[],"firstObserved":"2026-06-12T02:45:14.828451Z","lastObserved":"2026-06-12T02:45:14.828451Z","degree":0},{"entityId":"endpoint:10.0.5.16:443","type":"endpoint","normalizedValue":"10.0.5.16:443","aliases":["10.0.5.16:443"],"observationRefs":["EVT-0108"],"relationshipRefs":[],"firstObserved":"2026-06-11T15:28:19.958592Z","lastObserved":"2026-06-11T15:28:19.958592Z","degree":0},{"entityId":"endpoint:10.0.5.18:22","type":"endpoint","normalizedValue":"10.0.5.18:22","aliases":["10.0.5.18:22"],"observationRefs":["EVT-0119"],"relationshipRefs":[],"firstObserved":"2026-06-13T00:04:04.195656Z","lastObserved":"2026-06-13T00:04:04.195656Z","degree":0},{"entityId":"endpoint:10.0.5.19:53","type":"endpoint","normalizedValue":"10.0.5.19:53","aliases":["10.0.5.19:53"],"observationRefs":["EVT-0110"],"relationshipRefs":[],"firstObserved":"2026-06-10T11:33:38.176114Z","lastObserved":"2026-06-10T11:33:38.176114Z","degree":0},{"entityId":"endpoint:10.0.5.20:443","type":"endpoint","normalizedValue":"10.0.5.20:443","aliases":["10.0.5.20:443"],"observationRefs":["EVT-0079"],"relationshipRefs":[],"firstObserved":"2026-06-11T08:09:03.901158Z","lastObserved":"2026-06-11T08:09:03.901158Z","degree":0},{"entityId":"endpoint:10.0.5.22:443","type":"endpoint","normalizedValue":"10.0.5.22:443","aliases":["10.0.5.22:443"],"observationRefs":["EVT-0082"],"relationshipRefs":[],"firstObserved":"2026-06-12T18:55:43.289178Z","lastObserved":"2026-06-12T18:55:43.289178Z","degree":0},{"entityId":"endpoint:10.0.5.22:80","type":"endpoint","normalizedValue":"10.0.5.22:80","aliases":["10.0.5.22:80"],"observationRefs":["EVT-0081"],"relationshipRefs":[],"firstObserved":"2026-06-12T03:40:17.529020Z","lastObserved":"2026-06-12T03:40:17.529020Z","degree":0},{"entityId":"endpoint:10.0.5.26:25","type":"endpoint","normalizedValue":"10.0.5.26:25","aliases":["10.0.5.26:25"],"observationRefs":["EVT-0066"],"relationshipRefs":[],"firstObserved":"2026-06-11T11:08:13.385686Z","lastObserved":"2026-06-11T11:08:13.385686Z","degree":0},{"entityId":"endpoint:10.0.5.29:443","type":"endpoint","normalizedValue":"10.0.5.29:443","aliases":["10.0.5.29:443"],"observationRefs":["EVT-0089"],"relationshipRefs":[],"firstObserved":"2026-06-10T15:34:04.605935Z","lastObserved":"2026-06-10T15:34:04.605935Z","degree":0},{"entityId":"endpoint:13.107.42.14:25","type":"endpoint","normalizedValue":"13.107.42.14:25","aliases":["13.107.42.14:25"],"observationRefs":["EVT-0105"],"relationshipRefs":["rel_f968a43f0cba0f77"],"firstObserved":"2026-06-12T09:37:39.772267Z","lastObserved":"2026-06-12T09:37:39.772267Z","degree":1},{"entityId":"endpoint:151.101.65.140:22","type":"endpoint","normalizedValue":"151.101.65.140:22","aliases":["151.101.65.140:22"],"observationRefs":["EVT-0078"],"relationshipRefs":["rel_14310194fa6a1f34"],"firstObserved":"2026-06-13T07:41:34.251699Z","lastObserved":"2026-06-13T07:41:34.251699Z","degree":1},{"entityId":"endpoint:151.101.65.140:443","type":"endpoint","normalizedValue":"151.101.65.140:443","aliases":["151.101.65.140:443"],"observationRefs":["EVT-0075"],"relationshipRefs":["rel_c10dfc02b204c4b2"],"firstObserved":"2026-06-11T23:15:10.853857Z","lastObserved":"2026-06-11T23:15:10.853857Z","degree":1},{"entityId":"endpoint:185.220.101.45:443","type":"endpoint","normalizedValue":"185.220.101.45:443","aliases":["185.220.101.45:443"],"observationRefs":["EVT-0223","EVT-0224","EVT-0225"],"relationshipRefs":["rel_6b8664fc8ea94ca2","rel_41e1d389af71e938","rel_84f2efde7f63e0df","rel_7cff5a58b6dcf055","rel_bc30fe02ac81c27f","rel_e185f43459a19b77"],"firstObserved":"2026-06-10T09:03:17Z","lastObserved":"2026-06-10T09:34:21Z","degree":6},{"entityId":"endpoint:8.8.8.8:443","type":"endpoint","normalizedValue":"8.8.8.8:443","aliases":["8.8.8.8:443"],"observationRefs":["EVT-0126"],"relationshipRefs":["rel_ccd5f46e69ac2c8e"],"firstObserved":"2026-06-11T11:16:40.019911Z","lastObserved":"2026-06-11T11:16:40.019911Z","degree":1},{"entityId":"file:C:\\Temp\\7z.exe","type":"file","normalizedValue":"C:\\Temp\\7z.exe","aliases":["C:\\Temp\\7z.exe"],"observationRefs":["EVT-0240"],"relationshipRefs":["rel_cd2f163cc2522e63","rel_2a48ee292b08f3ec"],"firstObserved":"2026-06-10T20:04:02Z","lastObserved":"2026-06-10T20:04:02Z","degree":2},{"entityId":"file:C:\\Temp\\backup_archive.zip","type":"file","normalizedValue":"C:\\Temp\\backup_archive.zip","aliases":["C:\\Temp\\backup_archive.zip"],"observationRefs":["EVT-0237","EVT-0239"],"relationshipRefs":["rel_2c1e45554bd3da5a","rel_e956c4e26edf014c","rel_9b04eaf1d95b73db","rel_64733faa5a66e953","rel_cd2f163cc2522e63"],"firstObserved":"2026-06-10T16:51:03Z","lastObserved":"2026-06-10T20:03:17Z","degree":5},{"entityId":"file:C:\\Users\\jdavis\\AppData\\Local\\Temp\\~df4a12.tmp","type":"file","normalizedValue":"C:\\Users\\jdavis\\AppData\\Local\\Temp\\~df4a12.tmp","aliases":["C:\\Users\\jdavis\\AppData\\Local\\Temp\\~df4a12.tmp"],"observationRefs":["EVT-0227"],"relationshipRefs":["rel_2fc1e2d819f1d0d1","rel_911fbdf121802983"],"firstObserved":"2026-06-10T10:08:03Z","lastObserved":"2026-06-10T10:08:03Z","degree":2},{"entityId":"host:AUTH-SRV-01","type":"host","normalizedValue":"AUTH-SRV-01","aliases":["AUTH-SRV-01"],"observationRefs":["EVT-0024","EVT-0228","EVT-0229","EVT-0230","EVT-0231","EVT-0009","EVT-0029","EVT-0040","EVT-0006","EVT-0242","EVT-0019","EVT-0014","EVT-0020","EVT-0051","EVT-0028","EVT-0030","EVT-0044","EVT-0010","EVT-0050","EVT-0047","EVT-0049","EVT-0041","EVT-0034","EVT-0025","EVT-0053","EVT-0055","EVT-0012","EVT-0038","EVT-0031","EVT-0027","EVT-0035","EVT-0036","EVT-0045","EVT-0004","EVT-0048","EVT-0060","EVT-0017","EVT-0018","EVT-0057","EVT-0033","EVT-0013","EVT-0022"],"relationshipRefs":["rel_e19519e87f175b93","rel_30e54ca7752ab77e","rel_e01f16b7077efdad","rel_ee58b4b2d5f16fcf"],"firstObserved":"2026-06-10T10:42:27.919718Z","lastObserved":"2026-06-13T06:28:21.009868Z","degree":4},{"entityId":"host:AUTH-SRV-02","type":"host","normalizedValue":"AUTH-SRV-02","aliases":["AUTH-SRV-02"],"observationRefs":["EVT-0052","EVT-0042","EVT-0054","EVT-0011","EVT-0005","EVT-0015","EVT-0026","EVT-0059","EVT-0043","EVT-0058","EVT-0021","EVT-0003","EVT-0056","EVT-0002","EVT-0046","EVT-0001","EVT-0039","EVT-0008","EVT-0037","EVT-0023","EVT-0016","EVT-0032","EVT-0007"],"relationshipRefs":[],"firstObserved":"2026-06-10T20:49:34.566610Z","lastObserved":"2026-06-13T07:19:39.837409Z","degree":0},{"entityId":"host:FILE-SRV-02","type":"host","normalizedValue":"FILE-SRV-02","aliases":["FILE-SRV-02"],"observationRefs":["EVT-0231","EVT-0232","EVT-0233","EVT-0234","EVT-0235","EVT-0236","EVT-0237","EVT-0238","EVT-0239","EVT-0240","EVT-0241","EVT-0242"],"relationshipRefs":["rel_e01f16b7077efdad","rel_377b5e159dfa11bb","rel_94a3dff146addda7","rel_c3149da4d35bf861","rel_80a7f1a9e48c203f","rel_c3504efdff29d0bd","rel_cb1574c78f6d4056","rel_0780f89e83cc23a9","rel_bf63a511d673f1d5","rel_2c1e45554bd3da5a","rel_e956c4e26edf014c","rel_9b04eaf1d95b73db","rel_64733faa5a66e953","rel_cd2f163cc2522e63","rel_2a48ee292b08f3ec"],"firstObserved":"2026-06-10T13:11:33Z","lastObserved":"2026-06-10T20:08:11Z","degree":15},{"entityId":"host:WKSTN-01","type":"host","normalizedValue":"WKSTN-01","aliases":["WKSTN-01"],"observationRefs":["EVT-0180","EVT-0159","EVT-0030","EVT-0026","EVT-0171","EVT-0144","EVT-0049","EVT-0003","EVT-0012","EVT-0039","EVT-0027","EVT-0155","EVT-0018","EVT-0190","EVT-0162","EVT-0013"],"relationshipRefs":["rel_1d0a35a5c29aa141","rel_2909cdb826efd836","rel_85245e6d2010f6b9","rel_a6afab38abbaa54a","rel_543cb6b7e8e4ff63"],"firstObserved":"2026-06-10T12:06:58.828725Z","lastObserved":"2026-06-13T05:44:47.093107Z","degree":5},{"entityId":"host:WKSTN-02","type":"host","normalizedValue":"WKSTN-02","aliases":["WKSTN-02"],"observationRefs":["EVT-0187","EVT-0029","EVT-0006","EVT-0149","EVT-0020","EVT-0047","EVT-0156","EVT-0153","EVT-0045","EVT-0160","EVT-0060","EVT-0172","EVT-0007"],"relationshipRefs":["rel_ee58b4b2d5f16fcf"],"firstObserved":"2026-06-10T13:40:10.848419Z","lastObserved":"2026-06-13T07:19:39.837409Z","degree":1},{"entityId":"host:WKSTN-03","type":"host","normalizedValue":"WKSTN-03","aliases":["WKSTN-03"],"observationRefs":["EVT-0168","EVT-0183","EVT-0054","EVT-0043","EVT-0148","EVT-0025","EVT-0053","EVT-0002","EVT-0176","EVT-0038","EVT-0004"],"relationshipRefs":["rel_0cd7fc4a1756e7b8"],"firstObserved":"2026-06-10T14:01:45.325234Z","lastObserved":"2026-06-12T17:54:45.864623Z","degree":1},{"entityId":"host:WKSTN-04","type":"host","normalizedValue":"WKSTN-04","aliases":["WKSTN-04"],"observationRefs":["EVT-0040","EVT-0005","EVT-0166","EVT-0173","EVT-0158","EVT-0185","EVT-0008","EVT-0161","EVT-0017"],"relationshipRefs":["rel_ffd214d59f8f33e7"],"firstObserved":"2026-06-10T15:45:17.487358Z","lastObserved":"2026-06-12T22:25:32.646863Z","degree":1},{"entityId":"host:WKSTN-05","type":"host","normalizedValue":"WKSTN-05","aliases":["WKSTN-05"],"observationRefs":["EVT-0150","EVT-0142","EVT-0011","EVT-0044","EVT-0163","EVT-0055","EVT-0001","EVT-0033"],"relationshipRefs":[],"firstObserved":"2026-06-10T09:05:40.279231Z","lastObserved":"2026-06-13T02:58:23.165329Z","degree":0},{"entityId":"host:WKSTN-06","type":"host","normalizedValue":"WKSTN-06","aliases":["WKSTN-06"],"observationRefs":["EVT-0024","EVT-0167","EVT-0015","EVT-0179","EVT-0059","EVT-0157","EVT-0164","EVT-0058","EVT-0177","EVT-0021","EVT-0182","EVT-0056","EVT-0186","EVT-0035","EVT-0057","EVT-0032"],"relationshipRefs":["rel_2716286741966063","rel_b2da9c57949d2750"],"firstObserved":"2026-06-10T10:42:27.919718Z","lastObserved":"2026-06-13T03:34:49.698945Z","degree":2},{"entityId":"host:WKSTN-07","type":"host","normalizedValue":"WKSTN-07","aliases":["WKSTN-07"],"observationRefs":["EVT-0221","EVT-0222","EVT-0223","EVT-0224","EVT-0225","EVT-0226","EVT-0227","EVT-0228"],"relationshipRefs":["rel_0939f1e464f16e02","rel_7677da129f60f5ff","rel_6b8664fc8ea94ca2","rel_41e1d389af71e938","rel_84f2efde7f63e0df","rel_7cff5a58b6dcf055","rel_bc30fe02ac81c27f","rel_e185f43459a19b77","rel_2fc1e2d819f1d0d1","rel_911fbdf121802983","rel_e19519e87f175b93"],"firstObserved":"2026-06-10T08:12:33Z","lastObserved":"2026-06-10T11:22:14Z","degree":11},{"entityId":"host:WKSTN-08","type":"host","normalizedValue":"WKSTN-08","aliases":["WKSTN-08"],"observationRefs":["EVT-0152","EVT-0175","EVT-0042","EVT-0014","EVT-0051","EVT-0146","EVT-0154","EVT-0034","EVT-0046","EVT-0151","EVT-0141","EVT-0022"],"relationshipRefs":["rel_97cde3b0610ea5fb"],"firstObserved":"2026-06-10T10:57:37.982291Z","lastObserved":"2026-06-13T06:28:21.009868Z","degree":1},{"entityId":"host:WKSTN-09","type":"host","normalizedValue":"WKSTN-09","aliases":["WKSTN-09"],"observationRefs":["EVT-0009","EVT-0184","EVT-0170","EVT-0181","EVT-0178","EVT-0147","EVT-0050","EVT-0041","EVT-0031","EVT-0165","EVT-0037","EVT-0036"],"relationshipRefs":["rel_6fc19bdab346f9ed"],"firstObserved":"2026-06-10T14:40:12.102241Z","lastObserved":"2026-06-12T17:03:53.157508Z","degree":1},{"entityId":"host:WKSTN-10","type":"host","normalizedValue":"WKSTN-10","aliases":["WKSTN-10"],"observationRefs":["EVT-0052","EVT-0019","EVT-0028","EVT-0174","EVT-0143","EVT-0189","EVT-0010","EVT-0169","EVT-0145","EVT-0023","EVT-0188","EVT-0048","EVT-0016"],"relationshipRefs":["rel_a9f3d3582d652e24","rel_c0f9a0d0bb267d21"],"firstObserved":"2026-06-10T20:49:34.566610Z","lastObserved":"2026-06-12T20:02:27.306774Z","degree":2},{"entityId":"ipv4:10.0.1.10","type":"ipv4","normalizedValue":"10.0.1.10","aliases":["10.0.1.10"],"observationRefs":["EVT-0228","EVT-0231"],"relationshipRefs":["rel_e19519e87f175b93","rel_e01f16b7077efdad"],"firstObserved":"2026-06-10T11:22:14Z","lastObserved":"2026-06-10T13:11:33Z","degree":2},{"entityId":"ipv4:10.0.1.11","type":"ipv4","normalizedValue":"10.0.1.11","aliases":["10.0.1.11"],"observationRefs":["EVT-0091","EVT-0120"],"relationshipRefs":[],"firstObserved":"2026-06-11T06:43:39.266514Z","lastObserved":"2026-06-13T02:45:58.680196Z","degree":0},{"entityId":"ipv4:10.0.1.12","type":"ipv4","normalizedValue":"10.0.1.12","aliases":["10.0.1.12"],"observationRefs":["EVT-0125","EVT-0112","EVT-0080","EVT-0010","EVT-0193"],"relationshipRefs":[],"firstObserved":"2026-06-10T08:58:58.486989Z","lastObserved":"2026-06-13T05:39:45.933394Z","degree":0},{"entityId":"ipv4:10.0.1.120","type":"ipv4","normalizedValue":"10.0.1.120","aliases":["10.0.1.120"],"observationRefs":["EVT-0019"],"relationshipRefs":[],"firstObserved":"2026-06-10T22:59:02.525182Z","lastObserved":"2026-06-10T22:59:02.525182Z","degree":0},{"entityId":"ipv4:10.0.1.129","type":"ipv4","normalizedValue":"10.0.1.129","aliases":["10.0.1.129"],"observationRefs":["EVT-0018"],"relationshipRefs":[],"firstObserved":"2026-06-13T00:47:41.254884Z","lastObserved":"2026-06-13T00:47:41.254884Z","degree":0},{"entityId":"ipv4:10.0.1.13","type":"ipv4","normalizedValue":"10.0.1.13","aliases":["10.0.1.13"],"observationRefs":["EVT-0110","EVT-0089","EVT-0099","EVT-0073"],"relationshipRefs":[],"firstObserved":"2026-06-10T11:33:38.176114Z","lastObserved":"2026-06-12T18:10:52.596043Z","degree":0},{"entityId":"ipv4:10.0.1.16","type":"ipv4","normalizedValue":"10.0.1.16","aliases":["10.0.1.16"],"observationRefs":["EVT-0065","EVT-0192","EVT-0121","EVT-0207","EVT-0111"],"relationshipRefs":[],"firstObserved":"2026-06-11T23:37:02.311519Z","lastObserved":"2026-06-12T23:22:21.189980Z","degree":0},{"entityId":"ipv4:10.0.1.17","type":"ipv4","normalizedValue":"10.0.1.17","aliases":["10.0.1.17"],"observationRefs":["EVT-0076","EVT-0132","EVT-0100","EVT-0124","EVT-0118","EVT-0103"],"relationshipRefs":[],"firstObserved":"2026-06-10T17:00:41.935055Z","lastObserved":"2026-06-13T06:54:52.808353Z","degree":0},{"entityId":"ipv4:10.0.1.18","type":"ipv4","normalizedValue":"10.0.1.18","aliases":["10.0.1.18"],"observationRefs":["EVT-0130","EVT-0093","EVT-0117"],"relationshipRefs":[],"firstObserved":"2026-06-10T10:21:25.734447Z","lastObserved":"2026-06-11T21:27:27.580114Z","degree":0},{"entityId":"ipv4:10.0.1.19","type":"ipv4","normalizedValue":"10.0.1.19","aliases":["10.0.1.19"],"observationRefs":["EVT-0129"],"relationshipRefs":[],"firstObserved":"2026-06-11T19:57:16.622968Z","lastObserved":"2026-06-11T19:57:16.622968Z","degree":0},{"entityId":"ipv4:10.0.1.192","type":"ipv4","normalizedValue":"10.0.1.192","aliases":["10.0.1.192"],"observationRefs":["EVT-0043"],"relationshipRefs":[],"firstObserved":"2026-06-11T17:12:47.357821Z","lastObserved":"2026-06-11T17:12:47.357821Z","degree":0},{"entityId":"ipv4:10.0.1.20","type":"ipv4","normalizedValue":"10.0.1.20","aliases":["10.0.1.20"],"observationRefs":["EVT-0137"],"relationshipRefs":[],"firstObserved":"2026-06-11T14:45:34.167799Z","lastObserved":"2026-06-11T14:45:34.167799Z","degree":0},{"entityId":"ipv4:10.0.1.205","type":"ipv4","normalizedValue":"10.0.1.205","aliases":["10.0.1.205"],"observationRefs":["EVT-0052"],"relationshipRefs":[],"firstObserved":"2026-06-10T20:49:34.566610Z","lastObserved":"2026-06-10T20:49:34.566610Z","degree":0},{"entityId":"ipv4:10.0.1.21","type":"ipv4","normalizedValue":"10.0.1.21","aliases":["10.0.1.21"],"observationRefs":["EVT-0208","EVT-0201"],"relationshipRefs":[],"firstObserved":"2026-06-11T05:53:30.217271Z","lastObserved":"2026-06-12T14:11:08.681998Z","degree":0},{"entityId":"ipv4:10.0.1.219","type":"ipv4","normalizedValue":"10.0.1.219","aliases":["10.0.1.219"],"observationRefs":["EVT-0060"],"relationshipRefs":["rel_ee58b4b2d5f16fcf"],"firstObserved":"2026-06-12T20:35:47.779696Z","lastObserved":"2026-06-12T20:35:47.779696Z","degree":1},{"entityId":"ipv4:10.0.1.22","type":"ipv4","normalizedValue":"10.0.1.22","aliases":["10.0.1.22"],"observationRefs":["EVT-0231","EVT-0238","EVT-0113"],"relationshipRefs":["rel_e01f16b7077efdad","rel_9b04eaf1d95b73db"],"firstObserved":"2026-06-10T13:11:33Z","lastObserved":"2026-06-12T00:57:06.986281Z","degree":2},{"entityId":"ipv4:10.0.1.23","type":"ipv4","normalizedValue":"10.0.1.23","aliases":["10.0.1.23"],"observationRefs":["EVT-0117","EVT-0075"],"relationshipRefs":["rel_c10dfc02b204c4b2"],"firstObserved":"2026-06-11T21:27:27.580114Z","lastObserved":"2026-06-11T23:15:10.853857Z","degree":1},{"entityId":"ipv4:10.0.1.24","type":"ipv4","normalizedValue":"10.0.1.24","aliases":["10.0.1.24"],"observationRefs":["EVT-0102"],"relationshipRefs":[],"firstObserved":"2026-06-11T23:58:24.349240Z","lastObserved":"2026-06-11T23:58:24.349240Z","degree":0},{"entityId":"ipv4:10.0.1.243","type":"ipv4","normalizedValue":"10.0.1.243","aliases":["10.0.1.243"],"observationRefs":["EVT-0036"],"relationshipRefs":[],"firstObserved":"2026-06-12T17:03:53.157508Z","lastObserved":"2026-06-12T17:03:53.157508Z","degree":0},{"entityId":"ipv4:10.0.1.25","type":"ipv4","normalizedValue":"10.0.1.25","aliases":["10.0.1.25"],"observationRefs":["EVT-0067","EVT-0136"],"relationshipRefs":[],"firstObserved":"2026-06-11T03:18:15.219184Z","lastObserved":"2026-06-12T00:36:20.944073Z","degree":0},{"entityId":"ipv4:10.0.1.26","type":"ipv4","normalizedValue":"10.0.1.26","aliases":["10.0.1.26"],"observationRefs":["EVT-0130","EVT-0131","EVT-0127","EVT-0064"],"relationshipRefs":[],"firstObserved":"2026-06-10T10:21:25.734447Z","lastObserved":"2026-06-12T23:58:44.972517Z","degree":0},{"entityId":"ipv4:10.0.1.27","type":"ipv4","normalizedValue":"10.0.1.27","aliases":["10.0.1.27"],"observationRefs":["EVT-0072","EVT-0197","EVT-0138"],"relationshipRefs":[],"firstObserved":"2026-06-10T19:14:27.673088Z","lastObserved":"2026-06-13T05:07:38.576349Z","degree":0},{"entityId":"ipv4:10.0.1.28","type":"ipv4","normalizedValue":"10.0.1.28","aliases":["10.0.1.28"],"observationRefs":["EVT-0139","EVT-0077"],"relationshipRefs":[],"firstObserved":"2026-06-10T20:27:01.216356Z","lastObserved":"2026-06-12T08:06:15.898200Z","degree":0},{"entityId":"ipv4:10.0.1.29","type":"ipv4","normalizedValue":"10.0.1.29","aliases":["10.0.1.29"],"observationRefs":["EVT-0200","EVT-0086"],"relationshipRefs":[],"firstObserved":"2026-06-12T04:20:27.971638Z","lastObserved":"2026-06-12T23:13:04.715288Z","degree":0},{"entityId":"ipv4:10.0.1.55","type":"ipv4","normalizedValue":"10.0.1.55","aliases":["10.0.1.55"],"observationRefs":["EVT-0044"],"relationshipRefs":[],"firstObserved":"2026-06-11T11:46:02.176941Z","lastObserved":"2026-06-11T11:46:02.176941Z","degree":0},{"entityId":"ipv4:10.0.1.77","type":"ipv4","normalizedValue":"10.0.1.77","aliases":["10.0.1.77"],"observationRefs":["EVT-0011"],"relationshipRefs":[],"firstObserved":"2026-06-11T03:01:40.094053Z","lastObserved":"2026-06-11T03:01:40.094053Z","degree":0},{"entityId":"ipv4:10.0.1.94","type":"ipv4","normalizedValue":"10.0.1.94","aliases":["10.0.1.94"],"observationRefs":["EVT-0012"],"relationshipRefs":[],"firstObserved":"2026-06-12T06:32:59.499554Z","lastObserved":"2026-06-12T06:32:59.499554Z","degree":0},{"entityId":"ipv4:10.0.2.10","type":"ipv4","normalizedValue":"10.0.2.10","aliases":["10.0.2.10"],"observationRefs":["EVT-0091","EVT-0098"],"relationshipRefs":[],"firstObserved":"2026-06-11T06:43:39.266514Z","lastObserved":"2026-06-11T20:51:38.739876Z","degree":0},{"entityId":"ipv4:10.0.2.11","type":"ipv4","normalizedValue":"10.0.2.11","aliases":["10.0.2.11"],"observationRefs":["EVT-0213"],"relationshipRefs":[],"firstObserved":"2026-06-12T15:48:17.786338Z","lastObserved":"2026-06-12T15:48:17.786338Z","degree":0},{"entityId":"ipv4:10.0.2.12","type":"ipv4","normalizedValue":"10.0.2.12","aliases":["10.0.2.12"],"observationRefs":["EVT-0134","EVT-0122"],"relationshipRefs":[],"firstObserved":"2026-06-11T21:15:40.924019Z","lastObserved":"2026-06-12T22:21:21.756883Z","degree":0},{"entityId":"ipv4:10.0.2.14","type":"ipv4","normalizedValue":"10.0.2.14","aliases":["10.0.2.14"],"observationRefs":["EVT-0138"],"relationshipRefs":[],"firstObserved":"2026-06-13T05:07:38.576349Z","lastObserved":"2026-06-13T05:07:38.576349Z","degree":0},{"entityId":"ipv4:10.0.2.143","type":"ipv4","normalizedValue":"10.0.2.143","aliases":["10.0.2.143"],"observationRefs":["EVT-0001"],"relationshipRefs":[],"firstObserved":"2026-06-12T09:13:31.478890Z","lastObserved":"2026-06-12T09:13:31.478890Z","degree":0},{"entityId":"ipv4:10.0.2.15","type":"ipv4","normalizedValue":"10.0.2.15","aliases":["10.0.2.15"],"observationRefs":["EVT-0069"],"relationshipRefs":[],"firstObserved":"2026-06-13T02:16:28.485202Z","lastObserved":"2026-06-13T02:16:28.485202Z","degree":0},{"entityId":"ipv4:10.0.2.16","type":"ipv4","normalizedValue":"10.0.2.16","aliases":["10.0.2.16"],"observationRefs":["EVT-0100"],"relationshipRefs":[],"firstObserved":"2026-06-11T03:59:42.264363Z","lastObserved":"2026-06-11T03:59:42.264363Z","degree":0},{"entityId":"ipv4:10.0.2.17","type":"ipv4","normalizedValue":"10.0.2.17","aliases":["10.0.2.17"],"observationRefs":["EVT-0209","EVT-0095","EVT-0124"],"relationshipRefs":[],"firstObserved":"2026-06-10T08:50:44.249433Z","lastObserved":"2026-06-11T08:08:55.989392Z","degree":0},{"entityId":"ipv4:10.0.2.18","type":"ipv4","normalizedValue":"10.0.2.18","aliases":["10.0.2.18"],"observationRefs":["EVT-0101","EVT-0083"],"relationshipRefs":[],"firstObserved":"2026-06-12T01:12:07.786552Z","lastObserved":"2026-06-12T12:16:29.046088Z","degree":0},{"entityId":"ipv4:10.0.2.185","type":"ipv4","normalizedValue":"10.0.2.185","aliases":["10.0.2.185"],"observationRefs":["EVT-0009"],"relationshipRefs":[],"firstObserved":"2026-06-10T14:40:12.102241Z","lastObserved":"2026-06-10T14:40:12.102241Z","degree":0},{"entityId":"ipv4:10.0.2.19","type":"ipv4","normalizedValue":"10.0.2.19","aliases":["10.0.2.19"],"observationRefs":["EVT-0220","EVT-0061"],"relationshipRefs":[],"firstObserved":"2026-06-11T15:09:41.137709Z","lastObserved":"2026-06-12T11:39:04.098916Z","degree":0},{"entityId":"ipv4:10.0.2.198","type":"ipv4","normalizedValue":"10.0.2.198","aliases":["10.0.2.198"],"observationRefs":["EVT-0058"],"relationshipRefs":[],"firstObserved":"2026-06-11T19:26:53.798600Z","lastObserved":"2026-06-11T19:26:53.798600Z","degree":0},{"entityId":"ipv4:10.0.2.20","type":"ipv4","normalizedValue":"10.0.2.20","aliases":["10.0.2.20"],"observationRefs":["EVT-0062","EVT-0214"],"relationshipRefs":[],"firstObserved":"2026-06-12T06:00:13.395631Z","lastObserved":"2026-06-12T12:42:20.105292Z","degree":0},{"entityId":"ipv4:10.0.2.207","type":"ipv4","normalizedValue":"10.0.2.207","aliases":["10.0.2.207"],"observationRefs":["EVT-0040"],"relationshipRefs":[],"firstObserved":"2026-06-10T15:45:17.487358Z","lastObserved":"2026-06-10T15:45:17.487358Z","degree":0},{"entityId":"ipv4:10.0.2.21","type":"ipv4","normalizedValue":"10.0.2.21","aliases":["10.0.2.21"],"observationRefs":["EVT-0134"],"relationshipRefs":[],"firstObserved":"2026-06-11T21:15:40.924019Z","lastObserved":"2026-06-11T21:15:40.924019Z","degree":0},{"entityId":"ipv4:10.0.2.219","type":"ipv4","normalizedValue":"10.0.2.219","aliases":["10.0.2.219"],"observationRefs":["EVT-0030"],"relationshipRefs":[],"firstObserved":"2026-06-11T05:25:54.996133Z","lastObserved":"2026-06-11T05:25:54.996133Z","degree":0},{"entityId":"ipv4:10.0.2.22","type":"ipv4","normalizedValue":"10.0.2.22","aliases":["10.0.2.22"],"observationRefs":["EVT-0072","EVT-0120"],"relationshipRefs":[],"firstObserved":"2026-06-10T19:14:27.673088Z","lastObserved":"2026-06-13T02:45:58.680196Z","degree":0},{"entityId":"ipv4:10.0.2.24","type":"ipv4","normalizedValue":"10.0.2.24","aliases":["10.0.2.24"],"observationRefs":["EVT-0191","EVT-0065","EVT-0064"],"relationshipRefs":[],"firstObserved":"2026-06-11T04:22:17.617130Z","lastObserved":"2026-06-12T23:58:44.972517Z","degree":0},{"entityId":"ipv4:10.0.2.249","type":"ipv4","normalizedValue":"10.0.2.249","aliases":["10.0.2.249"],"observationRefs":["EVT-0020"],"relationshipRefs":["rel_ee58b4b2d5f16fcf"],"firstObserved":"2026-06-10T23:30:40.097804Z","lastObserved":"2026-06-10T23:30:40.097804Z","degree":1},{"entityId":"ipv4:10.0.2.25","type":"ipv4","normalizedValue":"10.0.2.25","aliases":["10.0.2.25"],"observationRefs":["EVT-0088","EVT-0063","EVT-0050"],"relationshipRefs":[],"firstObserved":"2026-06-10T19:03:40.932454Z","lastObserved":"2026-06-11T16:50:58.471757Z","degree":0},{"entityId":"ipv4:10.0.2.26","type":"ipv4","normalizedValue":"10.0.2.26","aliases":["10.0.2.26"],"observationRefs":["EVT-0069"],"relationshipRefs":[],"firstObserved":"2026-06-13T02:16:28.485202Z","lastObserved":"2026-06-13T02:16:28.485202Z","degree":0},{"entityId":"ipv4:10.0.2.27","type":"ipv4","normalizedValue":"10.0.2.27","aliases":["10.0.2.27"],"observationRefs":["EVT-0101"],"relationshipRefs":[],"firstObserved":"2026-06-12T01:12:07.786552Z","lastObserved":"2026-06-12T01:12:07.786552Z","degree":0},{"entityId":"ipv4:10.0.2.28","type":"ipv4","normalizedValue":"10.0.2.28","aliases":["10.0.2.28"],"observationRefs":["EVT-0125"],"relationshipRefs":[],"firstObserved":"2026-06-10T08:58:58.486989Z","lastObserved":"2026-06-10T08:58:58.486989Z","degree":0},{"entityId":"ipv4:10.0.2.29","type":"ipv4","normalizedValue":"10.0.2.29","aliases":["10.0.2.29"],"observationRefs":["EVT-0129","EVT-0114"],"relationshipRefs":[],"firstObserved":"2026-06-11T19:57:16.622968Z","lastObserved":"2026-06-12T07:55:54.736700Z","degree":0},{"entityId":"ipv4:10.0.2.45","type":"ipv4","normalizedValue":"10.0.2.45","aliases":["10.0.2.45"],"observationRefs":["EVT-0024"],"relationshipRefs":[],"firstObserved":"2026-06-10T10:42:27.919718Z","lastObserved":"2026-06-10T10:42:27.919718Z","degree":0},{"entityId":"ipv4:10.0.2.47","type":"ipv4","normalizedValue":"10.0.2.47","aliases":["10.0.2.47"],"observationRefs":["EVT-0223","EVT-0224","EVT-0225","EVT-0228"],"relationshipRefs":["rel_6b8664fc8ea94ca2","rel_41e1d389af71e938","rel_84f2efde7f63e0df","rel_7cff5a58b6dcf055","rel_bc30fe02ac81c27f","rel_e185f43459a19b77","rel_e19519e87f175b93"],"firstObserved":"2026-06-10T09:03:17Z","lastObserved":"2026-06-10T11:22:14Z","degree":7},{"entityId":"ipv4:10.0.2.72","type":"ipv4","normalizedValue":"10.0.2.72","aliases":["10.0.2.72"],"observationRefs":["EVT-0017"],"relationshipRefs":[],"firstObserved":"2026-06-12T22:25:32.646863Z","lastObserved":"2026-06-12T22:25:32.646863Z","degree":0},{"entityId":"ipv4:10.0.2.89","type":"ipv4","normalizedValue":"10.0.2.89","aliases":["10.0.2.89"],"observationRefs":["EVT-0027"],"relationshipRefs":[],"firstObserved":"2026-06-12T12:28:41.358556Z","lastObserved":"2026-06-12T12:28:41.358556Z","degree":0},{"entityId":"ipv4:10.0.3.10","type":"ipv4","normalizedValue":"10.0.3.10","aliases":["10.0.3.10"],"observationRefs":["EVT-0112","EVT-0102","EVT-0115","EVT-0086"],"relationshipRefs":[],"firstObserved":"2026-06-11T04:44:54.143200Z","lastObserved":"2026-06-12T23:13:04.715288Z","degree":0},{"entityId":"ipv4:10.0.3.11","type":"ipv4","normalizedValue":"10.0.3.11","aliases":["10.0.3.11"],"observationRefs":["EVT-0123","EVT-0118","EVT-0074","EVT-0061"],"relationshipRefs":[],"firstObserved":"2026-06-10T11:11:11.437561Z","lastObserved":"2026-06-12T11:39:04.098916Z","degree":0},{"entityId":"ipv4:10.0.3.112","type":"ipv4","normalizedValue":"10.0.3.112","aliases":["10.0.3.112"],"observationRefs":["EVT-0047"],"relationshipRefs":[],"firstObserved":"2026-06-11T19:35:25.309741Z","lastObserved":"2026-06-11T19:35:25.309741Z","degree":0},{"entityId":"ipv4:10.0.3.12","type":"ipv4","normalizedValue":"10.0.3.12","aliases":["10.0.3.12"],"observationRefs":["EVT-0092"],"relationshipRefs":[],"firstObserved":"2026-06-12T09:04:10.147368Z","lastObserved":"2026-06-12T09:04:10.147368Z","degree":0},{"entityId":"ipv4:10.0.3.123","type":"ipv4","normalizedValue":"10.0.3.123","aliases":["10.0.3.123"],"observationRefs":["EVT-0008"],"relationshipRefs":[],"firstObserved":"2026-06-12T10:38:43.187238Z","lastObserved":"2026-06-12T10:38:43.187238Z","degree":0},{"entityId":"ipv4:10.0.3.13","type":"ipv4","normalizedValue":"10.0.3.13","aliases":["10.0.3.13"],"observationRefs":["EVT-0136"],"relationshipRefs":[],"firstObserved":"2026-06-12T00:36:20.944073Z","lastObserved":"2026-06-12T00:36:20.944073Z","degree":0},{"entityId":"ipv4:10.0.3.134","type":"ipv4","normalizedValue":"10.0.3.134","aliases":["10.0.3.134"],"observationRefs":["EVT-0022"],"relationshipRefs":[],"firstObserved":"2026-06-13T06:28:21.009868Z","lastObserved":"2026-06-13T06:28:21.009868Z","degree":0},{"entityId":"ipv4:10.0.3.14","type":"ipv4","normalizedValue":"10.0.3.14","aliases":["10.0.3.14"],"observationRefs":["EVT-0107","EVT-0196","EVT-0109"],"relationshipRefs":[],"firstObserved":"2026-06-12T10:30:57.120501Z","lastObserved":"2026-06-13T04:21:51.608932Z","degree":0},{"entityId":"ipv4:10.0.3.144","type":"ipv4","normalizedValue":"10.0.3.144","aliases":["10.0.3.144"],"observationRefs":["EVT-0007"],"relationshipRefs":[],"firstObserved":"2026-06-13T07:19:39.837409Z","lastObserved":"2026-06-13T07:19:39.837409Z","degree":0},{"entityId":"ipv4:10.0.3.15","type":"ipv4","normalizedValue":"10.0.3.15","aliases":["10.0.3.15"],"observationRefs":["EVT-0106"],"relationshipRefs":[],"firstObserved":"2026-06-12T22:45:45.706980Z","lastObserved":"2026-06-12T22:45:45.706980Z","degree":0},{"entityId":"ipv4:10.0.3.154","type":"ipv4","normalizedValue":"10.0.3.154","aliases":["10.0.3.154"],"observationRefs":["EVT-0037"],"relationshipRefs":[],"firstObserved":"2026-06-12T13:01:06.466588Z","lastObserved":"2026-06-12T13:01:06.466588Z","degree":0},{"entityId":"ipv4:10.0.3.16","type":"ipv4","normalizedValue":"10.0.3.16","aliases":["10.0.3.16"],"observationRefs":["EVT-0132"],"relationshipRefs":[],"firstObserved":"2026-06-10T19:20:59.796200Z","lastObserved":"2026-06-10T19:20:59.796200Z","degree":0},{"entityId":"ipv4:10.0.3.160","type":"ipv4","normalizedValue":"10.0.3.160","aliases":["10.0.3.160"],"observationRefs":["EVT-0025"],"relationshipRefs":[],"firstObserved":"2026-06-12T01:40:25.507119Z","lastObserved":"2026-06-12T01:40:25.507119Z","degree":0},{"entityId":"ipv4:10.0.3.172","type":"ipv4","normalizedValue":"10.0.3.172","aliases":["10.0.3.172"],"observationRefs":["EVT-0041"],"relationshipRefs":[],"firstObserved":"2026-06-11T21:18:42.135724Z","lastObserved":"2026-06-11T21:18:42.135724Z","degree":0},{"entityId":"ipv4:10.0.3.18","type":"ipv4","normalizedValue":"10.0.3.18","aliases":["10.0.3.18"],"observationRefs":["EVT-0128","EVT-0217","EVT-0116"],"relationshipRefs":[],"firstObserved":"2026-06-11T12:31:15.304298Z","lastObserved":"2026-06-12T21:43:29.098438Z","degree":0},{"entityId":"ipv4:10.0.3.195","type":"ipv4","normalizedValue":"10.0.3.195","aliases":["10.0.3.195"],"observationRefs":["EVT-0056"],"relationshipRefs":[],"firstObserved":"2026-06-12T00:08:42.310238Z","lastObserved":"2026-06-12T00:08:42.310238Z","degree":0},{"entityId":"ipv4:10.0.3.196","type":"ipv4","normalizedValue":"10.0.3.196","aliases":["10.0.3.196"],"observationRefs":["EVT-0006"],"relationshipRefs":[],"firstObserved":"2026-06-10T19:51:26.563646Z","lastObserved":"2026-06-10T19:51:26.563646Z","degree":0},{"entityId":"ipv4:10.0.3.197","type":"ipv4","normalizedValue":"10.0.3.197","aliases":["10.0.3.197"],"observationRefs":["EVT-0046"],"relationshipRefs":[],"firstObserved":"2026-06-12T09:07:30.394151Z","lastObserved":"2026-06-12T09:07:30.394151Z","degree":0},{"entityId":"ipv4:10.0.3.20","type":"ipv4","normalizedValue":"10.0.3.20","aliases":["10.0.3.20"],"observationRefs":["EVT-0215","EVT-0135"],"relationshipRefs":[],"firstObserved":"2026-06-10T12:29:17.435280Z","lastObserved":"2026-06-12T04:00:39.646550Z","degree":0},{"entityId":"ipv4:10.0.3.21","type":"ipv4","normalizedValue":"10.0.3.21","aliases":["10.0.3.21"],"observationRefs":["EVT-0194","EVT-0128"],"relationshipRefs":[],"firstObserved":"2026-06-10T20:42:23.024628Z","lastObserved":"2026-06-11T12:31:15.304298Z","degree":0},{"entityId":"ipv4:10.0.3.22","type":"ipv4","normalizedValue":"10.0.3.22","aliases":["10.0.3.22"],"observationRefs":["EVT-0095","EVT-0218","EVT-0116"],"relationshipRefs":[],"firstObserved":"2026-06-10T11:22:19.206032Z","lastObserved":"2026-06-12T21:43:29.098438Z","degree":0},{"entityId":"ipv4:10.0.3.23","type":"ipv4","normalizedValue":"10.0.3.23","aliases":["10.0.3.23"],"observationRefs":["EVT-0219","EVT-0212"],"relationshipRefs":[],"firstObserved":"2026-06-12T00:13:31.309003Z","lastObserved":"2026-06-13T04:51:58.957297Z","degree":0},{"entityId":"ipv4:10.0.3.24","type":"ipv4","normalizedValue":"10.0.3.24","aliases":["10.0.3.24"],"observationRefs":["EVT-0042"],"relationshipRefs":[],"firstObserved":"2026-06-10T21:25:00.921148Z","lastObserved":"2026-06-10T21:25:00.921148Z","degree":0},{"entityId":"ipv4:10.0.3.25","type":"ipv4","normalizedValue":"10.0.3.25","aliases":["10.0.3.25"],"observationRefs":["EVT-0113"],"relationshipRefs":[],"firstObserved":"2026-06-12T00:57:06.986281Z","lastObserved":"2026-06-12T00:57:06.986281Z","degree":0},{"entityId":"ipv4:10.0.3.27","type":"ipv4","normalizedValue":"10.0.3.27","aliases":["10.0.3.27"],"observationRefs":["EVT-0210","EVT-0137","EVT-0106","EVT-0085"],"relationshipRefs":[],"firstObserved":"2026-06-10T12:09:59.368729Z","lastObserved":"2026-06-13T07:24:21.751627Z","degree":0},{"entityId":"ipv4:10.0.3.29","type":"ipv4","normalizedValue":"10.0.3.29","aliases":["10.0.3.29"],"observationRefs":["EVT-0114","EVT-0119","EVT-0087"],"relationshipRefs":[],"firstObserved":"2026-06-12T07:55:54.736700Z","lastObserved":"2026-06-13T02:11:29.423126Z","degree":0},{"entityId":"ipv4:10.0.3.78","type":"ipv4","normalizedValue":"10.0.3.78","aliases":["10.0.3.78"],"observationRefs":["EVT-0005","EVT-0048"],"relationshipRefs":[],"firstObserved":"2026-06-11T03:21:03.937588Z","lastObserved":"2026-06-12T18:59:04.644060Z","degree":0},{"entityId":"ipv4:10.0.3.82","type":"ipv4","normalizedValue":"10.0.3.82","aliases":["10.0.3.82"],"observationRefs":["EVT-0034"],"relationshipRefs":[],"firstObserved":"2026-06-12T00:56:43.536471Z","lastObserved":"2026-06-12T00:56:43.536471Z","degree":0},{"entityId":"ipv4:10.0.4.10","type":"ipv4","normalizedValue":"10.0.4.10","aliases":["10.0.4.10"],"observationRefs":["EVT-0203"],"relationshipRefs":[],"firstObserved":"2026-06-11T13:56:04.379651Z","lastObserved":"2026-06-11T13:56:04.379651Z","degree":0},{"entityId":"ipv4:10.0.4.108","type":"ipv4","normalizedValue":"10.0.4.108","aliases":["10.0.4.108"],"observationRefs":["EVT-0029"],"relationshipRefs":[],"firstObserved":"2026-06-10T15:42:39.986198Z","lastObserved":"2026-06-10T15:42:39.986198Z","degree":0},{"entityId":"ipv4:10.0.4.11","type":"ipv4","normalizedValue":"10.0.4.11","aliases":["10.0.4.11"],"observationRefs":["EVT-0204","EVT-0098","EVT-0097","EVT-0090"],"relationshipRefs":[],"firstObserved":"2026-06-10T23:51:56.666230Z","lastObserved":"2026-06-12T18:01:04.842883Z","degree":0},{"entityId":"ipv4:10.0.4.12","type":"ipv4","normalizedValue":"10.0.4.12","aliases":["10.0.4.12"],"observationRefs":["EVT-0206","EVT-0071","EVT-0067","EVT-0099","EVT-0108"],"relationshipRefs":[],"firstObserved":"2026-06-10T09:46:29.618328Z","lastObserved":"2026-06-11T15:28:19.958592Z","degree":0},{"entityId":"ipv4:10.0.4.13","type":"ipv4","normalizedValue":"10.0.4.13","aliases":["10.0.4.13"],"observationRefs":["EVT-0140","EVT-0070"],"relationshipRefs":[],"firstObserved":"2026-06-10T15:39:12.340248Z","lastObserved":"2026-06-11T09:31:48.790384Z","degree":0},{"entityId":"ipv4:10.0.4.14","type":"ipv4","normalizedValue":"10.0.4.14","aliases":["10.0.4.14"],"observationRefs":["EVT-0080","EVT-0066","EVT-0063","EVT-0104"],"relationshipRefs":[],"firstObserved":"2026-06-11T07:06:05.683843Z","lastObserved":"2026-06-12T03:16:40.664293Z","degree":0},{"entityId":"ipv4:10.0.4.15","type":"ipv4","normalizedValue":"10.0.4.15","aliases":["10.0.4.15"],"observationRefs":["EVT-0123","EVT-0071","EVT-0121"],"relationshipRefs":[],"firstObserved":"2026-06-10T11:11:11.437561Z","lastObserved":"2026-06-12T12:02:46.441429Z","degree":0},{"entityId":"ipv4:10.0.4.16","type":"ipv4","normalizedValue":"10.0.4.16","aliases":["10.0.4.16"],"observationRefs":["EVT-0107"],"relationshipRefs":[],"firstObserved":"2026-06-12T10:30:57.120501Z","lastObserved":"2026-06-12T10:30:57.120501Z","degree":0},{"entityId":"ipv4:10.0.4.162","type":"ipv4","normalizedValue":"10.0.4.162","aliases":["10.0.4.162"],"observationRefs":["EVT-0021"],"relationshipRefs":[],"firstObserved":"2026-06-11T21:01:27.094565Z","lastObserved":"2026-06-11T21:01:27.094565Z","degree":0},{"entityId":"ipv4:10.0.4.17","type":"ipv4","normalizedValue":"10.0.4.17","aliases":["10.0.4.17"],"observationRefs":["EVT-0135"],"relationshipRefs":[],"firstObserved":"2026-06-12T04:00:39.646550Z","lastObserved":"2026-06-12T04:00:39.646550Z","degree":0},{"entityId":"ipv4:10.0.4.18","type":"ipv4","normalizedValue":"10.0.4.18","aliases":["10.0.4.18"],"observationRefs":["EVT-0139","EVT-0115","EVT-0090"],"relationshipRefs":[],"firstObserved":"2026-06-10T20:27:01.216356Z","lastObserved":"2026-06-12T18:01:04.842883Z","degree":0},{"entityId":"ipv4:10.0.4.182","type":"ipv4","normalizedValue":"10.0.4.182","aliases":["10.0.4.182"],"observationRefs":["EVT-0032"],"relationshipRefs":[],"firstObserved":"2026-06-13T03:34:49.698945Z","lastObserved":"2026-06-13T03:34:49.698945Z","degree":0},{"entityId":"ipv4:10.0.4.187","type":"ipv4","normalizedValue":"10.0.4.187","aliases":["10.0.4.187"],"observationRefs":["EVT-0033"],"relationshipRefs":[],"firstObserved":"2026-06-13T02:58:23.165329Z","lastObserved":"2026-06-13T02:58:23.165329Z","degree":0},{"entityId":"ipv4:10.0.4.19","type":"ipv4","normalizedValue":"10.0.4.19","aliases":["10.0.4.19"],"observationRefs":["EVT-0198"],"relationshipRefs":[],"firstObserved":"2026-06-11T11:16:12.352464Z","lastObserved":"2026-06-11T11:16:12.352464Z","degree":0},{"entityId":"ipv4:10.0.4.20","type":"ipv4","normalizedValue":"10.0.4.20","aliases":["10.0.4.20"],"observationRefs":["EVT-0094","EVT-0126","EVT-0133","EVT-0087"],"relationshipRefs":["rel_ccd5f46e69ac2c8e"],"firstObserved":"2026-06-10T19:10:05.788416Z","lastObserved":"2026-06-13T02:11:29.423126Z","degree":1},{"entityId":"ipv4:10.0.4.205","type":"ipv4","normalizedValue":"10.0.4.205","aliases":["10.0.4.205"],"observationRefs":["EVT-0053"],"relationshipRefs":[],"firstObserved":"2026-06-12T02:38:33.566378Z","lastObserved":"2026-06-12T02:38:33.566378Z","degree":0},{"entityId":"ipv4:10.0.4.207","type":"ipv4","normalizedValue":"10.0.4.207","aliases":["10.0.4.207"],"observationRefs":["EVT-0059"],"relationshipRefs":[],"firstObserved":"2026-06-11T12:01:42.212359Z","lastObserved":"2026-06-11T12:01:42.212359Z","degree":0},{"entityId":"ipv4:10.0.4.209","type":"ipv4","normalizedValue":"10.0.4.209","aliases":["10.0.4.209"],"observationRefs":["EVT-0004"],"relationshipRefs":[],"firstObserved":"2026-06-12T17:54:45.864623Z","lastObserved":"2026-06-12T17:54:45.864623Z","degree":0},{"entityId":"ipv4:10.0.4.21","type":"ipv4","normalizedValue":"10.0.4.21","aliases":["10.0.4.21"],"observationRefs":["EVT-0140","EVT-0096","EVT-0104"],"relationshipRefs":[],"firstObserved":"2026-06-10T15:39:12.340248Z","lastObserved":"2026-06-12T03:16:40.664293Z","degree":0},{"entityId":"ipv4:10.0.4.22","type":"ipv4","normalizedValue":"10.0.4.22","aliases":["10.0.4.22"],"observationRefs":["EVT-0216","EVT-0084"],"relationshipRefs":[],"firstObserved":"2026-06-10T09:51:41.372814Z","lastObserved":"2026-06-10T19:41:12.690494Z","degree":0},{"entityId":"ipv4:10.0.4.23","type":"ipv4","normalizedValue":"10.0.4.23","aliases":["10.0.4.23"],"observationRefs":["EVT-0088","EVT-0092","EVT-0085"],"relationshipRefs":[],"firstObserved":"2026-06-10T19:03:40.932454Z","lastObserved":"2026-06-13T07:24:21.751627Z","degree":0},{"entityId":"ipv4:10.0.4.24","type":"ipv4","normalizedValue":"10.0.4.24","aliases":["10.0.4.24"],"observationRefs":["EVT-0076","EVT-0051","EVT-0074","EVT-0073"],"relationshipRefs":[],"firstObserved":"2026-06-10T17:00:41.935055Z","lastObserved":"2026-06-12T18:10:52.596043Z","degree":0},{"entityId":"ipv4:10.0.4.247","type":"ipv4","normalizedValue":"10.0.4.247","aliases":["10.0.4.247"],"observationRefs":["EVT-0015"],"relationshipRefs":[],"firstObserved":"2026-06-11T07:40:22.208790Z","lastObserved":"2026-06-11T07:40:22.208790Z","degree":0},{"entityId":"ipv4:10.0.4.25","type":"ipv4","normalizedValue":"10.0.4.25","aliases":["10.0.4.25"],"observationRefs":["EVT-0079"],"relationshipRefs":[],"firstObserved":"2026-06-11T08:09:03.901158Z","lastObserved":"2026-06-11T08:09:03.901158Z","degree":0},{"entityId":"ipv4:10.0.4.26","type":"ipv4","normalizedValue":"10.0.4.26","aliases":["10.0.4.26"],"observationRefs":["EVT-0133","EVT-0082","EVT-0111"],"relationshipRefs":[],"firstObserved":"2026-06-12T18:53:52.382561Z","lastObserved":"2026-06-12T23:22:21.189980Z","degree":0},{"entityId":"ipv4:10.0.4.29","type":"ipv4","normalizedValue":"10.0.4.29","aliases":["10.0.4.29"],"observationRefs":["EVT-0096"],"relationshipRefs":[],"firstObserved":"2026-06-10T20:46:42.214912Z","lastObserved":"2026-06-10T20:46:42.214912Z","degree":0},{"entityId":"ipv4:10.0.4.44","type":"ipv4","normalizedValue":"10.0.4.44","aliases":["10.0.4.44"],"observationRefs":["EVT-0045"],"relationshipRefs":[],"firstObserved":"2026-06-12T17:30:15.202796Z","lastObserved":"2026-06-12T17:30:15.202796Z","degree":0},{"entityId":"ipv4:10.0.4.53","type":"ipv4","normalizedValue":"10.0.4.53","aliases":["10.0.4.53"],"observationRefs":["EVT-0049"],"relationshipRefs":[],"firstObserved":"2026-06-11T19:46:43.199688Z","lastObserved":"2026-06-11T19:46:43.199688Z","degree":0},{"entityId":"ipv4:10.0.4.59","type":"ipv4","normalizedValue":"10.0.4.59","aliases":["10.0.4.59"],"observationRefs":["EVT-0035"],"relationshipRefs":[],"firstObserved":"2026-06-12T14:48:37.755262Z","lastObserved":"2026-06-12T14:48:37.755262Z","degree":0},{"entityId":"ipv4:10.0.5.10","type":"ipv4","normalizedValue":"10.0.5.10","aliases":["10.0.5.10"],"observationRefs":["EVT-0211","EVT-0103"],"relationshipRefs":[],"firstObserved":"2026-06-13T02:42:29.565021Z","lastObserved":"2026-06-13T06:54:52.808353Z","degree":0},{"entityId":"ipv4:10.0.5.11","type":"ipv4","normalizedValue":"10.0.5.11","aliases":["10.0.5.11"],"observationRefs":["EVT-0026","EVT-0195"],"relationshipRefs":[],"firstObserved":"2026-06-11T11:50:35.135756Z","lastObserved":"2026-06-12T14:04:23.602351Z","degree":0},{"entityId":"ipv4:10.0.5.12","type":"ipv4","normalizedValue":"10.0.5.12","aliases":["10.0.5.12"],"observationRefs":["EVT-0084","EVT-0068"],"relationshipRefs":[],"firstObserved":"2026-06-10T19:41:12.690494Z","lastObserved":"2026-06-12T04:40:04.900779Z","degree":0},{"entityId":"ipv4:10.0.5.13","type":"ipv4","normalizedValue":"10.0.5.13","aliases":["10.0.5.13"],"observationRefs":["EVT-0068","EVT-0122"],"relationshipRefs":[],"firstObserved":"2026-06-12T04:40:04.900779Z","lastObserved":"2026-06-12T22:21:21.756883Z","degree":0},{"entityId":"ipv4:10.0.5.137","type":"ipv4","normalizedValue":"10.0.5.137","aliases":["10.0.5.137"],"observationRefs":["EVT-0003"],"relationshipRefs":[],"firstObserved":"2026-06-11T21:44:08.561917Z","lastObserved":"2026-06-11T21:44:08.561917Z","degree":0},{"entityId":"ipv4:10.0.5.14","type":"ipv4","normalizedValue":"10.0.5.14","aliases":["10.0.5.14"],"observationRefs":["EVT-0205"],"relationshipRefs":[],"firstObserved":"2026-06-12T00:48:18.537661Z","lastObserved":"2026-06-12T00:48:18.537661Z","degree":0},{"entityId":"ipv4:10.0.5.15","type":"ipv4","normalizedValue":"10.0.5.15","aliases":["10.0.5.15"],"observationRefs":["EVT-0131","EVT-0081","EVT-0109"],"relationshipRefs":[],"firstObserved":"2026-06-10T21:27:34.395616Z","lastObserved":"2026-06-13T04:21:51.608932Z","degree":0},{"entityId":"ipv4:10.0.5.16","type":"ipv4","normalizedValue":"10.0.5.16","aliases":["10.0.5.16"],"observationRefs":["EVT-0014","EVT-0108","EVT-0097","EVT-0083"],"relationshipRefs":[],"firstObserved":"2026-06-10T23:00:48.297157Z","lastObserved":"2026-06-12T12:16:29.046088Z","degree":0},{"entityId":"ipv4:10.0.5.165","type":"ipv4","normalizedValue":"10.0.5.165","aliases":["10.0.5.165"],"observationRefs":["EVT-0057"],"relationshipRefs":[],"firstObserved":"2026-06-13T02:22:03.427384Z","lastObserved":"2026-06-13T02:22:03.427384Z","degree":0},{"entityId":"ipv4:10.0.5.17","type":"ipv4","normalizedValue":"10.0.5.17","aliases":["10.0.5.17"],"observationRefs":["EVT-0093"],"relationshipRefs":[],"firstObserved":"2026-06-11T20:36:15.876223Z","lastObserved":"2026-06-11T20:36:15.876223Z","degree":0},{"entityId":"ipv4:10.0.5.175","type":"ipv4","normalizedValue":"10.0.5.175","aliases":["10.0.5.175"],"observationRefs":["EVT-0023"],"relationshipRefs":[],"firstObserved":"2026-06-12T13:29:54.225130Z","lastObserved":"2026-06-12T13:29:54.225130Z","degree":0},{"entityId":"ipv4:10.0.5.18","type":"ipv4","normalizedValue":"10.0.5.18","aliases":["10.0.5.18"],"observationRefs":["EVT-0199","EVT-0119"],"relationshipRefs":[],"firstObserved":"2026-06-10T12:18:41.520558Z","lastObserved":"2026-06-13T00:04:04.195656Z","degree":0},{"entityId":"ipv4:10.0.5.189","type":"ipv4","normalizedValue":"10.0.5.189","aliases":["10.0.5.189"],"observationRefs":["EVT-0013"],"relationshipRefs":[],"firstObserved":"2026-06-13T05:44:47.093107Z","lastObserved":"2026-06-13T05:44:47.093107Z","degree":0},{"entityId":"ipv4:10.0.5.19","type":"ipv4","normalizedValue":"10.0.5.19","aliases":["10.0.5.19"],"observationRefs":["EVT-0110","EVT-0077"],"relationshipRefs":[],"firstObserved":"2026-06-10T11:33:38.176114Z","lastObserved":"2026-06-12T08:06:15.898200Z","degree":0},{"entityId":"ipv4:10.0.5.20","type":"ipv4","normalizedValue":"10.0.5.20","aliases":["10.0.5.20"],"observationRefs":["EVT-0079"],"relationshipRefs":[],"firstObserved":"2026-06-11T08:09:03.901158Z","lastObserved":"2026-06-11T08:09:03.901158Z","degree":0},{"entityId":"ipv4:10.0.5.21","type":"ipv4","normalizedValue":"10.0.5.21","aliases":["10.0.5.21"],"observationRefs":["EVT-0105"],"relationshipRefs":["rel_f968a43f0cba0f77"],"firstObserved":"2026-06-12T09:37:39.772267Z","lastObserved":"2026-06-12T09:37:39.772267Z","degree":1},{"entityId":"ipv4:10.0.5.214","type":"ipv4","normalizedValue":"10.0.5.214","aliases":["10.0.5.214"],"observationRefs":["EVT-0055"],"relationshipRefs":[],"firstObserved":"2026-06-12T06:15:52.098136Z","lastObserved":"2026-06-12T06:15:52.098136Z","degree":0},{"entityId":"ipv4:10.0.5.218","type":"ipv4","normalizedValue":"10.0.5.218","aliases":["10.0.5.218"],"observationRefs":["EVT-0016"],"relationshipRefs":[],"firstObserved":"2026-06-12T20:02:27.306774Z","lastObserved":"2026-06-12T20:02:27.306774Z","degree":0},{"entityId":"ipv4:10.0.5.22","type":"ipv4","normalizedValue":"10.0.5.22","aliases":["10.0.5.22"],"observationRefs":["EVT-0202","EVT-0081","EVT-0082"],"relationshipRefs":[],"firstObserved":"2026-06-11T12:46:27.752751Z","lastObserved":"2026-06-12T18:55:43.289178Z","degree":0},{"entityId":"ipv4:10.0.5.225","type":"ipv4","normalizedValue":"10.0.5.225","aliases":["10.0.5.225"],"observationRefs":["EVT-0039"],"relationshipRefs":[],"firstObserved":"2026-06-12T10:09:41.598420Z","lastObserved":"2026-06-12T10:09:41.598420Z","degree":0},{"entityId":"ipv4:10.0.5.226","type":"ipv4","normalizedValue":"10.0.5.226","aliases":["10.0.5.226"],"observationRefs":["EVT-0038"],"relationshipRefs":[],"firstObserved":"2026-06-12T10:30:21.031344Z","lastObserved":"2026-06-12T10:30:21.031344Z","degree":0},{"entityId":"ipv4:10.0.5.23","type":"ipv4","normalizedValue":"10.0.5.23","aliases":["10.0.5.23"],"observationRefs":["EVT-0094"],"relationshipRefs":[],"firstObserved":"2026-06-10T19:10:05.788416Z","lastObserved":"2026-06-10T19:10:05.788416Z","degree":0},{"entityId":"ipv4:10.0.5.25","type":"ipv4","normalizedValue":"10.0.5.25","aliases":["10.0.5.25"],"observationRefs":["EVT-0070"],"relationshipRefs":[],"firstObserved":"2026-06-11T09:31:48.790384Z","lastObserved":"2026-06-11T09:31:48.790384Z","degree":0},{"entityId":"ipv4:10.0.5.26","type":"ipv4","normalizedValue":"10.0.5.26","aliases":["10.0.5.26"],"observationRefs":["EVT-0066","EVT-0002","EVT-0062"],"relationshipRefs":[],"firstObserved":"2026-06-11T11:08:13.385686Z","lastObserved":"2026-06-12T06:00:13.395631Z","degree":0},{"entityId":"ipv4:10.0.5.27","type":"ipv4","normalizedValue":"10.0.5.27","aliases":["10.0.5.27"],"observationRefs":["EVT-0078"],"relationshipRefs":["rel_14310194fa6a1f34"],"firstObserved":"2026-06-13T07:41:34.251699Z","lastObserved":"2026-06-13T07:41:34.251699Z","degree":1},{"entityId":"ipv4:10.0.5.29","type":"ipv4","normalizedValue":"10.0.5.29","aliases":["10.0.5.29"],"observationRefs":["EVT-0089","EVT-0127"],"relationshipRefs":[],"firstObserved":"2026-06-10T15:34:04.605935Z","lastObserved":"2026-06-11T15:04:19.669750Z","degree":0},{"entityId":"ipv4:10.0.5.43","type":"ipv4","normalizedValue":"10.0.5.43","aliases":["10.0.5.43"],"observationRefs":["EVT-0054"],"relationshipRefs":[],"firstObserved":"2026-06-11T01:19:38.981577Z","lastObserved":"2026-06-11T01:19:38.981577Z","degree":0},{"entityId":"ipv4:10.0.5.52","type":"ipv4","normalizedValue":"10.0.5.52","aliases":["10.0.5.52"],"observationRefs":["EVT-0031"],"relationshipRefs":[],"firstObserved":"2026-06-12T11:17:50.636387Z","lastObserved":"2026-06-12T11:17:50.636387Z","degree":0},{"entityId":"ipv4:10.0.5.57","type":"ipv4","normalizedValue":"10.0.5.57","aliases":["10.0.5.57"],"observationRefs":["EVT-0028"],"relationshipRefs":[],"firstObserved":"2026-06-11T00:19:26.577031Z","lastObserved":"2026-06-11T00:19:26.577031Z","degree":0},{"entityId":"ipv4:13.107.42.14","type":"ipv4","normalizedValue":"13.107.42.14","aliases":["13.107.42.14"],"observationRefs":["EVT-0105"],"relationshipRefs":["rel_f968a43f0cba0f77"],"firstObserved":"2026-06-12T09:37:39.772267Z","lastObserved":"2026-06-12T09:37:39.772267Z","degree":1},{"entityId":"ipv4:151.101.65.140","type":"ipv4","normalizedValue":"151.101.65.140","aliases":["151.101.65.140"],"observationRefs":["EVT-0075","EVT-0078"],"relationshipRefs":["rel_c10dfc02b204c4b2","rel_14310194fa6a1f34"],"firstObserved":"2026-06-11T23:15:10.853857Z","lastObserved":"2026-06-13T07:41:34.251699Z","degree":2},{"entityId":"ipv4:185.220.101.45","type":"ipv4","normalizedValue":"185.220.101.45","aliases":["185.220.101.45"],"observationRefs":["EVT-0223","EVT-0224","EVT-0225"],"relationshipRefs":["rel_6b8664fc8ea94ca2","rel_41e1d389af71e938","rel_84f2efde7f63e0df","rel_7cff5a58b6dcf055","rel_bc30fe02ac81c27f","rel_e185f43459a19b77"],"firstObserved":"2026-06-10T09:03:17Z","lastObserved":"2026-06-10T09:34:21Z","degree":6},{"entityId":"ipv4:8.8.8.8","type":"ipv4","normalizedValue":"8.8.8.8","aliases":["8.8.8.8"],"observationRefs":["EVT-0126"],"relationshipRefs":["rel_ccd5f46e69ac2c8e"],"firstObserved":"2026-06-11T11:16:40.019911Z","lastObserved":"2026-06-11T11:16:40.019911Z","degree":1},{"entityId":"process:AUTH-SRV-01:2341","type":"process","normalizedValue":"2341","aliases":["2341"],"observationRefs":["EVT-0229"],"relationshipRefs":["rel_e19519e87f175b93","rel_30e54ca7752ab77e"],"firstObserved":"2026-06-10T11:23:08Z","lastObserved":"2026-06-10T11:23:08Z","degree":2},{"entityId":"process:AUTH-SRV-01:2398","type":"process","normalizedValue":"2398","aliases":["2398"],"observationRefs":["EVT-0230"],"relationshipRefs":["rel_30e54ca7752ab77e"],"firstObserved":"2026-06-10T11:28:42Z","lastObserved":"2026-06-10T11:28:42Z","degree":1},{"entityId":"process:FILE-SRV-02:3871","type":"process","normalizedValue":"3871","aliases":["3871"],"observationRefs":["EVT-0233"],"relationshipRefs":["rel_377b5e159dfa11bb","rel_c3149da4d35bf861","rel_80a7f1a9e48c203f","rel_c3504efdff29d0bd","rel_cb1574c78f6d4056"],"firstObserved":"2026-06-10T13:12:07Z","lastObserved":"2026-06-10T13:12:07Z","degree":5},{"entityId":"process:FILE-SRV-02:4012","type":"process","normalizedValue":"4012","aliases":["4012"],"observationRefs":["EVT-0234"],"relationshipRefs":["rel_80a7f1a9e48c203f","rel_0780f89e83cc23a9"],"firstObserved":"2026-06-10T14:05:22Z","lastObserved":"2026-06-10T14:05:22Z","degree":2},{"entityId":"process:FILE-SRV-02:4044","type":"process","normalizedValue":"4044","aliases":["4044"],"observationRefs":["EVT-0235"],"relationshipRefs":["rel_c3504efdff29d0bd","rel_0780f89e83cc23a9","rel_bf63a511d673f1d5"],"firstObserved":"2026-06-10T14:07:55Z","lastObserved":"2026-06-10T14:07:55Z","degree":3},{"entityId":"process:FILE-SRV-02:5521","type":"process","normalizedValue":"5521","aliases":["5521"],"observationRefs":["EVT-0236"],"relationshipRefs":["rel_cb1574c78f6d4056","rel_bf63a511d673f1d5","rel_2c1e45554bd3da5a","rel_e956c4e26edf014c"],"firstObserved":"2026-06-10T16:34:12Z","lastObserved":"2026-06-10T16:34:12Z","degree":4},{"entityId":"process:WKSTN-01:1052","type":"process","normalizedValue":"1052","aliases":["1052"],"observationRefs":["EVT-0159"],"relationshipRefs":["rel_543cb6b7e8e4ff63"],"firstObserved":"2026-06-10T18:19:08.876335Z","lastObserved":"2026-06-10T18:19:08.876335Z","degree":1},{"entityId":"process:WKSTN-01:2577","type":"process","normalizedValue":"2577","aliases":["2577"],"observationRefs":["EVT-0180"],"relationshipRefs":["rel_1d0a35a5c29aa141","rel_2909cdb826efd836","rel_85245e6d2010f6b9","rel_a6afab38abbaa54a"],"firstObserved":"2026-06-10T12:06:58.828725Z","lastObserved":"2026-06-10T12:06:58.828725Z","degree":4},{"entityId":"process:WKSTN-01:3131","type":"process","normalizedValue":"3131","aliases":["3131"],"observationRefs":["EVT-0190"],"relationshipRefs":["rel_1d0a35a5c29aa141"],"firstObserved":"2026-06-13T04:07:27.113794Z","lastObserved":"2026-06-13T04:07:27.113794Z","degree":1},{"entityId":"process:WKSTN-01:4253","type":"process","normalizedValue":"4253","aliases":["4253"],"observationRefs":["EVT-0171"],"relationshipRefs":["rel_85245e6d2010f6b9"],"firstObserved":"2026-06-11T12:29:43.990005Z","lastObserved":"2026-06-11T12:29:43.990005Z","degree":1},{"entityId":"process:WKSTN-01:9612","type":"process","normalizedValue":"9612","aliases":["9612"],"observationRefs":["EVT-0155"],"relationshipRefs":["rel_543cb6b7e8e4ff63"],"firstObserved":"2026-06-12T22:39:14.761511Z","lastObserved":"2026-06-12T22:39:14.761511Z","degree":1},{"entityId":"process:WKSTN-01:9691","type":"process","normalizedValue":"9691","aliases":["9691"],"observationRefs":["EVT-0162"],"relationshipRefs":["rel_2909cdb826efd836"],"firstObserved":"2026-06-13T04:08:50.678413Z","lastObserved":"2026-06-13T04:08:50.678413Z","degree":1},{"entityId":"process:WKSTN-01:9736","type":"process","normalizedValue":"9736","aliases":["9736"],"observationRefs":["EVT-0144"],"relationshipRefs":["rel_a6afab38abbaa54a"],"firstObserved":"2026-06-11T14:27:41.334185Z","lastObserved":"2026-06-11T14:27:41.334185Z","degree":1},{"entityId":"process:WKSTN-02:2934","type":"process","normalizedValue":"2934","aliases":["2934"],"observationRefs":["EVT-0156"],"relationshipRefs":[],"firstObserved":"2026-06-11T22:30:09.186275Z","lastObserved":"2026-06-11T22:30:09.186275Z","degree":0},{"entityId":"process:WKSTN-02:4090","type":"process","normalizedValue":"4090","aliases":["4090"],"observationRefs":["EVT-0187"],"relationshipRefs":[],"firstObserved":"2026-06-10T13:40:10.848419Z","lastObserved":"2026-06-10T13:40:10.848419Z","degree":0},{"entityId":"process:WKSTN-02:4109","type":"process","normalizedValue":"4109","aliases":["4109"],"observationRefs":["EVT-0149"],"relationshipRefs":[],"firstObserved":"2026-06-10T22:43:26.429914Z","lastObserved":"2026-06-10T22:43:26.429914Z","degree":0},{"entityId":"process:WKSTN-02:4419","type":"process","normalizedValue":"4419","aliases":["4419"],"observationRefs":["EVT-0160"],"relationshipRefs":[],"firstObserved":"2026-06-12T18:08:37.149034Z","lastObserved":"2026-06-12T18:08:37.149034Z","degree":0},{"entityId":"process:WKSTN-02:7078","type":"process","normalizedValue":"7078","aliases":["7078"],"observationRefs":["EVT-0153"],"relationshipRefs":[],"firstObserved":"2026-06-12T15:10:02.539810Z","lastObserved":"2026-06-12T15:10:02.539810Z","degree":0},{"entityId":"process:WKSTN-02:7632","type":"process","normalizedValue":"7632","aliases":["7632"],"observationRefs":["EVT-0172"],"relationshipRefs":[],"firstObserved":"2026-06-12T21:00:27.515647Z","lastObserved":"2026-06-12T21:00:27.515647Z","degree":0},{"entityId":"process:WKSTN-03:5907","type":"process","normalizedValue":"5907","aliases":["5907"],"observationRefs":["EVT-0148"],"relationshipRefs":[],"firstObserved":"2026-06-11T17:28:12.381788Z","lastObserved":"2026-06-11T17:28:12.381788Z","degree":0},{"entityId":"process:WKSTN-03:8230","type":"process","normalizedValue":"8230","aliases":["8230"],"observationRefs":["EVT-0176"],"relationshipRefs":["rel_0cd7fc4a1756e7b8"],"firstObserved":"2026-06-12T03:15:28.402358Z","lastObserved":"2026-06-12T03:15:28.402358Z","degree":1},{"entityId":"process:WKSTN-03:8921","type":"process","normalizedValue":"8921","aliases":["8921"],"observationRefs":["EVT-0183"],"relationshipRefs":["rel_0cd7fc4a1756e7b8"],"firstObserved":"2026-06-10T18:51:47.084315Z","lastObserved":"2026-06-10T18:51:47.084315Z","degree":1},{"entityId":"process:WKSTN-03:8933","type":"process","normalizedValue":"8933","aliases":["8933"],"observationRefs":["EVT-0168"],"relationshipRefs":[],"firstObserved":"2026-06-10T14:01:45.325234Z","lastObserved":"2026-06-10T14:01:45.325234Z","degree":0},{"entityId":"process:WKSTN-04:2244","type":"process","normalizedValue":"2244","aliases":["2244"],"observationRefs":["EVT-0166"],"relationshipRefs":[],"firstObserved":"2026-06-11T14:30:37.545256Z","lastObserved":"2026-06-11T14:30:37.545256Z","degree":0},{"entityId":"process:WKSTN-04:5341","type":"process","normalizedValue":"5341","aliases":["5341"],"observationRefs":["EVT-0173"],"relationshipRefs":[],"firstObserved":"2026-06-11T16:31:53.576072Z","lastObserved":"2026-06-11T16:31:53.576072Z","degree":0},{"entityId":"process:WKSTN-04:5409","type":"process","normalizedValue":"5409","aliases":["5409"],"observationRefs":["EVT-0161"],"relationshipRefs":["rel_ffd214d59f8f33e7"],"firstObserved":"2026-06-12T15:30:45.933847Z","lastObserved":"2026-06-12T15:30:45.933847Z","degree":1},{"entityId":"process:WKSTN-04:5694","type":"process","normalizedValue":"5694","aliases":["5694"],"observationRefs":["EVT-0185"],"relationshipRefs":[],"firstObserved":"2026-06-12T08:16:33.013731Z","lastObserved":"2026-06-12T08:16:33.013731Z","degree":0},{"entityId":"process:WKSTN-04:9163","type":"process","normalizedValue":"9163","aliases":["9163"],"observationRefs":["EVT-0158"],"relationshipRefs":["rel_ffd214d59f8f33e7"],"firstObserved":"2026-06-11T17:07:26.334963Z","lastObserved":"2026-06-11T17:07:26.334963Z","degree":1},{"entityId":"process:WKSTN-05:4775","type":"process","normalizedValue":"4775","aliases":["4775"],"observationRefs":["EVT-0163"],"relationshipRefs":[],"firstObserved":"2026-06-11T23:36:10.574094Z","lastObserved":"2026-06-11T23:36:10.574094Z","degree":0},{"entityId":"process:WKSTN-05:5002","type":"process","normalizedValue":"5002","aliases":["5002"],"observationRefs":["EVT-0150"],"relationshipRefs":[],"firstObserved":"2026-06-10T09:05:40.279231Z","lastObserved":"2026-06-10T09:05:40.279231Z","degree":0},{"entityId":"process:WKSTN-05:6480","type":"process","normalizedValue":"6480","aliases":["6480"],"observationRefs":["EVT-0142"],"relationshipRefs":[],"firstObserved":"2026-06-10T21:41:40.136056Z","lastObserved":"2026-06-10T21:41:40.136056Z","degree":0},{"entityId":"process:WKSTN-06:1723","type":"process","normalizedValue":"1723","aliases":["1723"],"observationRefs":["EVT-0182"],"relationshipRefs":[],"firstObserved":"2026-06-11T21:49:25.220591Z","lastObserved":"2026-06-11T21:49:25.220591Z","degree":0},{"entityId":"process:WKSTN-06:2842","type":"process","normalizedValue":"2842","aliases":["2842"],"observationRefs":["EVT-0186"],"relationshipRefs":[],"firstObserved":"2026-06-12T08:52:01.323938Z","lastObserved":"2026-06-12T08:52:01.323938Z","degree":0},{"entityId":"process:WKSTN-06:4780","type":"process","normalizedValue":"4780","aliases":["4780"],"observationRefs":["EVT-0177"],"relationshipRefs":["rel_2716286741966063"],"firstObserved":"2026-06-11T19:33:50.203756Z","lastObserved":"2026-06-11T19:33:50.203756Z","degree":1},{"entityId":"process:WKSTN-06:5459","type":"process","normalizedValue":"5459","aliases":["5459"],"observationRefs":["EVT-0157"],"relationshipRefs":["rel_b2da9c57949d2750"],"firstObserved":"2026-06-11T18:10:19.904909Z","lastObserved":"2026-06-11T18:10:19.904909Z","degree":1},{"entityId":"process:WKSTN-06:6443","type":"process","normalizedValue":"6443","aliases":["6443"],"observationRefs":["EVT-0167"],"relationshipRefs":[],"firstObserved":"2026-06-11T00:49:30.104519Z","lastObserved":"2026-06-11T00:49:30.104519Z","degree":0},{"entityId":"process:WKSTN-06:6493","type":"process","normalizedValue":"6493","aliases":["6493"],"observationRefs":["EVT-0179"],"relationshipRefs":["rel_2716286741966063","rel_b2da9c57949d2750"],"firstObserved":"2026-06-11T11:44:31.430862Z","lastObserved":"2026-06-11T11:44:31.430862Z","degree":2},{"entityId":"process:WKSTN-06:9802","type":"process","normalizedValue":"9802","aliases":["9802"],"observationRefs":["EVT-0164"],"relationshipRefs":[],"firstObserved":"2026-06-11T18:39:09.582038Z","lastObserved":"2026-06-11T18:39:09.582038Z","degree":0},{"entityId":"process:WKSTN-07:4872","type":"process","normalizedValue":"4872","aliases":["4872"],"observationRefs":["EVT-0221"],"relationshipRefs":["rel_0939f1e464f16e02","rel_7677da129f60f5ff","rel_6b8664fc8ea94ca2"],"firstObserved":"2026-06-10T08:12:33Z","lastObserved":"2026-06-10T08:12:33Z","degree":3},{"entityId":"process:WKSTN-07:5104","type":"process","normalizedValue":"5104","aliases":["5104"],"observationRefs":["EVT-0222","EVT-0226"],"relationshipRefs":["rel_0939f1e464f16e02","rel_7677da129f60f5ff","rel_41e1d389af71e938","rel_2fc1e2d819f1d0d1","rel_911fbdf121802983"],"firstObserved":"2026-06-10T08:12:35Z","lastObserved":"2026-06-10T10:07:51Z","degree":5},{"entityId":"process:WKSTN-07:612","type":"process","normalizedValue":"612","aliases":["612"],"observationRefs":["EVT-0226"],"relationshipRefs":["rel_2fc1e2d819f1d0d1","rel_911fbdf121802983"],"firstObserved":"2026-06-10T10:07:51Z","lastObserved":"2026-06-10T10:07:51Z","degree":2},{"entityId":"process:WKSTN-08:2796","type":"process","normalizedValue":"2796","aliases":["2796"],"observationRefs":["EVT-0154"],"relationshipRefs":[],"firstObserved":"2026-06-11T20:48:14.324572Z","lastObserved":"2026-06-11T20:48:14.324572Z","degree":0},{"entityId":"process:WKSTN-08:2847","type":"process","normalizedValue":"2847","aliases":["2847"],"observationRefs":["EVT-0175"],"relationshipRefs":[],"firstObserved":"2026-06-10T12:37:08.758133Z","lastObserved":"2026-06-10T12:37:08.758133Z","degree":0},{"entityId":"process:WKSTN-08:2949","type":"process","normalizedValue":"2949","aliases":["2949"],"observationRefs":["EVT-0151"],"relationshipRefs":["rel_97cde3b0610ea5fb"],"firstObserved":"2026-06-12T16:48:39.361865Z","lastObserved":"2026-06-12T16:48:39.361865Z","degree":1},{"entityId":"process:WKSTN-08:3323","type":"process","normalizedValue":"3323","aliases":["3323"],"observationRefs":["EVT-0146"],"relationshipRefs":[],"firstObserved":"2026-06-11T15:35:55.236814Z","lastObserved":"2026-06-11T15:35:55.236814Z","degree":0},{"entityId":"process:WKSTN-08:5633","type":"process","normalizedValue":"5633","aliases":["5633"],"observationRefs":["EVT-0152"],"relationshipRefs":[],"firstObserved":"2026-06-10T10:57:37.982291Z","lastObserved":"2026-06-10T10:57:37.982291Z","degree":0},{"entityId":"process:WKSTN-08:6181","type":"process","normalizedValue":"6181","aliases":["6181"],"observationRefs":["EVT-0141"],"relationshipRefs":["rel_97cde3b0610ea5fb"],"firstObserved":"2026-06-13T03:04:15.015833Z","lastObserved":"2026-06-13T03:04:15.015833Z","degree":1},{"entityId":"process:WKSTN-09:1737","type":"process","normalizedValue":"1737","aliases":["1737"],"observationRefs":["EVT-0184"],"relationshipRefs":[],"firstObserved":"2026-06-10T19:35:47.005698Z","lastObserved":"2026-06-10T19:35:47.005698Z","degree":0},{"entityId":"process:WKSTN-09:2916","type":"process","normalizedValue":"2916","aliases":["2916"],"observationRefs":["EVT-0165"],"relationshipRefs":[],"firstObserved":"2026-06-12T12:40:49.190476Z","lastObserved":"2026-06-12T12:40:49.190476Z","degree":0},{"entityId":"process:WKSTN-09:3445","type":"process","normalizedValue":"3445","aliases":["3445"],"observationRefs":["EVT-0178"],"relationshipRefs":[],"firstObserved":"2026-06-11T07:28:39.978902Z","lastObserved":"2026-06-11T07:28:39.978902Z","degree":0},{"entityId":"process:WKSTN-09:6515","type":"process","normalizedValue":"6515","aliases":["6515"],"observationRefs":["EVT-0147"],"relationshipRefs":["rel_6fc19bdab346f9ed"],"firstObserved":"2026-06-11T16:38:31.959259Z","lastObserved":"2026-06-11T16:38:31.959259Z","degree":1},{"entityId":"process:WKSTN-09:6799","type":"process","normalizedValue":"6799","aliases":["6799"],"observationRefs":["EVT-0181"],"relationshipRefs":[],"firstObserved":"2026-06-11T06:50:13.194708Z","lastObserved":"2026-06-11T06:50:13.194708Z","degree":0},{"entityId":"process:WKSTN-09:8067","type":"process","normalizedValue":"8067","aliases":["8067"],"observationRefs":["EVT-0170"],"relationshipRefs":["rel_6fc19bdab346f9ed"],"firstObserved":"2026-06-11T05:09:06.671408Z","lastObserved":"2026-06-11T05:09:06.671408Z","degree":1},{"entityId":"process:WKSTN-10:1689","type":"process","normalizedValue":"1689","aliases":["1689"],"observationRefs":["EVT-0143"],"relationshipRefs":[],"firstObserved":"2026-06-11T06:56:50.158387Z","lastObserved":"2026-06-11T06:56:50.158387Z","degree":0},{"entityId":"process:WKSTN-10:4845","type":"process","normalizedValue":"4845","aliases":["4845"],"observationRefs":["EVT-0188"],"relationshipRefs":["rel_c0f9a0d0bb267d21"],"firstObserved":"2026-06-12T17:10:30.174600Z","lastObserved":"2026-06-12T17:10:30.174600Z","degree":1},{"entityId":"process:WKSTN-10:6661","type":"process","normalizedValue":"6661","aliases":["6661"],"observationRefs":["EVT-0145"],"relationshipRefs":["rel_a9f3d3582d652e24"],"firstObserved":"2026-06-12T00:44:33.219009Z","lastObserved":"2026-06-12T00:44:33.219009Z","degree":1},{"entityId":"process:WKSTN-10:6720","type":"process","normalizedValue":"6720","aliases":["6720"],"observationRefs":["EVT-0174"],"relationshipRefs":[],"firstObserved":"2026-06-11T01:41:07.455907Z","lastObserved":"2026-06-11T01:41:07.455907Z","degree":0},{"entityId":"process:WKSTN-10:7640","type":"process","normalizedValue":"7640","aliases":["7640"],"observationRefs":["EVT-0169"],"relationshipRefs":["rel_a9f3d3582d652e24","rel_c0f9a0d0bb267d21"],"firstObserved":"2026-06-11T23:56:24.035700Z","lastObserved":"2026-06-11T23:56:24.035700Z","degree":2},{"entityId":"process:WKSTN-10:8796","type":"process","normalizedValue":"8796","aliases":["8796"],"observationRefs":["EVT-0189"],"relationshipRefs":[],"firstObserved":"2026-06-11T13:18:47.088963Z","lastObserved":"2026-06-11T13:18:47.088963Z","degree":0},{"entityId":"service:FILE-SRV-02:PSEXESVC","type":"service","normalizedValue":"PSEXESVC","aliases":["PSEXESVC"],"observationRefs":["EVT-0232","EVT-0241"],"relationshipRefs":["rel_e01f16b7077efdad","rel_377b5e159dfa11bb","rel_94a3dff146addda7","rel_c3149da4d35bf861","rel_2a48ee292b08f3ec"],"firstObserved":"2026-06-10T13:12:04Z","lastObserved":"2026-06-10T20:05:38Z","degree":5},{"entityId":"user:asmith","type":"user","normalizedValue":"asmith","aliases":["asmith"],"observationRefs":["EVT-0199","EVT-0187","EVT-0006","EVT-0011","EVT-0189","EVT-0203","EVT-0047","EVT-0049","EVT-0034","EVT-0037","EVT-0207"],"relationshipRefs":[],"firstObserved":"2026-06-10T12:18:41.520558Z","lastObserved":"2026-06-12T22:59:45.883199Z","degree":0},{"entityId":"user:bwilliams","type":"user","normalizedValue":"bwilliams","aliases":["bwilliams"],"observationRefs":["EVT-0180","EVT-0170","EVT-0173","EVT-0003","EVT-0163","EVT-0145","EVT-0213","EVT-0036","EVT-0045","EVT-0017","EVT-0162","EVT-0007"],"relationshipRefs":["rel_1d0a35a5c29aa141","rel_2909cdb826efd836","rel_85245e6d2010f6b9","rel_a6afab38abbaa54a","rel_6fc19bdab346f9ed","rel_a9f3d3582d652e24"],"firstObserved":"2026-06-10T12:06:58.828725Z","lastObserved":"2026-06-13T07:19:39.837409Z","degree":6},{"entityId":"user:cjohnson","type":"user","normalizedValue":"cjohnson","aliases":["cjohnson"],"observationRefs":["EVT-0181","EVT-0202","EVT-0164","EVT-0218","EVT-0002","EVT-0186","EVT-0195","EVT-0155","EVT-0033","EVT-0141","EVT-0022"],"relationshipRefs":["rel_543cb6b7e8e4ff63","rel_97cde3b0610ea5fb"],"firstObserved":"2026-06-11T06:50:13.194708Z","lastObserved":"2026-06-13T06:28:21.009868Z","degree":2},{"entityId":"user:dtaylor","type":"user","normalizedValue":"dtaylor","aliases":["dtaylor"],"observationRefs":["EVT-0209","EVT-0150","EVT-0183","EVT-0052","EVT-0142","EVT-0149","EVT-0204","EVT-0028","EVT-0167","EVT-0005","EVT-0059","EVT-0171","EVT-0148","EVT-0157","EVT-0169","EVT-0056","EVT-0192","EVT-0038","EVT-0004","EVT-0160","EVT-0032","EVT-0193"],"relationshipRefs":["rel_85245e6d2010f6b9","rel_0cd7fc4a1756e7b8","rel_b2da9c57949d2750","rel_a9f3d3582d652e24","rel_c0f9a0d0bb267d21"],"firstObserved":"2026-06-10T08:50:44.249433Z","lastObserved":"2026-06-13T05:39:45.933394Z","degree":5},{"entityId":"user:ewhite","type":"user","normalizedValue":"ewhite","aliases":["ewhite"],"observationRefs":["EVT-0206","EVT-0024","EVT-0210","EVT-0174","EVT-0205","EVT-0053","EVT-0031","EVT-0165","EVT-0161","EVT-0188","EVT-0048","EVT-0016","EVT-0172","EVT-0013"],"relationshipRefs":["rel_ffd214d59f8f33e7","rel_c0f9a0d0bb267d21"],"firstObserved":"2026-06-10T09:46:29.618328Z","lastObserved":"2026-06-13T05:44:47.093107Z","degree":2},{"entityId":"user:fmartinez","type":"user","normalizedValue":"fmartinez","aliases":["fmartinez"],"observationRefs":["EVT-0152","EVT-0215","EVT-0175","EVT-0029","EVT-0194","EVT-0020","EVT-0191","EVT-0208","EVT-0015","EVT-0147","EVT-0154","EVT-0023","EVT-0201","EVT-0060","EVT-0196","EVT-0018"],"relationshipRefs":["rel_ee58b4b2d5f16fcf","rel_6fc19bdab346f9ed"],"firstObserved":"2026-06-10T10:57:37.982291Z","lastObserved":"2026-06-13T00:47:41.254884Z","degree":2},{"entityId":"user:glee","type":"user","normalizedValue":"glee","aliases":["glee"],"observationRefs":["EVT-0216","EVT-0168","EVT-0042","EVT-0014","EVT-0054","EVT-0179","EVT-0166","EVT-0217","EVT-0041","EVT-0057"],"relationshipRefs":["rel_2716286741966063","rel_b2da9c57949d2750"],"firstObserved":"2026-06-10T09:51:41.372814Z","lastObserved":"2026-06-13T02:22:03.427384Z","degree":2},{"entityId":"user:hwalker","type":"user","normalizedValue":"hwalker","aliases":["hwalker"],"observationRefs":["EVT-0009","EVT-0019","EVT-0051","EVT-0030","EVT-0010","EVT-0043","EVT-0197","EVT-0219","EVT-0025","EVT-0176","EVT-0185","EVT-0039","EVT-0008","EVT-0027","EVT-0153"],"relationshipRefs":["rel_0cd7fc4a1756e7b8"],"firstObserved":"2026-06-10T14:40:12.102241Z","lastObserved":"2026-06-12T15:10:02.539810Z","degree":1},{"entityId":"user:iharris","type":"user","normalizedValue":"iharris","aliases":["iharris"],"observationRefs":["EVT-0040","EVT-0178","EVT-0220","EVT-0050","EVT-0158","EVT-0177","EVT-0055","EVT-0012","EVT-0214","EVT-0211","EVT-0190"],"relationshipRefs":["rel_1d0a35a5c29aa141","rel_2716286741966063","rel_ffd214d59f8f33e7"],"firstObserved":"2026-06-10T15:45:17.487358Z","lastObserved":"2026-06-13T04:07:27.113794Z","degree":3},{"entityId":"user:jclark","type":"user","normalizedValue":"jclark","aliases":["jclark"],"observationRefs":["EVT-0159","EVT-0184","EVT-0143","EVT-0198","EVT-0044","EVT-0026","EVT-0144","EVT-0146","EVT-0058","EVT-0021","EVT-0182","EVT-0156","EVT-0200","EVT-0046","EVT-0001","EVT-0035","EVT-0151","EVT-0212"],"relationshipRefs":["rel_a6afab38abbaa54a","rel_543cb6b7e8e4ff63","rel_97cde3b0610ea5fb"],"firstObserved":"2026-06-10T18:19:08.876335Z","lastObserved":"2026-06-13T04:51:58.957297Z","degree":3},{"entityId":"user:jdavis","type":"user","normalizedValue":"jdavis","aliases":["jdavis"],"observationRefs":["EVT-0221","EVT-0222","EVT-0226","EVT-0227","EVT-0228","EVT-0229","EVT-0230","EVT-0232","EVT-0233","EVT-0234","EVT-0235","EVT-0236","EVT-0237","EVT-0238","EVT-0239","EVT-0240","EVT-0241","EVT-0242"],"relationshipRefs":["rel_0939f1e464f16e02","rel_7677da129f60f5ff","rel_6b8664fc8ea94ca2","rel_41e1d389af71e938","rel_2fc1e2d819f1d0d1","rel_911fbdf121802983","rel_e19519e87f175b93","rel_30e54ca7752ab77e","rel_e01f16b7077efdad","rel_377b5e159dfa11bb","rel_94a3dff146addda7","rel_c3149da4d35bf861","rel_80a7f1a9e48c203f","rel_c3504efdff29d0bd","rel_cb1574c78f6d4056","rel_0780f89e83cc23a9","rel_bf63a511d673f1d5","rel_2c1e45554bd3da5a","rel_e956c4e26edf014c","rel_9b04eaf1d95b73db","rel_64733faa5a66e953","rel_cd2f163cc2522e63","rel_2a48ee292b08f3ec"],"firstObserved":"2026-06-10T08:12:33Z","lastObserved":"2026-06-10T20:08:11Z","degree":23}],"observations":[{"observationId":"EVT-0221","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-10T08:12:33Z","entities":[{"entityId":"host:WKSTN-07","type":"host","rawValue":"WKSTN-07","normalizedValue":"WKSTN-07","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0221","role":"host"},{"entityId":"user:jdavis","type":"user","rawValue":"jdavis","normalizedValue":"jdavis","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0221","role":"actor_user"},{"entityId":"process:WKSTN-07:4872","type":"process","rawValue":"4872","normalizedValue":"4872","normalizationMethod":"verbatim","sourceObservationId":"EVT-0221","role":"process"}],"attributes":{"hostname":"WKSTN-07","username":"jdavis","process_name":"cmd.exe","parent_process":"WINWORD.EXE","process_path":"C:\\Windows\\System32\\cmd.exe","command_line":"cmd.exe /c powershell.exe -nop -w hidden -enc JABjAGwAaQBlAG4AdA...","pid":4872,"integrity_level":"medium"},"raw":{"event_id":"EVT-0221","source_type":"endpoint","timestamp":"2026-06-10T08:12:33Z","event_name":"process_create","hostname":"WKSTN-07","username":"jdavis","process_name":"cmd.exe","parent_process":"WINWORD.EXE","process_path":"C:\\Windows\\System32\\cmd.exe","command_line":"cmd.exe /c powershell.exe -nop -w hidden -enc JABjAGwAaQBlAG4AdA...","pid":4872,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0222","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-10T08:12:35Z","entities":[{"entityId":"host:WKSTN-07","type":"host","rawValue":"WKSTN-07","normalizedValue":"WKSTN-07","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0222","role":"host"},{"entityId":"user:jdavis","type":"user","rawValue":"jdavis","normalizedValue":"jdavis","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0222","role":"actor_user"},{"entityId":"process:WKSTN-07:5104","type":"process","rawValue":"5104","normalizedValue":"5104","normalizationMethod":"verbatim","sourceObservationId":"EVT-0222","role":"process"}],"attributes":{"hostname":"WKSTN-07","username":"jdavis","process_name":"powershell.exe","parent_process":"cmd.exe","process_path":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","command_line":"powershell.exe -nop -w hidden -enc JABjAGwAaQBlAG4AdA...","pid":5104,"integrity_level":"medium"},"raw":{"event_id":"EVT-0222","source_type":"endpoint","timestamp":"2026-06-10T08:12:35Z","event_name":"process_create","hostname":"WKSTN-07","username":"jdavis","process_name":"powershell.exe","parent_process":"cmd.exe","process_path":"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","command_line":"powershell.exe -nop -w hidden -enc JABjAGwAaQBlAG4AdA...","pid":5104,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0209","sourceType":"cloud_storage","eventType":"file_download","timestamp":"2026-06-10T08:50:44.249433Z","entities":[{"entityId":"user:dtaylor","type":"user","rawValue":"dtaylor","normalizedValue":"dtaylor","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0209","role":"actor_user"},{"entityId":"ipv4:10.0.2.17","type":"ipv4","rawValue":"10.0.2.17","normalizedValue":"10.0.2.17","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0209","role":"source_ip"},{"entityId":"bucket:corp-documents","type":"bucket","rawValue":"corp-documents","normalizedValue":"corp-documents","normalizationMethod":"verbatim","sourceObservationId":"EVT-0209","role":"bucket"},{"entityId":"cloud_object:corp-documents/Team_OKRs_2026.xlsx","type":"cloud_object","rawValue":"corp-documents/Team_OKRs_2026.xlsx","normalizedValue":"corp-documents/Team_OKRs_2026.xlsx","normalizationMethod":"verbatim","sourceObservationId":"EVT-0209","role":"cloud_object"}],"attributes":{"username":"dtaylor","source_ip":"10.0.2.17","file_name":"Team_OKRs_2026.xlsx","file_size_bytes":906815,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"raw":{"event_id":"EVT-0209","source_type":"cloud_storage","timestamp":"2026-06-10T08:50:44.249433Z","event_name":"file_download","username":"dtaylor","source_ip":"10.0.2.17","file_name":"Team_OKRs_2026.xlsx","file_size_bytes":906815,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0125","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-10T08:58:58.486989Z","entities":[{"entityId":"ipv4:10.0.1.12","type":"ipv4","rawValue":"10.0.1.12","normalizedValue":"10.0.1.12","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0125","role":"src_ip"},{"entityId":"ipv4:10.0.2.28","type":"ipv4","rawValue":"10.0.2.28","normalizedValue":"10.0.2.28","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0125","role":"dst_ip"},{"entityId":"endpoint:10.0.2.28:25","type":"endpoint","rawValue":"10.0.2.28:25","normalizedValue":"10.0.2.28:25","normalizationMethod":"verbatim","sourceObservationId":"EVT-0125","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.1.12","dst_ip":"10.0.2.28","dst_port":25,"protocol":"TCP","bytes_sent":6621,"bytes_recv":100563,"action":"allowed","firewall_rule":"ALLOW-OUT-181"},"raw":{"event_id":"EVT-0125","source_type":"network","timestamp":"2026-06-10T08:58:58.486989Z","event_name":"network_connection","src_ip":"10.0.1.12","dst_ip":"10.0.2.28","dst_port":25,"protocol":"TCP","bytes_sent":6621,"bytes_recv":100563,"action":"allowed","firewall_rule":"ALLOW-OUT-181"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0223","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-10T09:03:17Z","entities":[{"entityId":"ipv4:10.0.2.47","type":"ipv4","rawValue":"10.0.2.47","normalizedValue":"10.0.2.47","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0223","role":"src_ip"},{"entityId":"ipv4:185.220.101.45","type":"ipv4","rawValue":"185.220.101.45","normalizedValue":"185.220.101.45","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0223","role":"dst_ip"},{"entityId":"host:WKSTN-07","type":"host","rawValue":"WKSTN-07","normalizedValue":"WKSTN-07","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0223","role":"src_host"},{"entityId":"endpoint:185.220.101.45:443","type":"endpoint","rawValue":"185.220.101.45:443","normalizedValue":"185.220.101.45:443","normalizationMethod":"verbatim","sourceObservationId":"EVT-0223","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.2.47","src_host":"WKSTN-07","dst_ip":"185.220.101.45","dst_port":443,"protocol":"TCP","bytes_sent":4821,"bytes_recv":82034,"action":"allowed","firewall_rule":"ALLOW-OUT-443"},"raw":{"event_id":"EVT-0223","source_type":"network","timestamp":"2026-06-10T09:03:17Z","event_name":"network_connection","src_ip":"10.0.2.47","src_host":"WKSTN-07","dst_ip":"185.220.101.45","dst_port":443,"protocol":"TCP","bytes_sent":4821,"bytes_recv":82034,"action":"allowed","firewall_rule":"ALLOW-OUT-443"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0150","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-10T09:05:40.279231Z","entities":[{"entityId":"host:WKSTN-05","type":"host","rawValue":"WKSTN-05","normalizedValue":"WKSTN-05","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0150","role":"host"},{"entityId":"user:dtaylor","type":"user","rawValue":"dtaylor","normalizedValue":"dtaylor","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0150","role":"actor_user"},{"entityId":"process:WKSTN-05:5002","type":"process","rawValue":"5002","normalizedValue":"5002","normalizationMethod":"verbatim","sourceObservationId":"EVT-0150","role":"process"}],"attributes":{"hostname":"WKSTN-05","username":"dtaylor","process_name":"word.exe","parent_process":"teams.exe","process_path":"C:\\Program Files\\Microsoft\\","command_line":"","pid":5002,"integrity_level":"medium"},"raw":{"event_id":"EVT-0150","source_type":"endpoint","timestamp":"2026-06-10T09:05:40.279231Z","event_name":"process_create","hostname":"WKSTN-05","username":"dtaylor","process_name":"word.exe","parent_process":"teams.exe","process_path":"C:\\Program Files\\Microsoft\\","command_line":"","pid":5002,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0224","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-10T09:18:44Z","entities":[{"entityId":"ipv4:10.0.2.47","type":"ipv4","rawValue":"10.0.2.47","normalizedValue":"10.0.2.47","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0224","role":"src_ip"},{"entityId":"ipv4:185.220.101.45","type":"ipv4","rawValue":"185.220.101.45","normalizedValue":"185.220.101.45","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0224","role":"dst_ip"},{"entityId":"host:WKSTN-07","type":"host","rawValue":"WKSTN-07","normalizedValue":"WKSTN-07","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0224","role":"src_host"},{"entityId":"endpoint:185.220.101.45:443","type":"endpoint","rawValue":"185.220.101.45:443","normalizedValue":"185.220.101.45:443","normalizationMethod":"verbatim","sourceObservationId":"EVT-0224","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.2.47","src_host":"WKSTN-07","dst_ip":"185.220.101.45","dst_port":443,"protocol":"TCP","bytes_sent":1203,"bytes_recv":4410,"action":"allowed","firewall_rule":"ALLOW-OUT-443"},"raw":{"event_id":"EVT-0224","source_type":"network","timestamp":"2026-06-10T09:18:44Z","event_name":"network_connection","src_ip":"10.0.2.47","src_host":"WKSTN-07","dst_ip":"185.220.101.45","dst_port":443,"protocol":"TCP","bytes_sent":1203,"bytes_recv":4410,"action":"allowed","firewall_rule":"ALLOW-OUT-443"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0225","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-10T09:34:21Z","entities":[{"entityId":"ipv4:10.0.2.47","type":"ipv4","rawValue":"10.0.2.47","normalizedValue":"10.0.2.47","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0225","role":"src_ip"},{"entityId":"ipv4:185.220.101.45","type":"ipv4","rawValue":"185.220.101.45","normalizedValue":"185.220.101.45","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0225","role":"dst_ip"},{"entityId":"host:WKSTN-07","type":"host","rawValue":"WKSTN-07","normalizedValue":"WKSTN-07","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0225","role":"src_host"},{"entityId":"endpoint:185.220.101.45:443","type":"endpoint","rawValue":"185.220.101.45:443","normalizedValue":"185.220.101.45:443","normalizationMethod":"verbatim","sourceObservationId":"EVT-0225","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.2.47","src_host":"WKSTN-07","dst_ip":"185.220.101.45","dst_port":443,"protocol":"TCP","bytes_sent":987,"bytes_recv":3201,"action":"allowed","firewall_rule":"ALLOW-OUT-443"},"raw":{"event_id":"EVT-0225","source_type":"network","timestamp":"2026-06-10T09:34:21Z","event_name":"network_connection","src_ip":"10.0.2.47","src_host":"WKSTN-07","dst_ip":"185.220.101.45","dst_port":443,"protocol":"TCP","bytes_sent":987,"bytes_recv":3201,"action":"allowed","firewall_rule":"ALLOW-OUT-443"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0206","sourceType":"cloud_storage","eventType":"file_download","timestamp":"2026-06-10T09:46:29.618328Z","entities":[{"entityId":"user:ewhite","type":"user","rawValue":"ewhite","normalizedValue":"ewhite","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0206","role":"actor_user"},{"entityId":"ipv4:10.0.4.12","type":"ipv4","rawValue":"10.0.4.12","normalizedValue":"10.0.4.12","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0206","role":"source_ip"},{"entityId":"bucket:corp-documents","type":"bucket","rawValue":"corp-documents","normalizedValue":"corp-documents","normalizationMethod":"verbatim","sourceObservationId":"EVT-0206","role":"bucket"},{"entityId":"cloud_object:corp-documents/Team_OKRs_2026.xlsx","type":"cloud_object","rawValue":"corp-documents/Team_OKRs_2026.xlsx","normalizedValue":"corp-documents/Team_OKRs_2026.xlsx","normalizationMethod":"verbatim","sourceObservationId":"EVT-0206","role":"cloud_object"}],"attributes":{"username":"ewhite","source_ip":"10.0.4.12","file_name":"Team_OKRs_2026.xlsx","file_size_bytes":4115874,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"raw":{"event_id":"EVT-0206","source_type":"cloud_storage","timestamp":"2026-06-10T09:46:29.618328Z","event_name":"file_download","username":"ewhite","source_ip":"10.0.4.12","file_name":"Team_OKRs_2026.xlsx","file_size_bytes":4115874,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0216","sourceType":"cloud_storage","eventType":"file_share","timestamp":"2026-06-10T09:51:41.372814Z","entities":[{"entityId":"user:glee","type":"user","rawValue":"glee","normalizedValue":"glee","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0216","role":"actor_user"},{"entityId":"ipv4:10.0.4.22","type":"ipv4","rawValue":"10.0.4.22","normalizedValue":"10.0.4.22","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0216","role":"source_ip"},{"entityId":"bucket:corp-documents","type":"bucket","rawValue":"corp-documents","normalizedValue":"corp-documents","normalizationMethod":"verbatim","sourceObservationId":"EVT-0216","role":"bucket"},{"entityId":"cloud_object:corp-documents/Q2_Budget_Draft.xlsx","type":"cloud_object","rawValue":"corp-documents/Q2_Budget_Draft.xlsx","normalizedValue":"corp-documents/Q2_Budget_Draft.xlsx","normalizationMethod":"verbatim","sourceObservationId":"EVT-0216","role":"cloud_object"}],"attributes":{"username":"glee","source_ip":"10.0.4.22","file_name":"Q2_Budget_Draft.xlsx","file_size_bytes":2543635,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"raw":{"event_id":"EVT-0216","source_type":"cloud_storage","timestamp":"2026-06-10T09:51:41.372814Z","event_name":"file_share","username":"glee","source_ip":"10.0.4.22","file_name":"Q2_Budget_Draft.xlsx","file_size_bytes":2543635,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0226","sourceType":"endpoint","eventType":"process_access","timestamp":"2026-06-10T10:07:51Z","entities":[{"entityId":"host:WKSTN-07","type":"host","rawValue":"WKSTN-07","normalizedValue":"WKSTN-07","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0226","role":"host"},{"entityId":"user:jdavis","type":"user","rawValue":"jdavis","normalizedValue":"jdavis","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0226","role":"actor_user"},{"entityId":"process:WKSTN-07:5104","type":"process","rawValue":"5104","normalizedValue":"5104","normalizationMethod":"verbatim","sourceObservationId":"EVT-0226","role":"process"},{"entityId":"process:WKSTN-07:612","type":"process","rawValue":"612","normalizedValue":"612","normalizationMethod":"verbatim","sourceObservationId":"EVT-0226","role":"target_process"}],"attributes":{"hostname":"WKSTN-07","username":"jdavis","process_name":"powershell.exe","target_process":"lsass.exe","access_rights":"0x1410","pid":5104,"target_pid":612},"raw":{"event_id":"EVT-0226","source_type":"endpoint","timestamp":"2026-06-10T10:07:51Z","event_name":"process_access","hostname":"WKSTN-07","username":"jdavis","process_name":"powershell.exe","target_process":"lsass.exe","access_rights":"0x1410","pid":5104,"target_pid":612},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0227","sourceType":"endpoint","eventType":"file_create","timestamp":"2026-06-10T10:08:03Z","entities":[{"entityId":"host:WKSTN-07","type":"host","rawValue":"WKSTN-07","normalizedValue":"WKSTN-07","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0227","role":"host"},{"entityId":"user:jdavis","type":"user","rawValue":"jdavis","normalizedValue":"jdavis","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0227","role":"actor_user"},{"entityId":"file:C:\\Users\\jdavis\\AppData\\Local\\Temp\\~df4a12.tmp","type":"file","rawValue":"C:\\Users\\jdavis\\AppData\\Local\\Temp\\~df4a12.tmp","normalizedValue":"C:\\Users\\jdavis\\AppData\\Local\\Temp\\~df4a12.tmp","normalizationMethod":"verbatim-path","sourceObservationId":"EVT-0227","role":"file"}],"attributes":{"hostname":"WKSTN-07","username":"jdavis","file_path":"C:\\Users\\jdavis\\AppData\\Local\\Temp\\~df4a12.tmp","file_size_bytes":14823322},"raw":{"event_id":"EVT-0227","source_type":"endpoint","timestamp":"2026-06-10T10:08:03Z","event_name":"file_create","hostname":"WKSTN-07","username":"jdavis","file_path":"C:\\Users\\jdavis\\AppData\\Local\\Temp\\~df4a12.tmp","file_size_bytes":14823322},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0130","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-10T10:21:25.734447Z","entities":[{"entityId":"ipv4:10.0.1.26","type":"ipv4","rawValue":"10.0.1.26","normalizedValue":"10.0.1.26","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0130","role":"src_ip"},{"entityId":"ipv4:10.0.1.18","type":"ipv4","rawValue":"10.0.1.18","normalizedValue":"10.0.1.18","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0130","role":"dst_ip"},{"entityId":"endpoint:10.0.1.18:22","type":"endpoint","rawValue":"10.0.1.18:22","normalizedValue":"10.0.1.18:22","normalizationMethod":"verbatim","sourceObservationId":"EVT-0130","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.1.26","dst_ip":"10.0.1.18","dst_port":22,"protocol":"UDP","bytes_sent":43234,"bytes_recv":176671,"action":"allowed","firewall_rule":"ALLOW-OUT-119"},"raw":{"event_id":"EVT-0130","source_type":"network","timestamp":"2026-06-10T10:21:25.734447Z","event_name":"network_connection","src_ip":"10.0.1.26","dst_ip":"10.0.1.18","dst_port":22,"protocol":"UDP","bytes_sent":43234,"bytes_recv":176671,"action":"allowed","firewall_rule":"ALLOW-OUT-119"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0024","sourceType":"auth","eventType":"user_logoff","timestamp":"2026-06-10T10:42:27.919718Z","entities":[{"entityId":"user:ewhite","type":"user","rawValue":"ewhite","normalizedValue":"ewhite","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0024","role":"actor_user"},{"entityId":"host:WKSTN-06","type":"host","rawValue":"WKSTN-06","normalizedValue":"WKSTN-06","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0024","role":"source_host"},{"entityId":"host:AUTH-SRV-01","type":"host","rawValue":"AUTH-SRV-01","normalizedValue":"AUTH-SRV-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0024","role":"dest_host"},{"entityId":"ipv4:10.0.2.45","type":"ipv4","rawValue":"10.0.2.45","normalizedValue":"10.0.2.45","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0024","role":"source_ip"}],"attributes":{"username":"ewhite","source_host":"WKSTN-06","dest_host":"AUTH-SRV-01","logon_type":"network","result":"failure","source_ip":"10.0.2.45"},"raw":{"event_id":"EVT-0024","source_type":"auth","timestamp":"2026-06-10T10:42:27.919718Z","event_name":"user_logoff","username":"ewhite","source_host":"WKSTN-06","dest_host":"AUTH-SRV-01","logon_type":"network","result":"failure","source_ip":"10.0.2.45"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0152","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-10T10:57:37.982291Z","entities":[{"entityId":"host:WKSTN-08","type":"host","rawValue":"WKSTN-08","normalizedValue":"WKSTN-08","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0152","role":"host"},{"entityId":"user:fmartinez","type":"user","rawValue":"fmartinez","normalizedValue":"fmartinez","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0152","role":"actor_user"},{"entityId":"process:WKSTN-08:5633","type":"process","rawValue":"5633","normalizedValue":"5633","normalizationMethod":"verbatim","sourceObservationId":"EVT-0152","role":"process"}],"attributes":{"hostname":"WKSTN-08","username":"fmartinez","process_name":"word.exe","parent_process":"teams.exe","process_path":"C:\\Program Files\\Google\\","command_line":"","pid":5633,"integrity_level":"medium"},"raw":{"event_id":"EVT-0152","source_type":"endpoint","timestamp":"2026-06-10T10:57:37.982291Z","event_name":"process_create","hostname":"WKSTN-08","username":"fmartinez","process_name":"word.exe","parent_process":"teams.exe","process_path":"C:\\Program Files\\Google\\","command_line":"","pid":5633,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0123","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-10T11:11:11.437561Z","entities":[{"entityId":"ipv4:10.0.4.15","type":"ipv4","rawValue":"10.0.4.15","normalizedValue":"10.0.4.15","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0123","role":"src_ip"},{"entityId":"ipv4:10.0.3.11","type":"ipv4","rawValue":"10.0.3.11","normalizedValue":"10.0.3.11","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0123","role":"dst_ip"},{"entityId":"endpoint:10.0.3.11:443","type":"endpoint","rawValue":"10.0.3.11:443","normalizedValue":"10.0.3.11:443","normalizationMethod":"verbatim","sourceObservationId":"EVT-0123","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.4.15","dst_ip":"10.0.3.11","dst_port":443,"protocol":"UDP","bytes_sent":3268,"bytes_recv":91794,"action":"allowed","firewall_rule":"ALLOW-OUT-114"},"raw":{"event_id":"EVT-0123","source_type":"network","timestamp":"2026-06-10T11:11:11.437561Z","event_name":"network_connection","src_ip":"10.0.4.15","dst_ip":"10.0.3.11","dst_port":443,"protocol":"UDP","bytes_sent":3268,"bytes_recv":91794,"action":"allowed","firewall_rule":"ALLOW-OUT-114"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0228","sourceType":"auth","eventType":"user_logon","timestamp":"2026-06-10T11:22:14Z","entities":[{"entityId":"user:jdavis","type":"user","rawValue":"jdavis","normalizedValue":"jdavis","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0228","role":"actor_user"},{"entityId":"host:WKSTN-07","type":"host","rawValue":"WKSTN-07","normalizedValue":"WKSTN-07","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0228","role":"source_host"},{"entityId":"host:AUTH-SRV-01","type":"host","rawValue":"AUTH-SRV-01","normalizedValue":"AUTH-SRV-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0228","role":"dest_host"},{"entityId":"ipv4:10.0.2.47","type":"ipv4","rawValue":"10.0.2.47","normalizedValue":"10.0.2.47","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0228","role":"source_ip"},{"entityId":"ipv4:10.0.1.10","type":"ipv4","rawValue":"10.0.1.10","normalizedValue":"10.0.1.10","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0228","role":"dest_ip"}],"attributes":{"username":"jdavis","source_host":"WKSTN-07","dest_host":"AUTH-SRV-01","logon_type":"network","result":"success","source_ip":"10.0.2.47","dest_ip":"10.0.1.10"},"raw":{"event_id":"EVT-0228","source_type":"auth","timestamp":"2026-06-10T11:22:14Z","event_name":"user_logon","username":"jdavis","source_host":"WKSTN-07","dest_host":"AUTH-SRV-01","logon_type":"network","result":"success","source_ip":"10.0.2.47","dest_ip":"10.0.1.10"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0095","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-10T11:22:19.206032Z","entities":[{"entityId":"ipv4:10.0.3.22","type":"ipv4","rawValue":"10.0.3.22","normalizedValue":"10.0.3.22","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0095","role":"src_ip"},{"entityId":"ipv4:10.0.2.17","type":"ipv4","rawValue":"10.0.2.17","normalizedValue":"10.0.2.17","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0095","role":"dst_ip"},{"entityId":"endpoint:10.0.2.17:22","type":"endpoint","rawValue":"10.0.2.17:22","normalizedValue":"10.0.2.17:22","normalizationMethod":"verbatim","sourceObservationId":"EVT-0095","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.3.22","dst_ip":"10.0.2.17","dst_port":22,"protocol":"TCP","bytes_sent":4611,"bytes_recv":100074,"action":"allowed","firewall_rule":"ALLOW-OUT-135"},"raw":{"event_id":"EVT-0095","source_type":"network","timestamp":"2026-06-10T11:22:19.206032Z","event_name":"network_connection","src_ip":"10.0.3.22","dst_ip":"10.0.2.17","dst_port":22,"protocol":"TCP","bytes_sent":4611,"bytes_recv":100074,"action":"allowed","firewall_rule":"ALLOW-OUT-135"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0229","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-10T11:23:08Z","entities":[{"entityId":"host:AUTH-SRV-01","type":"host","rawValue":"AUTH-SRV-01","normalizedValue":"AUTH-SRV-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0229","role":"host"},{"entityId":"user:jdavis","type":"user","rawValue":"jdavis","normalizedValue":"jdavis","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0229","role":"actor_user"},{"entityId":"process:AUTH-SRV-01:2341","type":"process","rawValue":"2341","normalizedValue":"2341","normalizationMethod":"verbatim","sourceObservationId":"EVT-0229","role":"process"}],"attributes":{"hostname":"AUTH-SRV-01","username":"jdavis","process_name":"net.exe","parent_process":"cmd.exe","command_line":"net group \"Domain Admins\" /domain","process_path":"C:\\Windows\\System32\\net.exe","pid":2341,"integrity_level":"high"},"raw":{"event_id":"EVT-0229","source_type":"endpoint","timestamp":"2026-06-10T11:23:08Z","event_name":"process_create","hostname":"AUTH-SRV-01","username":"jdavis","process_name":"net.exe","parent_process":"cmd.exe","command_line":"net group \"Domain Admins\" /domain","process_path":"C:\\Windows\\System32\\net.exe","pid":2341,"integrity_level":"high"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0230","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-10T11:28:42Z","entities":[{"entityId":"host:AUTH-SRV-01","type":"host","rawValue":"AUTH-SRV-01","normalizedValue":"AUTH-SRV-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0230","role":"host"},{"entityId":"user:jdavis","type":"user","rawValue":"jdavis","normalizedValue":"jdavis","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0230","role":"actor_user"},{"entityId":"process:AUTH-SRV-01:2398","type":"process","rawValue":"2398","normalizedValue":"2398","normalizationMethod":"verbatim","sourceObservationId":"EVT-0230","role":"process"}],"attributes":{"hostname":"AUTH-SRV-01","username":"jdavis","process_name":"net.exe","parent_process":"cmd.exe","command_line":"net user /domain","process_path":"C:\\Windows\\System32\\net.exe","pid":2398,"integrity_level":"high"},"raw":{"event_id":"EVT-0230","source_type":"endpoint","timestamp":"2026-06-10T11:28:42Z","event_name":"process_create","hostname":"AUTH-SRV-01","username":"jdavis","process_name":"net.exe","parent_process":"cmd.exe","command_line":"net user /domain","process_path":"C:\\Windows\\System32\\net.exe","pid":2398,"integrity_level":"high"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0110","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-10T11:33:38.176114Z","entities":[{"entityId":"ipv4:10.0.1.13","type":"ipv4","rawValue":"10.0.1.13","normalizedValue":"10.0.1.13","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0110","role":"src_ip"},{"entityId":"ipv4:10.0.5.19","type":"ipv4","rawValue":"10.0.5.19","normalizedValue":"10.0.5.19","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0110","role":"dst_ip"},{"entityId":"endpoint:10.0.5.19:53","type":"endpoint","rawValue":"10.0.5.19:53","normalizedValue":"10.0.5.19:53","normalizationMethod":"verbatim","sourceObservationId":"EVT-0110","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.1.13","dst_ip":"10.0.5.19","dst_port":53,"protocol":"TCP","bytes_sent":48795,"bytes_recv":137177,"action":"allowed","firewall_rule":"ALLOW-OUT-137"},"raw":{"event_id":"EVT-0110","source_type":"network","timestamp":"2026-06-10T11:33:38.176114Z","event_name":"network_connection","src_ip":"10.0.1.13","dst_ip":"10.0.5.19","dst_port":53,"protocol":"TCP","bytes_sent":48795,"bytes_recv":137177,"action":"allowed","firewall_rule":"ALLOW-OUT-137"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0180","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-10T12:06:58.828725Z","entities":[{"entityId":"host:WKSTN-01","type":"host","rawValue":"WKSTN-01","normalizedValue":"WKSTN-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0180","role":"host"},{"entityId":"user:bwilliams","type":"user","rawValue":"bwilliams","normalizedValue":"bwilliams","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0180","role":"actor_user"},{"entityId":"process:WKSTN-01:2577","type":"process","rawValue":"2577","normalizedValue":"2577","normalizationMethod":"verbatim","sourceObservationId":"EVT-0180","role":"process"}],"attributes":{"hostname":"WKSTN-01","username":"bwilliams","process_name":"outlook.exe","parent_process":"outlook.exe","process_path":"C:\\Program Files\\Microsoft\\","command_line":"","pid":2577,"integrity_level":"medium"},"raw":{"event_id":"EVT-0180","source_type":"endpoint","timestamp":"2026-06-10T12:06:58.828725Z","event_name":"process_create","hostname":"WKSTN-01","username":"bwilliams","process_name":"outlook.exe","parent_process":"outlook.exe","process_path":"C:\\Program Files\\Microsoft\\","command_line":"","pid":2577,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0210","sourceType":"cloud_storage","eventType":"file_upload","timestamp":"2026-06-10T12:09:59.368729Z","entities":[{"entityId":"user:ewhite","type":"user","rawValue":"ewhite","normalizedValue":"ewhite","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0210","role":"actor_user"},{"entityId":"ipv4:10.0.3.27","type":"ipv4","rawValue":"10.0.3.27","normalizedValue":"10.0.3.27","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0210","role":"source_ip"},{"entityId":"bucket:corp-documents","type":"bucket","rawValue":"corp-documents","normalizedValue":"corp-documents","normalizationMethod":"verbatim","sourceObservationId":"EVT-0210","role":"bucket"},{"entityId":"cloud_object:corp-documents/Q2_Budget_Draft.xlsx","type":"cloud_object","rawValue":"corp-documents/Q2_Budget_Draft.xlsx","normalizedValue":"corp-documents/Q2_Budget_Draft.xlsx","normalizationMethod":"verbatim","sourceObservationId":"EVT-0210","role":"cloud_object"}],"attributes":{"username":"ewhite","source_ip":"10.0.3.27","file_name":"Q2_Budget_Draft.xlsx","file_size_bytes":3279866,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"raw":{"event_id":"EVT-0210","source_type":"cloud_storage","timestamp":"2026-06-10T12:09:59.368729Z","event_name":"file_upload","username":"ewhite","source_ip":"10.0.3.27","file_name":"Q2_Budget_Draft.xlsx","file_size_bytes":3279866,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0199","sourceType":"cloud_storage","eventType":"file_view","timestamp":"2026-06-10T12:18:41.520558Z","entities":[{"entityId":"user:asmith","type":"user","rawValue":"asmith","normalizedValue":"asmith","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0199","role":"actor_user"},{"entityId":"ipv4:10.0.5.18","type":"ipv4","rawValue":"10.0.5.18","normalizedValue":"10.0.5.18","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0199","role":"source_ip"},{"entityId":"bucket:corp-documents","type":"bucket","rawValue":"corp-documents","normalizedValue":"corp-documents","normalizationMethod":"verbatim","sourceObservationId":"EVT-0199","role":"bucket"},{"entityId":"cloud_object:corp-documents/Client_Proposal_Acme.docx","type":"cloud_object","rawValue":"corp-documents/Client_Proposal_Acme.docx","normalizedValue":"corp-documents/Client_Proposal_Acme.docx","normalizationMethod":"verbatim","sourceObservationId":"EVT-0199","role":"cloud_object"}],"attributes":{"username":"asmith","source_ip":"10.0.5.18","file_name":"Client_Proposal_Acme.docx","file_size_bytes":412030,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"raw":{"event_id":"EVT-0199","source_type":"cloud_storage","timestamp":"2026-06-10T12:18:41.520558Z","event_name":"file_view","username":"asmith","source_ip":"10.0.5.18","file_name":"Client_Proposal_Acme.docx","file_size_bytes":412030,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0215","sourceType":"cloud_storage","eventType":"file_upload","timestamp":"2026-06-10T12:29:17.435280Z","entities":[{"entityId":"user:fmartinez","type":"user","rawValue":"fmartinez","normalizedValue":"fmartinez","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0215","role":"actor_user"},{"entityId":"ipv4:10.0.3.20","type":"ipv4","rawValue":"10.0.3.20","normalizedValue":"10.0.3.20","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0215","role":"source_ip"},{"entityId":"bucket:corp-documents","type":"bucket","rawValue":"corp-documents","normalizedValue":"corp-documents","normalizationMethod":"verbatim","sourceObservationId":"EVT-0215","role":"bucket"},{"entityId":"cloud_object:corp-documents/Meeting_Notes_Jun10.docx","type":"cloud_object","rawValue":"corp-documents/Meeting_Notes_Jun10.docx","normalizedValue":"corp-documents/Meeting_Notes_Jun10.docx","normalizationMethod":"verbatim","sourceObservationId":"EVT-0215","role":"cloud_object"}],"attributes":{"username":"fmartinez","source_ip":"10.0.3.20","file_name":"Meeting_Notes_Jun10.docx","file_size_bytes":11680,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"raw":{"event_id":"EVT-0215","source_type":"cloud_storage","timestamp":"2026-06-10T12:29:17.435280Z","event_name":"file_upload","username":"fmartinez","source_ip":"10.0.3.20","file_name":"Meeting_Notes_Jun10.docx","file_size_bytes":11680,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0175","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-10T12:37:08.758133Z","entities":[{"entityId":"host:WKSTN-08","type":"host","rawValue":"WKSTN-08","normalizedValue":"WKSTN-08","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0175","role":"host"},{"entityId":"user:fmartinez","type":"user","rawValue":"fmartinez","normalizedValue":"fmartinez","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0175","role":"actor_user"},{"entityId":"process:WKSTN-08:2847","type":"process","rawValue":"2847","normalizedValue":"2847","normalizationMethod":"verbatim","sourceObservationId":"EVT-0175","role":"process"}],"attributes":{"hostname":"WKSTN-08","username":"fmartinez","process_name":"word.exe","parent_process":"explorer.exe","process_path":"C:\\Program Files\\Google\\","command_line":"","pid":2847,"integrity_level":"medium"},"raw":{"event_id":"EVT-0175","source_type":"endpoint","timestamp":"2026-06-10T12:37:08.758133Z","event_name":"process_create","hostname":"WKSTN-08","username":"fmartinez","process_name":"word.exe","parent_process":"explorer.exe","process_path":"C:\\Program Files\\Google\\","command_line":"","pid":2847,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0231","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-10T13:11:33Z","entities":[{"entityId":"ipv4:10.0.1.10","type":"ipv4","rawValue":"10.0.1.10","normalizedValue":"10.0.1.10","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0231","role":"src_ip"},{"entityId":"ipv4:10.0.1.22","type":"ipv4","rawValue":"10.0.1.22","normalizedValue":"10.0.1.22","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0231","role":"dst_ip"},{"entityId":"host:AUTH-SRV-01","type":"host","rawValue":"AUTH-SRV-01","normalizedValue":"AUTH-SRV-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0231","role":"src_host"},{"entityId":"host:FILE-SRV-02","type":"host","rawValue":"FILE-SRV-02","normalizedValue":"FILE-SRV-02","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0231","role":"dst_host"},{"entityId":"endpoint:10.0.1.22:445","type":"endpoint","rawValue":"10.0.1.22:445","normalizedValue":"10.0.1.22:445","normalizationMethod":"verbatim","sourceObservationId":"EVT-0231","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.1.10","src_host":"AUTH-SRV-01","dst_ip":"10.0.1.22","dst_host":"FILE-SRV-02","dst_port":445,"protocol":"TCP","bytes_sent":32048,"bytes_recv":8192,"action":"allowed","firewall_rule":"ALLOW-INT-SMB"},"raw":{"event_id":"EVT-0231","source_type":"network","timestamp":"2026-06-10T13:11:33Z","event_name":"network_connection","src_ip":"10.0.1.10","src_host":"AUTH-SRV-01","dst_ip":"10.0.1.22","dst_host":"FILE-SRV-02","dst_port":445,"protocol":"TCP","bytes_sent":32048,"bytes_recv":8192,"action":"allowed","firewall_rule":"ALLOW-INT-SMB"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0232","sourceType":"endpoint","eventType":"service_create","timestamp":"2026-06-10T13:12:04Z","entities":[{"entityId":"host:FILE-SRV-02","type":"host","rawValue":"FILE-SRV-02","normalizedValue":"FILE-SRV-02","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0232","role":"host"},{"entityId":"user:jdavis","type":"user","rawValue":"jdavis","normalizedValue":"jdavis","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0232","role":"actor_user"},{"entityId":"service:FILE-SRV-02:PSEXESVC","type":"service","rawValue":"PSEXESVC","normalizedValue":"PSEXESVC","normalizationMethod":"uppercase-service","sourceObservationId":"EVT-0232","role":"service"}],"attributes":{"hostname":"FILE-SRV-02","username":"jdavis","service_name":"PSEXESVC","service_path":"C:\\Windows\\PSEXESVC.exe"},"raw":{"event_id":"EVT-0232","source_type":"endpoint","timestamp":"2026-06-10T13:12:04Z","event_name":"service_create","hostname":"FILE-SRV-02","username":"jdavis","service_name":"PSEXESVC","service_path":"C:\\Windows\\PSEXESVC.exe"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0233","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-10T13:12:07Z","entities":[{"entityId":"host:FILE-SRV-02","type":"host","rawValue":"FILE-SRV-02","normalizedValue":"FILE-SRV-02","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0233","role":"host"},{"entityId":"user:jdavis","type":"user","rawValue":"jdavis","normalizedValue":"jdavis","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0233","role":"actor_user"},{"entityId":"process:FILE-SRV-02:3871","type":"process","rawValue":"3871","normalizedValue":"3871","normalizationMethod":"verbatim","sourceObservationId":"EVT-0233","role":"process"}],"attributes":{"hostname":"FILE-SRV-02","username":"jdavis","process_name":"cmd.exe","parent_process":"PSEXESVC.exe","command_line":"cmd.exe","process_path":"C:\\Windows\\System32\\cmd.exe","pid":3871,"integrity_level":"system"},"raw":{"event_id":"EVT-0233","source_type":"endpoint","timestamp":"2026-06-10T13:12:07Z","event_name":"process_create","hostname":"FILE-SRV-02","username":"jdavis","process_name":"cmd.exe","parent_process":"PSEXESVC.exe","command_line":"cmd.exe","process_path":"C:\\Windows\\System32\\cmd.exe","pid":3871,"integrity_level":"system"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0187","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-10T13:40:10.848419Z","entities":[{"entityId":"host:WKSTN-02","type":"host","rawValue":"WKSTN-02","normalizedValue":"WKSTN-02","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0187","role":"host"},{"entityId":"user:asmith","type":"user","rawValue":"asmith","normalizedValue":"asmith","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0187","role":"actor_user"},{"entityId":"process:WKSTN-02:4090","type":"process","rawValue":"4090","normalizedValue":"4090","normalizationMethod":"verbatim","sourceObservationId":"EVT-0187","role":"process"}],"attributes":{"hostname":"WKSTN-02","username":"asmith","process_name":"word.exe","parent_process":"explorer.exe","process_path":"C:\\Program Files\\Microsoft\\","command_line":"","pid":4090,"integrity_level":"medium"},"raw":{"event_id":"EVT-0187","source_type":"endpoint","timestamp":"2026-06-10T13:40:10.848419Z","event_name":"process_create","hostname":"WKSTN-02","username":"asmith","process_name":"word.exe","parent_process":"explorer.exe","process_path":"C:\\Program Files\\Microsoft\\","command_line":"","pid":4090,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0168","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-10T14:01:45.325234Z","entities":[{"entityId":"host:WKSTN-03","type":"host","rawValue":"WKSTN-03","normalizedValue":"WKSTN-03","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0168","role":"host"},{"entityId":"user:glee","type":"user","rawValue":"glee","normalizedValue":"glee","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0168","role":"actor_user"},{"entityId":"process:WKSTN-03:8933","type":"process","rawValue":"8933","normalizedValue":"8933","normalizationMethod":"verbatim","sourceObservationId":"EVT-0168","role":"process"}],"attributes":{"hostname":"WKSTN-03","username":"glee","process_name":"notepad.exe","parent_process":"teams.exe","process_path":"C:\\Program Files\\Google\\","command_line":"","pid":8933,"integrity_level":"medium"},"raw":{"event_id":"EVT-0168","source_type":"endpoint","timestamp":"2026-06-10T14:01:45.325234Z","event_name":"process_create","hostname":"WKSTN-03","username":"glee","process_name":"notepad.exe","parent_process":"teams.exe","process_path":"C:\\Program Files\\Google\\","command_line":"","pid":8933,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0234","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-10T14:05:22Z","entities":[{"entityId":"host:FILE-SRV-02","type":"host","rawValue":"FILE-SRV-02","normalizedValue":"FILE-SRV-02","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0234","role":"host"},{"entityId":"user:jdavis","type":"user","rawValue":"jdavis","normalizedValue":"jdavis","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0234","role":"actor_user"},{"entityId":"process:FILE-SRV-02:4012","type":"process","rawValue":"4012","normalizedValue":"4012","normalizationMethod":"verbatim","sourceObservationId":"EVT-0234","role":"process"}],"attributes":{"hostname":"FILE-SRV-02","username":"jdavis","process_name":"net.exe","parent_process":"cmd.exe","command_line":"net share","process_path":"C:\\Windows\\System32\\net.exe","pid":4012,"integrity_level":"system"},"raw":{"event_id":"EVT-0234","source_type":"endpoint","timestamp":"2026-06-10T14:05:22Z","event_name":"process_create","hostname":"FILE-SRV-02","username":"jdavis","process_name":"net.exe","parent_process":"cmd.exe","command_line":"net share","process_path":"C:\\Windows\\System32\\net.exe","pid":4012,"integrity_level":"system"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0235","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-10T14:07:55Z","entities":[{"entityId":"host:FILE-SRV-02","type":"host","rawValue":"FILE-SRV-02","normalizedValue":"FILE-SRV-02","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0235","role":"host"},{"entityId":"user:jdavis","type":"user","rawValue":"jdavis","normalizedValue":"jdavis","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0235","role":"actor_user"},{"entityId":"process:FILE-SRV-02:4044","type":"process","rawValue":"4044","normalizedValue":"4044","normalizationMethod":"verbatim","sourceObservationId":"EVT-0235","role":"process"}],"attributes":{"hostname":"FILE-SRV-02","username":"jdavis","process_name":"cmd.exe","parent_process":"cmd.exe","command_line":"dir /s /b \\\\FILE-SRV-02\\finance-data","process_path":"C:\\Windows\\System32\\cmd.exe","pid":4044,"integrity_level":"system"},"raw":{"event_id":"EVT-0235","source_type":"endpoint","timestamp":"2026-06-10T14:07:55Z","event_name":"process_create","hostname":"FILE-SRV-02","username":"jdavis","process_name":"cmd.exe","parent_process":"cmd.exe","command_line":"dir /s /b \\\\FILE-SRV-02\\finance-data","process_path":"C:\\Windows\\System32\\cmd.exe","pid":4044,"integrity_level":"system"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0009","sourceType":"auth","eventType":"user_logoff","timestamp":"2026-06-10T14:40:12.102241Z","entities":[{"entityId":"user:hwalker","type":"user","rawValue":"hwalker","normalizedValue":"hwalker","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0009","role":"actor_user"},{"entityId":"host:WKSTN-09","type":"host","rawValue":"WKSTN-09","normalizedValue":"WKSTN-09","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0009","role":"source_host"},{"entityId":"host:AUTH-SRV-01","type":"host","rawValue":"AUTH-SRV-01","normalizedValue":"AUTH-SRV-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0009","role":"dest_host"},{"entityId":"ipv4:10.0.2.185","type":"ipv4","rawValue":"10.0.2.185","normalizedValue":"10.0.2.185","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0009","role":"source_ip"}],"attributes":{"username":"hwalker","source_host":"WKSTN-09","dest_host":"AUTH-SRV-01","logon_type":"network","result":"success","source_ip":"10.0.2.185"},"raw":{"event_id":"EVT-0009","source_type":"auth","timestamp":"2026-06-10T14:40:12.102241Z","event_name":"user_logoff","username":"hwalker","source_host":"WKSTN-09","dest_host":"AUTH-SRV-01","logon_type":"network","result":"success","source_ip":"10.0.2.185"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0089","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-10T15:34:04.605935Z","entities":[{"entityId":"ipv4:10.0.1.13","type":"ipv4","rawValue":"10.0.1.13","normalizedValue":"10.0.1.13","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0089","role":"src_ip"},{"entityId":"ipv4:10.0.5.29","type":"ipv4","rawValue":"10.0.5.29","normalizedValue":"10.0.5.29","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0089","role":"dst_ip"},{"entityId":"endpoint:10.0.5.29:443","type":"endpoint","rawValue":"10.0.5.29:443","normalizedValue":"10.0.5.29:443","normalizationMethod":"verbatim","sourceObservationId":"EVT-0089","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.1.13","dst_ip":"10.0.5.29","dst_port":443,"protocol":"UDP","bytes_sent":48257,"bytes_recv":11954,"action":"allowed","firewall_rule":"ALLOW-OUT-115"},"raw":{"event_id":"EVT-0089","source_type":"network","timestamp":"2026-06-10T15:34:04.605935Z","event_name":"network_connection","src_ip":"10.0.1.13","dst_ip":"10.0.5.29","dst_port":443,"protocol":"UDP","bytes_sent":48257,"bytes_recv":11954,"action":"allowed","firewall_rule":"ALLOW-OUT-115"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0140","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-10T15:39:12.340248Z","entities":[{"entityId":"ipv4:10.0.4.21","type":"ipv4","rawValue":"10.0.4.21","normalizedValue":"10.0.4.21","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0140","role":"src_ip"},{"entityId":"ipv4:10.0.4.13","type":"ipv4","rawValue":"10.0.4.13","normalizedValue":"10.0.4.13","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0140","role":"dst_ip"},{"entityId":"endpoint:10.0.4.13:443","type":"endpoint","rawValue":"10.0.4.13:443","normalizedValue":"10.0.4.13:443","normalizationMethod":"verbatim","sourceObservationId":"EVT-0140","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.4.21","dst_ip":"10.0.4.13","dst_port":443,"protocol":"TCP","bytes_sent":35990,"bytes_recv":159361,"action":"allowed","firewall_rule":"ALLOW-OUT-177"},"raw":{"event_id":"EVT-0140","source_type":"network","timestamp":"2026-06-10T15:39:12.340248Z","event_name":"network_connection","src_ip":"10.0.4.21","dst_ip":"10.0.4.13","dst_port":443,"protocol":"TCP","bytes_sent":35990,"bytes_recv":159361,"action":"allowed","firewall_rule":"ALLOW-OUT-177"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0029","sourceType":"auth","eventType":"failed_logon","timestamp":"2026-06-10T15:42:39.986198Z","entities":[{"entityId":"user:fmartinez","type":"user","rawValue":"fmartinez","normalizedValue":"fmartinez","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0029","role":"actor_user"},{"entityId":"host:WKSTN-02","type":"host","rawValue":"WKSTN-02","normalizedValue":"WKSTN-02","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0029","role":"source_host"},{"entityId":"host:AUTH-SRV-01","type":"host","rawValue":"AUTH-SRV-01","normalizedValue":"AUTH-SRV-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0029","role":"dest_host"},{"entityId":"ipv4:10.0.4.108","type":"ipv4","rawValue":"10.0.4.108","normalizedValue":"10.0.4.108","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0029","role":"source_ip"}],"attributes":{"username":"fmartinez","source_host":"WKSTN-02","dest_host":"AUTH-SRV-01","logon_type":"interactive","result":"success","source_ip":"10.0.4.108"},"raw":{"event_id":"EVT-0029","source_type":"auth","timestamp":"2026-06-10T15:42:39.986198Z","event_name":"failed_logon","username":"fmartinez","source_host":"WKSTN-02","dest_host":"AUTH-SRV-01","logon_type":"interactive","result":"success","source_ip":"10.0.4.108"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0040","sourceType":"auth","eventType":"failed_logon","timestamp":"2026-06-10T15:45:17.487358Z","entities":[{"entityId":"user:iharris","type":"user","rawValue":"iharris","normalizedValue":"iharris","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0040","role":"actor_user"},{"entityId":"host:WKSTN-04","type":"host","rawValue":"WKSTN-04","normalizedValue":"WKSTN-04","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0040","role":"source_host"},{"entityId":"host:AUTH-SRV-01","type":"host","rawValue":"AUTH-SRV-01","normalizedValue":"AUTH-SRV-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0040","role":"dest_host"},{"entityId":"ipv4:10.0.2.207","type":"ipv4","rawValue":"10.0.2.207","normalizedValue":"10.0.2.207","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0040","role":"source_ip"}],"attributes":{"username":"iharris","source_host":"WKSTN-04","dest_host":"AUTH-SRV-01","logon_type":"network","result":"success","source_ip":"10.0.2.207"},"raw":{"event_id":"EVT-0040","source_type":"auth","timestamp":"2026-06-10T15:45:17.487358Z","event_name":"failed_logon","username":"iharris","source_host":"WKSTN-04","dest_host":"AUTH-SRV-01","logon_type":"network","result":"success","source_ip":"10.0.2.207"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0071","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-10T16:00:22.055696Z","entities":[{"entityId":"ipv4:10.0.4.12","type":"ipv4","rawValue":"10.0.4.12","normalizedValue":"10.0.4.12","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0071","role":"src_ip"},{"entityId":"ipv4:10.0.4.15","type":"ipv4","rawValue":"10.0.4.15","normalizedValue":"10.0.4.15","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0071","role":"dst_ip"},{"entityId":"endpoint:10.0.4.15:443","type":"endpoint","rawValue":"10.0.4.15:443","normalizedValue":"10.0.4.15:443","normalizationMethod":"verbatim","sourceObservationId":"EVT-0071","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.4.12","dst_ip":"10.0.4.15","dst_port":443,"protocol":"UDP","bytes_sent":13973,"bytes_recv":169768,"action":"allowed","firewall_rule":"ALLOW-OUT-121"},"raw":{"event_id":"EVT-0071","source_type":"network","timestamp":"2026-06-10T16:00:22.055696Z","event_name":"network_connection","src_ip":"10.0.4.12","dst_ip":"10.0.4.15","dst_port":443,"protocol":"UDP","bytes_sent":13973,"bytes_recv":169768,"action":"allowed","firewall_rule":"ALLOW-OUT-121"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0236","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-10T16:34:12Z","entities":[{"entityId":"host:FILE-SRV-02","type":"host","rawValue":"FILE-SRV-02","normalizedValue":"FILE-SRV-02","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0236","role":"host"},{"entityId":"user:jdavis","type":"user","rawValue":"jdavis","normalizedValue":"jdavis","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0236","role":"actor_user"},{"entityId":"process:FILE-SRV-02:5521","type":"process","rawValue":"5521","normalizedValue":"5521","normalizationMethod":"verbatim","sourceObservationId":"EVT-0236","role":"process"}],"attributes":{"hostname":"FILE-SRV-02","username":"jdavis","process_name":"7z.exe","parent_process":"cmd.exe","command_line":"7z.exe a -r C:\\Temp\\backup_archive.zip \\\\FILE-SRV-02\\finance-data\\2026\\*","process_path":"C:\\Temp\\7z.exe","pid":5521,"integrity_level":"system"},"raw":{"event_id":"EVT-0236","source_type":"endpoint","timestamp":"2026-06-10T16:34:12Z","event_name":"process_create","hostname":"FILE-SRV-02","username":"jdavis","process_name":"7z.exe","parent_process":"cmd.exe","command_line":"7z.exe a -r C:\\Temp\\backup_archive.zip \\\\FILE-SRV-02\\finance-data\\2026\\*","process_path":"C:\\Temp\\7z.exe","pid":5521,"integrity_level":"system"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0237","sourceType":"endpoint","eventType":"file_create","timestamp":"2026-06-10T16:51:03Z","entities":[{"entityId":"host:FILE-SRV-02","type":"host","rawValue":"FILE-SRV-02","normalizedValue":"FILE-SRV-02","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0237","role":"host"},{"entityId":"user:jdavis","type":"user","rawValue":"jdavis","normalizedValue":"jdavis","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0237","role":"actor_user"},{"entityId":"file:C:\\Temp\\backup_archive.zip","type":"file","rawValue":"C:\\Temp\\backup_archive.zip","normalizedValue":"C:\\Temp\\backup_archive.zip","normalizationMethod":"verbatim-path","sourceObservationId":"EVT-0237","role":"file"}],"attributes":{"hostname":"FILE-SRV-02","username":"jdavis","file_path":"C:\\Temp\\backup_archive.zip","file_size_bytes":2473829122},"raw":{"event_id":"EVT-0237","source_type":"endpoint","timestamp":"2026-06-10T16:51:03Z","event_name":"file_create","hostname":"FILE-SRV-02","username":"jdavis","file_path":"C:\\Temp\\backup_archive.zip","file_size_bytes":2473829122},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0076","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-10T17:00:41.935055Z","entities":[{"entityId":"ipv4:10.0.4.24","type":"ipv4","rawValue":"10.0.4.24","normalizedValue":"10.0.4.24","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0076","role":"src_ip"},{"entityId":"ipv4:10.0.1.17","type":"ipv4","rawValue":"10.0.1.17","normalizedValue":"10.0.1.17","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0076","role":"dst_ip"},{"entityId":"endpoint:10.0.1.17:53","type":"endpoint","rawValue":"10.0.1.17:53","normalizedValue":"10.0.1.17:53","normalizationMethod":"verbatim","sourceObservationId":"EVT-0076","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.4.24","dst_ip":"10.0.1.17","dst_port":53,"protocol":"UDP","bytes_sent":38304,"bytes_recv":66786,"action":"allowed","firewall_rule":"ALLOW-OUT-116"},"raw":{"event_id":"EVT-0076","source_type":"network","timestamp":"2026-06-10T17:00:41.935055Z","event_name":"network_connection","src_ip":"10.0.4.24","dst_ip":"10.0.1.17","dst_port":53,"protocol":"UDP","bytes_sent":38304,"bytes_recv":66786,"action":"allowed","firewall_rule":"ALLOW-OUT-116"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0238","sourceType":"cloud_storage","eventType":"file_upload","timestamp":"2026-06-10T18:18:44Z","entities":[{"entityId":"user:jdavis","type":"user","rawValue":"jdavis","normalizedValue":"jdavis","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0238","role":"actor_user"},{"entityId":"ipv4:10.0.1.22","type":"ipv4","rawValue":"10.0.1.22","normalizedValue":"10.0.1.22","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0238","role":"source_ip"},{"entityId":"host:FILE-SRV-02","type":"host","rawValue":"FILE-SRV-02","normalizedValue":"FILE-SRV-02","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0238","role":"source_host"},{"entityId":"bucket:ext-drop-xf9q2","type":"bucket","rawValue":"ext-drop-xf9q2","normalizedValue":"ext-drop-xf9q2","normalizationMethod":"verbatim","sourceObservationId":"EVT-0238","role":"bucket"},{"entityId":"cloud_object:ext-drop-xf9q2/backup_archive.zip","type":"cloud_object","rawValue":"ext-drop-xf9q2/backup_archive.zip","normalizedValue":"ext-drop-xf9q2/backup_archive.zip","normalizationMethod":"verbatim","sourceObservationId":"EVT-0238","role":"cloud_object"}],"attributes":{"username":"jdavis","source_ip":"10.0.1.22","source_host":"FILE-SRV-02","file_name":"backup_archive.zip","file_size_bytes":2473829122,"bucket":"ext-drop-xf9q2","bucket_owner":"EXTERNAL","action":"allowed","user_agent":"python-requests/2.28.1"},"raw":{"event_id":"EVT-0238","source_type":"cloud_storage","timestamp":"2026-06-10T18:18:44Z","event_name":"file_upload","username":"jdavis","source_ip":"10.0.1.22","source_host":"FILE-SRV-02","file_name":"backup_archive.zip","file_size_bytes":2473829122,"bucket":"ext-drop-xf9q2","bucket_owner":"EXTERNAL","action":"allowed","user_agent":"python-requests/2.28.1"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0159","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-10T18:19:08.876335Z","entities":[{"entityId":"host:WKSTN-01","type":"host","rawValue":"WKSTN-01","normalizedValue":"WKSTN-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0159","role":"host"},{"entityId":"user:jclark","type":"user","rawValue":"jclark","normalizedValue":"jclark","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0159","role":"actor_user"},{"entityId":"process:WKSTN-01:1052","type":"process","rawValue":"1052","normalizedValue":"1052","normalizationMethod":"verbatim","sourceObservationId":"EVT-0159","role":"process"}],"attributes":{"hostname":"WKSTN-01","username":"jclark","process_name":"teams.exe","parent_process":"explorer.exe","process_path":"C:\\Program Files\\Microsoft\\","command_line":"","pid":1052,"integrity_level":"medium"},"raw":{"event_id":"EVT-0159","source_type":"endpoint","timestamp":"2026-06-10T18:19:08.876335Z","event_name":"process_create","hostname":"WKSTN-01","username":"jclark","process_name":"teams.exe","parent_process":"explorer.exe","process_path":"C:\\Program Files\\Microsoft\\","command_line":"","pid":1052,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0183","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-10T18:51:47.084315Z","entities":[{"entityId":"host:WKSTN-03","type":"host","rawValue":"WKSTN-03","normalizedValue":"WKSTN-03","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0183","role":"host"},{"entityId":"user:dtaylor","type":"user","rawValue":"dtaylor","normalizedValue":"dtaylor","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0183","role":"actor_user"},{"entityId":"process:WKSTN-03:8921","type":"process","rawValue":"8921","normalizedValue":"8921","normalizationMethod":"verbatim","sourceObservationId":"EVT-0183","role":"process"}],"attributes":{"hostname":"WKSTN-03","username":"dtaylor","process_name":"outlook.exe","parent_process":"teams.exe","process_path":"C:\\Program Files\\Slack\\","command_line":"","pid":8921,"integrity_level":"medium"},"raw":{"event_id":"EVT-0183","source_type":"endpoint","timestamp":"2026-06-10T18:51:47.084315Z","event_name":"process_create","hostname":"WKSTN-03","username":"dtaylor","process_name":"outlook.exe","parent_process":"teams.exe","process_path":"C:\\Program Files\\Slack\\","command_line":"","pid":8921,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0088","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-10T19:03:40.932454Z","entities":[{"entityId":"ipv4:10.0.2.25","type":"ipv4","rawValue":"10.0.2.25","normalizedValue":"10.0.2.25","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0088","role":"src_ip"},{"entityId":"ipv4:10.0.4.23","type":"ipv4","rawValue":"10.0.4.23","normalizedValue":"10.0.4.23","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0088","role":"dst_ip"},{"entityId":"endpoint:10.0.4.23:443","type":"endpoint","rawValue":"10.0.4.23:443","normalizedValue":"10.0.4.23:443","normalizationMethod":"verbatim","sourceObservationId":"EVT-0088","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.2.25","dst_ip":"10.0.4.23","dst_port":443,"protocol":"UDP","bytes_sent":46553,"bytes_recv":144702,"action":"allowed","firewall_rule":"ALLOW-OUT-131"},"raw":{"event_id":"EVT-0088","source_type":"network","timestamp":"2026-06-10T19:03:40.932454Z","event_name":"network_connection","src_ip":"10.0.2.25","dst_ip":"10.0.4.23","dst_port":443,"protocol":"UDP","bytes_sent":46553,"bytes_recv":144702,"action":"allowed","firewall_rule":"ALLOW-OUT-131"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0094","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-10T19:10:05.788416Z","entities":[{"entityId":"ipv4:10.0.5.23","type":"ipv4","rawValue":"10.0.5.23","normalizedValue":"10.0.5.23","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0094","role":"src_ip"},{"entityId":"ipv4:10.0.4.20","type":"ipv4","rawValue":"10.0.4.20","normalizedValue":"10.0.4.20","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0094","role":"dst_ip"},{"entityId":"endpoint:10.0.4.20:53","type":"endpoint","rawValue":"10.0.4.20:53","normalizedValue":"10.0.4.20:53","normalizationMethod":"verbatim","sourceObservationId":"EVT-0094","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.5.23","dst_ip":"10.0.4.20","dst_port":53,"protocol":"TCP","bytes_sent":43821,"bytes_recv":147201,"action":"allowed","firewall_rule":"ALLOW-OUT-104"},"raw":{"event_id":"EVT-0094","source_type":"network","timestamp":"2026-06-10T19:10:05.788416Z","event_name":"network_connection","src_ip":"10.0.5.23","dst_ip":"10.0.4.20","dst_port":53,"protocol":"TCP","bytes_sent":43821,"bytes_recv":147201,"action":"allowed","firewall_rule":"ALLOW-OUT-104"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0072","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-10T19:14:27.673088Z","entities":[{"entityId":"ipv4:10.0.1.27","type":"ipv4","rawValue":"10.0.1.27","normalizedValue":"10.0.1.27","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0072","role":"src_ip"},{"entityId":"ipv4:10.0.2.22","type":"ipv4","rawValue":"10.0.2.22","normalizedValue":"10.0.2.22","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0072","role":"dst_ip"},{"entityId":"endpoint:10.0.2.22:80","type":"endpoint","rawValue":"10.0.2.22:80","normalizedValue":"10.0.2.22:80","normalizationMethod":"verbatim","sourceObservationId":"EVT-0072","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.1.27","dst_ip":"10.0.2.22","dst_port":80,"protocol":"UDP","bytes_sent":4334,"bytes_recv":12200,"action":"allowed","firewall_rule":"ALLOW-OUT-117"},"raw":{"event_id":"EVT-0072","source_type":"network","timestamp":"2026-06-10T19:14:27.673088Z","event_name":"network_connection","src_ip":"10.0.1.27","dst_ip":"10.0.2.22","dst_port":80,"protocol":"UDP","bytes_sent":4334,"bytes_recv":12200,"action":"allowed","firewall_rule":"ALLOW-OUT-117"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0132","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-10T19:20:59.796200Z","entities":[{"entityId":"ipv4:10.0.3.16","type":"ipv4","rawValue":"10.0.3.16","normalizedValue":"10.0.3.16","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0132","role":"src_ip"},{"entityId":"ipv4:10.0.1.17","type":"ipv4","rawValue":"10.0.1.17","normalizedValue":"10.0.1.17","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0132","role":"dst_ip"},{"entityId":"endpoint:10.0.1.17:443","type":"endpoint","rawValue":"10.0.1.17:443","normalizedValue":"10.0.1.17:443","normalizationMethod":"verbatim","sourceObservationId":"EVT-0132","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.3.16","dst_ip":"10.0.1.17","dst_port":443,"protocol":"TCP","bytes_sent":4820,"bytes_recv":30530,"action":"allowed","firewall_rule":"ALLOW-OUT-176"},"raw":{"event_id":"EVT-0132","source_type":"network","timestamp":"2026-06-10T19:20:59.796200Z","event_name":"network_connection","src_ip":"10.0.3.16","dst_ip":"10.0.1.17","dst_port":443,"protocol":"TCP","bytes_sent":4820,"bytes_recv":30530,"action":"allowed","firewall_rule":"ALLOW-OUT-176"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0184","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-10T19:35:47.005698Z","entities":[{"entityId":"host:WKSTN-09","type":"host","rawValue":"WKSTN-09","normalizedValue":"WKSTN-09","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0184","role":"host"},{"entityId":"user:jclark","type":"user","rawValue":"jclark","normalizedValue":"jclark","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0184","role":"actor_user"},{"entityId":"process:WKSTN-09:1737","type":"process","rawValue":"1737","normalizedValue":"1737","normalizationMethod":"verbatim","sourceObservationId":"EVT-0184","role":"process"}],"attributes":{"hostname":"WKSTN-09","username":"jclark","process_name":"chrome.exe","parent_process":"teams.exe","process_path":"C:\\Program Files\\Microsoft\\","command_line":"","pid":1737,"integrity_level":"medium"},"raw":{"event_id":"EVT-0184","source_type":"endpoint","timestamp":"2026-06-10T19:35:47.005698Z","event_name":"process_create","hostname":"WKSTN-09","username":"jclark","process_name":"chrome.exe","parent_process":"teams.exe","process_path":"C:\\Program Files\\Microsoft\\","command_line":"","pid":1737,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0084","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-10T19:41:12.690494Z","entities":[{"entityId":"ipv4:10.0.5.12","type":"ipv4","rawValue":"10.0.5.12","normalizedValue":"10.0.5.12","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0084","role":"src_ip"},{"entityId":"ipv4:10.0.4.22","type":"ipv4","rawValue":"10.0.4.22","normalizedValue":"10.0.4.22","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0084","role":"dst_ip"},{"entityId":"endpoint:10.0.4.22:25","type":"endpoint","rawValue":"10.0.4.22:25","normalizedValue":"10.0.4.22:25","normalizationMethod":"verbatim","sourceObservationId":"EVT-0084","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.5.12","dst_ip":"10.0.4.22","dst_port":25,"protocol":"TCP","bytes_sent":16767,"bytes_recv":29679,"action":"allowed","firewall_rule":"ALLOW-OUT-184"},"raw":{"event_id":"EVT-0084","source_type":"network","timestamp":"2026-06-10T19:41:12.690494Z","event_name":"network_connection","src_ip":"10.0.5.12","dst_ip":"10.0.4.22","dst_port":25,"protocol":"TCP","bytes_sent":16767,"bytes_recv":29679,"action":"allowed","firewall_rule":"ALLOW-OUT-184"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0006","sourceType":"auth","eventType":"user_logoff","timestamp":"2026-06-10T19:51:26.563646Z","entities":[{"entityId":"user:asmith","type":"user","rawValue":"asmith","normalizedValue":"asmith","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0006","role":"actor_user"},{"entityId":"host:WKSTN-02","type":"host","rawValue":"WKSTN-02","normalizedValue":"WKSTN-02","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0006","role":"source_host"},{"entityId":"host:AUTH-SRV-01","type":"host","rawValue":"AUTH-SRV-01","normalizedValue":"AUTH-SRV-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0006","role":"dest_host"},{"entityId":"ipv4:10.0.3.196","type":"ipv4","rawValue":"10.0.3.196","normalizedValue":"10.0.3.196","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0006","role":"source_ip"}],"attributes":{"username":"asmith","source_host":"WKSTN-02","dest_host":"AUTH-SRV-01","logon_type":"network","result":"success","source_ip":"10.0.3.196"},"raw":{"event_id":"EVT-0006","source_type":"auth","timestamp":"2026-06-10T19:51:26.563646Z","event_name":"user_logoff","username":"asmith","source_host":"WKSTN-02","dest_host":"AUTH-SRV-01","logon_type":"network","result":"success","source_ip":"10.0.3.196"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0239","sourceType":"endpoint","eventType":"file_delete","timestamp":"2026-06-10T20:03:17Z","entities":[{"entityId":"host:FILE-SRV-02","type":"host","rawValue":"FILE-SRV-02","normalizedValue":"FILE-SRV-02","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0239","role":"host"},{"entityId":"user:jdavis","type":"user","rawValue":"jdavis","normalizedValue":"jdavis","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0239","role":"actor_user"},{"entityId":"file:C:\\Temp\\backup_archive.zip","type":"file","rawValue":"C:\\Temp\\backup_archive.zip","normalizedValue":"C:\\Temp\\backup_archive.zip","normalizationMethod":"verbatim-path","sourceObservationId":"EVT-0239","role":"file"}],"attributes":{"hostname":"FILE-SRV-02","username":"jdavis","file_path":"C:\\Temp\\backup_archive.zip"},"raw":{"event_id":"EVT-0239","source_type":"endpoint","timestamp":"2026-06-10T20:03:17Z","event_name":"file_delete","hostname":"FILE-SRV-02","username":"jdavis","file_path":"C:\\Temp\\backup_archive.zip"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0240","sourceType":"endpoint","eventType":"file_delete","timestamp":"2026-06-10T20:04:02Z","entities":[{"entityId":"host:FILE-SRV-02","type":"host","rawValue":"FILE-SRV-02","normalizedValue":"FILE-SRV-02","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0240","role":"host"},{"entityId":"user:jdavis","type":"user","rawValue":"jdavis","normalizedValue":"jdavis","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0240","role":"actor_user"},{"entityId":"file:C:\\Temp\\7z.exe","type":"file","rawValue":"C:\\Temp\\7z.exe","normalizedValue":"C:\\Temp\\7z.exe","normalizationMethod":"verbatim-path","sourceObservationId":"EVT-0240","role":"file"}],"attributes":{"hostname":"FILE-SRV-02","username":"jdavis","file_path":"C:\\Temp\\7z.exe"},"raw":{"event_id":"EVT-0240","source_type":"endpoint","timestamp":"2026-06-10T20:04:02Z","event_name":"file_delete","hostname":"FILE-SRV-02","username":"jdavis","file_path":"C:\\Temp\\7z.exe"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0241","sourceType":"endpoint","eventType":"service_delete","timestamp":"2026-06-10T20:05:38Z","entities":[{"entityId":"host:FILE-SRV-02","type":"host","rawValue":"FILE-SRV-02","normalizedValue":"FILE-SRV-02","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0241","role":"host"},{"entityId":"user:jdavis","type":"user","rawValue":"jdavis","normalizedValue":"jdavis","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0241","role":"actor_user"},{"entityId":"service:FILE-SRV-02:PSEXESVC","type":"service","rawValue":"PSEXESVC","normalizedValue":"PSEXESVC","normalizationMethod":"uppercase-service","sourceObservationId":"EVT-0241","role":"service"}],"attributes":{"hostname":"FILE-SRV-02","username":"jdavis","service_name":"PSEXESVC"},"raw":{"event_id":"EVT-0241","source_type":"endpoint","timestamp":"2026-06-10T20:05:38Z","event_name":"service_delete","hostname":"FILE-SRV-02","username":"jdavis","service_name":"PSEXESVC"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0242","sourceType":"auth","eventType":"user_logoff","timestamp":"2026-06-10T20:08:11Z","entities":[{"entityId":"user:jdavis","type":"user","rawValue":"jdavis","normalizedValue":"jdavis","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0242","role":"actor_user"},{"entityId":"host:FILE-SRV-02","type":"host","rawValue":"FILE-SRV-02","normalizedValue":"FILE-SRV-02","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0242","role":"source_host"},{"entityId":"host:AUTH-SRV-01","type":"host","rawValue":"AUTH-SRV-01","normalizedValue":"AUTH-SRV-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0242","role":"dest_host"}],"attributes":{"username":"jdavis","source_host":"FILE-SRV-02","dest_host":"AUTH-SRV-01","logon_type":"network","result":"success"},"raw":{"event_id":"EVT-0242","source_type":"auth","timestamp":"2026-06-10T20:08:11Z","event_name":"user_logoff","username":"jdavis","source_host":"FILE-SRV-02","dest_host":"AUTH-SRV-01","logon_type":"network","result":"success"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0139","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-10T20:27:01.216356Z","entities":[{"entityId":"ipv4:10.0.4.18","type":"ipv4","rawValue":"10.0.4.18","normalizedValue":"10.0.4.18","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0139","role":"src_ip"},{"entityId":"ipv4:10.0.1.28","type":"ipv4","rawValue":"10.0.1.28","normalizedValue":"10.0.1.28","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0139","role":"dst_ip"},{"entityId":"endpoint:10.0.1.28:80","type":"endpoint","rawValue":"10.0.1.28:80","normalizedValue":"10.0.1.28:80","normalizationMethod":"verbatim","sourceObservationId":"EVT-0139","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.4.18","dst_ip":"10.0.1.28","dst_port":80,"protocol":"TCP","bytes_sent":11632,"bytes_recv":130624,"action":"allowed","firewall_rule":"ALLOW-OUT-188"},"raw":{"event_id":"EVT-0139","source_type":"network","timestamp":"2026-06-10T20:27:01.216356Z","event_name":"network_connection","src_ip":"10.0.4.18","dst_ip":"10.0.1.28","dst_port":80,"protocol":"TCP","bytes_sent":11632,"bytes_recv":130624,"action":"allowed","firewall_rule":"ALLOW-OUT-188"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0194","sourceType":"cloud_storage","eventType":"file_view","timestamp":"2026-06-10T20:42:23.024628Z","entities":[{"entityId":"user:fmartinez","type":"user","rawValue":"fmartinez","normalizedValue":"fmartinez","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0194","role":"actor_user"},{"entityId":"ipv4:10.0.3.21","type":"ipv4","rawValue":"10.0.3.21","normalizedValue":"10.0.3.21","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0194","role":"source_ip"},{"entityId":"bucket:corp-documents","type":"bucket","rawValue":"corp-documents","normalizedValue":"corp-documents","normalizationMethod":"verbatim","sourceObservationId":"EVT-0194","role":"bucket"},{"entityId":"cloud_object:corp-documents/Product_Roadmap_v3.pptx","type":"cloud_object","rawValue":"corp-documents/Product_Roadmap_v3.pptx","normalizedValue":"corp-documents/Product_Roadmap_v3.pptx","normalizationMethod":"verbatim","sourceObservationId":"EVT-0194","role":"cloud_object"}],"attributes":{"username":"fmartinez","source_ip":"10.0.3.21","file_name":"Product_Roadmap_v3.pptx","file_size_bytes":3492045,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"raw":{"event_id":"EVT-0194","source_type":"cloud_storage","timestamp":"2026-06-10T20:42:23.024628Z","event_name":"file_view","username":"fmartinez","source_ip":"10.0.3.21","file_name":"Product_Roadmap_v3.pptx","file_size_bytes":3492045,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0096","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-10T20:46:42.214912Z","entities":[{"entityId":"ipv4:10.0.4.29","type":"ipv4","rawValue":"10.0.4.29","normalizedValue":"10.0.4.29","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0096","role":"src_ip"},{"entityId":"ipv4:10.0.4.21","type":"ipv4","rawValue":"10.0.4.21","normalizedValue":"10.0.4.21","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0096","role":"dst_ip"},{"entityId":"endpoint:10.0.4.21:80","type":"endpoint","rawValue":"10.0.4.21:80","normalizedValue":"10.0.4.21:80","normalizationMethod":"verbatim","sourceObservationId":"EVT-0096","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.4.29","dst_ip":"10.0.4.21","dst_port":80,"protocol":"TCP","bytes_sent":37558,"bytes_recv":93625,"action":"allowed","firewall_rule":"ALLOW-OUT-112"},"raw":{"event_id":"EVT-0096","source_type":"network","timestamp":"2026-06-10T20:46:42.214912Z","event_name":"network_connection","src_ip":"10.0.4.29","dst_ip":"10.0.4.21","dst_port":80,"protocol":"TCP","bytes_sent":37558,"bytes_recv":93625,"action":"allowed","firewall_rule":"ALLOW-OUT-112"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0052","sourceType":"auth","eventType":"user_logon","timestamp":"2026-06-10T20:49:34.566610Z","entities":[{"entityId":"user:dtaylor","type":"user","rawValue":"dtaylor","normalizedValue":"dtaylor","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0052","role":"actor_user"},{"entityId":"host:WKSTN-10","type":"host","rawValue":"WKSTN-10","normalizedValue":"WKSTN-10","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0052","role":"source_host"},{"entityId":"host:AUTH-SRV-02","type":"host","rawValue":"AUTH-SRV-02","normalizedValue":"AUTH-SRV-02","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0052","role":"dest_host"},{"entityId":"ipv4:10.0.1.205","type":"ipv4","rawValue":"10.0.1.205","normalizedValue":"10.0.1.205","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0052","role":"source_ip"}],"attributes":{"username":"dtaylor","source_host":"WKSTN-10","dest_host":"AUTH-SRV-02","logon_type":"remote_interactive","result":"success","source_ip":"10.0.1.205"},"raw":{"event_id":"EVT-0052","source_type":"auth","timestamp":"2026-06-10T20:49:34.566610Z","event_name":"user_logon","username":"dtaylor","source_host":"WKSTN-10","dest_host":"AUTH-SRV-02","logon_type":"remote_interactive","result":"success","source_ip":"10.0.1.205"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0042","sourceType":"auth","eventType":"user_logon","timestamp":"2026-06-10T21:25:00.921148Z","entities":[{"entityId":"user:glee","type":"user","rawValue":"glee","normalizedValue":"glee","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0042","role":"actor_user"},{"entityId":"host:WKSTN-08","type":"host","rawValue":"WKSTN-08","normalizedValue":"WKSTN-08","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0042","role":"source_host"},{"entityId":"host:AUTH-SRV-02","type":"host","rawValue":"AUTH-SRV-02","normalizedValue":"AUTH-SRV-02","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0042","role":"dest_host"},{"entityId":"ipv4:10.0.3.24","type":"ipv4","rawValue":"10.0.3.24","normalizedValue":"10.0.3.24","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0042","role":"source_ip"}],"attributes":{"username":"glee","source_host":"WKSTN-08","dest_host":"AUTH-SRV-02","logon_type":"remote_interactive","result":"success","source_ip":"10.0.3.24"},"raw":{"event_id":"EVT-0042","source_type":"auth","timestamp":"2026-06-10T21:25:00.921148Z","event_name":"user_logon","username":"glee","source_host":"WKSTN-08","dest_host":"AUTH-SRV-02","logon_type":"remote_interactive","result":"success","source_ip":"10.0.3.24"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0131","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-10T21:27:34.395616Z","entities":[{"entityId":"ipv4:10.0.5.15","type":"ipv4","rawValue":"10.0.5.15","normalizedValue":"10.0.5.15","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0131","role":"src_ip"},{"entityId":"ipv4:10.0.1.26","type":"ipv4","rawValue":"10.0.1.26","normalizedValue":"10.0.1.26","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0131","role":"dst_ip"},{"entityId":"endpoint:10.0.1.26:53","type":"endpoint","rawValue":"10.0.1.26:53","normalizedValue":"10.0.1.26:53","normalizationMethod":"verbatim","sourceObservationId":"EVT-0131","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.5.15","dst_ip":"10.0.1.26","dst_port":53,"protocol":"UDP","bytes_sent":37042,"bytes_recv":21034,"action":"allowed","firewall_rule":"ALLOW-OUT-140"},"raw":{"event_id":"EVT-0131","source_type":"network","timestamp":"2026-06-10T21:27:34.395616Z","event_name":"network_connection","src_ip":"10.0.5.15","dst_ip":"10.0.1.26","dst_port":53,"protocol":"UDP","bytes_sent":37042,"bytes_recv":21034,"action":"allowed","firewall_rule":"ALLOW-OUT-140"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0142","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-10T21:41:40.136056Z","entities":[{"entityId":"host:WKSTN-05","type":"host","rawValue":"WKSTN-05","normalizedValue":"WKSTN-05","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0142","role":"host"},{"entityId":"user:dtaylor","type":"user","rawValue":"dtaylor","normalizedValue":"dtaylor","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0142","role":"actor_user"},{"entityId":"process:WKSTN-05:6480","type":"process","rawValue":"6480","normalizedValue":"6480","normalizationMethod":"verbatim","sourceObservationId":"EVT-0142","role":"process"}],"attributes":{"hostname":"WKSTN-05","username":"dtaylor","process_name":"word.exe","parent_process":"outlook.exe","process_path":"C:\\Program Files\\Google\\","command_line":"","pid":6480,"integrity_level":"medium"},"raw":{"event_id":"EVT-0142","source_type":"endpoint","timestamp":"2026-06-10T21:41:40.136056Z","event_name":"process_create","hostname":"WKSTN-05","username":"dtaylor","process_name":"word.exe","parent_process":"outlook.exe","process_path":"C:\\Program Files\\Google\\","command_line":"","pid":6480,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0149","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-10T22:43:26.429914Z","entities":[{"entityId":"host:WKSTN-02","type":"host","rawValue":"WKSTN-02","normalizedValue":"WKSTN-02","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0149","role":"host"},{"entityId":"user:dtaylor","type":"user","rawValue":"dtaylor","normalizedValue":"dtaylor","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0149","role":"actor_user"},{"entityId":"process:WKSTN-02:4109","type":"process","rawValue":"4109","normalizedValue":"4109","normalizationMethod":"verbatim","sourceObservationId":"EVT-0149","role":"process"}],"attributes":{"hostname":"WKSTN-02","username":"dtaylor","process_name":"chrome.exe","parent_process":"outlook.exe","process_path":"C:\\Program Files\\Microsoft\\","command_line":"","pid":4109,"integrity_level":"medium"},"raw":{"event_id":"EVT-0149","source_type":"endpoint","timestamp":"2026-06-10T22:43:26.429914Z","event_name":"process_create","hostname":"WKSTN-02","username":"dtaylor","process_name":"chrome.exe","parent_process":"outlook.exe","process_path":"C:\\Program Files\\Microsoft\\","command_line":"","pid":4109,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0019","sourceType":"auth","eventType":"failed_logon","timestamp":"2026-06-10T22:59:02.525182Z","entities":[{"entityId":"user:hwalker","type":"user","rawValue":"hwalker","normalizedValue":"hwalker","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0019","role":"actor_user"},{"entityId":"host:WKSTN-10","type":"host","rawValue":"WKSTN-10","normalizedValue":"WKSTN-10","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0019","role":"source_host"},{"entityId":"host:AUTH-SRV-01","type":"host","rawValue":"AUTH-SRV-01","normalizedValue":"AUTH-SRV-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0019","role":"dest_host"},{"entityId":"ipv4:10.0.1.120","type":"ipv4","rawValue":"10.0.1.120","normalizedValue":"10.0.1.120","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0019","role":"source_ip"}],"attributes":{"username":"hwalker","source_host":"WKSTN-10","dest_host":"AUTH-SRV-01","logon_type":"remote_interactive","result":"success","source_ip":"10.0.1.120"},"raw":{"event_id":"EVT-0019","source_type":"auth","timestamp":"2026-06-10T22:59:02.525182Z","event_name":"failed_logon","username":"hwalker","source_host":"WKSTN-10","dest_host":"AUTH-SRV-01","logon_type":"remote_interactive","result":"success","source_ip":"10.0.1.120"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0014","sourceType":"auth","eventType":"user_logoff","timestamp":"2026-06-10T23:00:48.297157Z","entities":[{"entityId":"user:glee","type":"user","rawValue":"glee","normalizedValue":"glee","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0014","role":"actor_user"},{"entityId":"host:WKSTN-08","type":"host","rawValue":"WKSTN-08","normalizedValue":"WKSTN-08","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0014","role":"source_host"},{"entityId":"host:AUTH-SRV-01","type":"host","rawValue":"AUTH-SRV-01","normalizedValue":"AUTH-SRV-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0014","role":"dest_host"},{"entityId":"ipv4:10.0.5.16","type":"ipv4","rawValue":"10.0.5.16","normalizedValue":"10.0.5.16","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0014","role":"source_ip"}],"attributes":{"username":"glee","source_host":"WKSTN-08","dest_host":"AUTH-SRV-01","logon_type":"interactive","result":"success","source_ip":"10.0.5.16"},"raw":{"event_id":"EVT-0014","source_type":"auth","timestamp":"2026-06-10T23:00:48.297157Z","event_name":"user_logoff","username":"glee","source_host":"WKSTN-08","dest_host":"AUTH-SRV-01","logon_type":"interactive","result":"success","source_ip":"10.0.5.16"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0020","sourceType":"auth","eventType":"user_logon","timestamp":"2026-06-10T23:30:40.097804Z","entities":[{"entityId":"user:fmartinez","type":"user","rawValue":"fmartinez","normalizedValue":"fmartinez","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0020","role":"actor_user"},{"entityId":"host:WKSTN-02","type":"host","rawValue":"WKSTN-02","normalizedValue":"WKSTN-02","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0020","role":"source_host"},{"entityId":"host:AUTH-SRV-01","type":"host","rawValue":"AUTH-SRV-01","normalizedValue":"AUTH-SRV-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0020","role":"dest_host"},{"entityId":"ipv4:10.0.2.249","type":"ipv4","rawValue":"10.0.2.249","normalizedValue":"10.0.2.249","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0020","role":"source_ip"}],"attributes":{"username":"fmartinez","source_host":"WKSTN-02","dest_host":"AUTH-SRV-01","logon_type":"interactive","result":"success","source_ip":"10.0.2.249"},"raw":{"event_id":"EVT-0020","source_type":"auth","timestamp":"2026-06-10T23:30:40.097804Z","event_name":"user_logon","username":"fmartinez","source_host":"WKSTN-02","dest_host":"AUTH-SRV-01","logon_type":"interactive","result":"success","source_ip":"10.0.2.249"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0204","sourceType":"cloud_storage","eventType":"file_download","timestamp":"2026-06-10T23:51:56.666230Z","entities":[{"entityId":"user:dtaylor","type":"user","rawValue":"dtaylor","normalizedValue":"dtaylor","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0204","role":"actor_user"},{"entityId":"ipv4:10.0.4.11","type":"ipv4","rawValue":"10.0.4.11","normalizedValue":"10.0.4.11","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0204","role":"source_ip"},{"entityId":"bucket:corp-documents","type":"bucket","rawValue":"corp-documents","normalizedValue":"corp-documents","normalizationMethod":"verbatim","sourceObservationId":"EVT-0204","role":"bucket"},{"entityId":"cloud_object:corp-documents/Team_OKRs_2026.xlsx","type":"cloud_object","rawValue":"corp-documents/Team_OKRs_2026.xlsx","normalizedValue":"corp-documents/Team_OKRs_2026.xlsx","normalizationMethod":"verbatim","sourceObservationId":"EVT-0204","role":"cloud_object"}],"attributes":{"username":"dtaylor","source_ip":"10.0.4.11","file_name":"Team_OKRs_2026.xlsx","file_size_bytes":4448950,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"raw":{"event_id":"EVT-0204","source_type":"cloud_storage","timestamp":"2026-06-10T23:51:56.666230Z","event_name":"file_download","username":"dtaylor","source_ip":"10.0.4.11","file_name":"Team_OKRs_2026.xlsx","file_size_bytes":4448950,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0051","sourceType":"auth","eventType":"user_logon","timestamp":"2026-06-10T23:54:23.601947Z","entities":[{"entityId":"user:hwalker","type":"user","rawValue":"hwalker","normalizedValue":"hwalker","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0051","role":"actor_user"},{"entityId":"host:WKSTN-08","type":"host","rawValue":"WKSTN-08","normalizedValue":"WKSTN-08","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0051","role":"source_host"},{"entityId":"host:AUTH-SRV-01","type":"host","rawValue":"AUTH-SRV-01","normalizedValue":"AUTH-SRV-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0051","role":"dest_host"},{"entityId":"ipv4:10.0.4.24","type":"ipv4","rawValue":"10.0.4.24","normalizedValue":"10.0.4.24","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0051","role":"source_ip"}],"attributes":{"username":"hwalker","source_host":"WKSTN-08","dest_host":"AUTH-SRV-01","logon_type":"network","result":"failure","source_ip":"10.0.4.24"},"raw":{"event_id":"EVT-0051","source_type":"auth","timestamp":"2026-06-10T23:54:23.601947Z","event_name":"user_logon","username":"hwalker","source_host":"WKSTN-08","dest_host":"AUTH-SRV-01","logon_type":"network","result":"failure","source_ip":"10.0.4.24"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0028","sourceType":"auth","eventType":"user_logoff","timestamp":"2026-06-11T00:19:26.577031Z","entities":[{"entityId":"user:dtaylor","type":"user","rawValue":"dtaylor","normalizedValue":"dtaylor","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0028","role":"actor_user"},{"entityId":"host:WKSTN-10","type":"host","rawValue":"WKSTN-10","normalizedValue":"WKSTN-10","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0028","role":"source_host"},{"entityId":"host:AUTH-SRV-01","type":"host","rawValue":"AUTH-SRV-01","normalizedValue":"AUTH-SRV-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0028","role":"dest_host"},{"entityId":"ipv4:10.0.5.57","type":"ipv4","rawValue":"10.0.5.57","normalizedValue":"10.0.5.57","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0028","role":"source_ip"}],"attributes":{"username":"dtaylor","source_host":"WKSTN-10","dest_host":"AUTH-SRV-01","logon_type":"network","result":"failure","source_ip":"10.0.5.57"},"raw":{"event_id":"EVT-0028","source_type":"auth","timestamp":"2026-06-11T00:19:26.577031Z","event_name":"user_logoff","username":"dtaylor","source_host":"WKSTN-10","dest_host":"AUTH-SRV-01","logon_type":"network","result":"failure","source_ip":"10.0.5.57"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0167","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-11T00:49:30.104519Z","entities":[{"entityId":"host:WKSTN-06","type":"host","rawValue":"WKSTN-06","normalizedValue":"WKSTN-06","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0167","role":"host"},{"entityId":"user:dtaylor","type":"user","rawValue":"dtaylor","normalizedValue":"dtaylor","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0167","role":"actor_user"},{"entityId":"process:WKSTN-06:6443","type":"process","rawValue":"6443","normalizedValue":"6443","normalizationMethod":"verbatim","sourceObservationId":"EVT-0167","role":"process"}],"attributes":{"hostname":"WKSTN-06","username":"dtaylor","process_name":"word.exe","parent_process":"outlook.exe","process_path":"C:\\Program Files\\Google\\","command_line":"","pid":6443,"integrity_level":"medium"},"raw":{"event_id":"EVT-0167","source_type":"endpoint","timestamp":"2026-06-11T00:49:30.104519Z","event_name":"process_create","hostname":"WKSTN-06","username":"dtaylor","process_name":"word.exe","parent_process":"outlook.exe","process_path":"C:\\Program Files\\Google\\","command_line":"","pid":6443,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0054","sourceType":"auth","eventType":"user_logon","timestamp":"2026-06-11T01:19:38.981577Z","entities":[{"entityId":"user:glee","type":"user","rawValue":"glee","normalizedValue":"glee","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0054","role":"actor_user"},{"entityId":"host:WKSTN-03","type":"host","rawValue":"WKSTN-03","normalizedValue":"WKSTN-03","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0054","role":"source_host"},{"entityId":"host:AUTH-SRV-02","type":"host","rawValue":"AUTH-SRV-02","normalizedValue":"AUTH-SRV-02","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0054","role":"dest_host"},{"entityId":"ipv4:10.0.5.43","type":"ipv4","rawValue":"10.0.5.43","normalizedValue":"10.0.5.43","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0054","role":"source_ip"}],"attributes":{"username":"glee","source_host":"WKSTN-03","dest_host":"AUTH-SRV-02","logon_type":"remote_interactive","result":"failure","source_ip":"10.0.5.43"},"raw":{"event_id":"EVT-0054","source_type":"auth","timestamp":"2026-06-11T01:19:38.981577Z","event_name":"user_logon","username":"glee","source_host":"WKSTN-03","dest_host":"AUTH-SRV-02","logon_type":"remote_interactive","result":"failure","source_ip":"10.0.5.43"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0174","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-11T01:41:07.455907Z","entities":[{"entityId":"host:WKSTN-10","type":"host","rawValue":"WKSTN-10","normalizedValue":"WKSTN-10","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0174","role":"host"},{"entityId":"user:ewhite","type":"user","rawValue":"ewhite","normalizedValue":"ewhite","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0174","role":"actor_user"},{"entityId":"process:WKSTN-10:6720","type":"process","rawValue":"6720","normalizedValue":"6720","normalizationMethod":"verbatim","sourceObservationId":"EVT-0174","role":"process"}],"attributes":{"hostname":"WKSTN-10","username":"ewhite","process_name":"chrome.exe","parent_process":"teams.exe","process_path":"C:\\Program Files\\Google\\","command_line":"","pid":6720,"integrity_level":"medium"},"raw":{"event_id":"EVT-0174","source_type":"endpoint","timestamp":"2026-06-11T01:41:07.455907Z","event_name":"process_create","hostname":"WKSTN-10","username":"ewhite","process_name":"chrome.exe","parent_process":"teams.exe","process_path":"C:\\Program Files\\Google\\","command_line":"","pid":6720,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0011","sourceType":"auth","eventType":"user_logoff","timestamp":"2026-06-11T03:01:40.094053Z","entities":[{"entityId":"user:asmith","type":"user","rawValue":"asmith","normalizedValue":"asmith","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0011","role":"actor_user"},{"entityId":"host:WKSTN-05","type":"host","rawValue":"WKSTN-05","normalizedValue":"WKSTN-05","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0011","role":"source_host"},{"entityId":"host:AUTH-SRV-02","type":"host","rawValue":"AUTH-SRV-02","normalizedValue":"AUTH-SRV-02","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0011","role":"dest_host"},{"entityId":"ipv4:10.0.1.77","type":"ipv4","rawValue":"10.0.1.77","normalizedValue":"10.0.1.77","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0011","role":"source_ip"}],"attributes":{"username":"asmith","source_host":"WKSTN-05","dest_host":"AUTH-SRV-02","logon_type":"remote_interactive","result":"success","source_ip":"10.0.1.77"},"raw":{"event_id":"EVT-0011","source_type":"auth","timestamp":"2026-06-11T03:01:40.094053Z","event_name":"user_logoff","username":"asmith","source_host":"WKSTN-05","dest_host":"AUTH-SRV-02","logon_type":"remote_interactive","result":"success","source_ip":"10.0.1.77"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0067","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-11T03:18:15.219184Z","entities":[{"entityId":"ipv4:10.0.4.12","type":"ipv4","rawValue":"10.0.4.12","normalizedValue":"10.0.4.12","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0067","role":"src_ip"},{"entityId":"ipv4:10.0.1.25","type":"ipv4","rawValue":"10.0.1.25","normalizedValue":"10.0.1.25","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0067","role":"dst_ip"},{"entityId":"endpoint:10.0.1.25:443","type":"endpoint","rawValue":"10.0.1.25:443","normalizedValue":"10.0.1.25:443","normalizationMethod":"verbatim","sourceObservationId":"EVT-0067","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.4.12","dst_ip":"10.0.1.25","dst_port":443,"protocol":"UDP","bytes_sent":31081,"bytes_recv":64840,"action":"allowed","firewall_rule":"ALLOW-OUT-156"},"raw":{"event_id":"EVT-0067","source_type":"network","timestamp":"2026-06-11T03:18:15.219184Z","event_name":"network_connection","src_ip":"10.0.4.12","dst_ip":"10.0.1.25","dst_port":443,"protocol":"UDP","bytes_sent":31081,"bytes_recv":64840,"action":"allowed","firewall_rule":"ALLOW-OUT-156"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0005","sourceType":"auth","eventType":"user_logon","timestamp":"2026-06-11T03:21:03.937588Z","entities":[{"entityId":"user:dtaylor","type":"user","rawValue":"dtaylor","normalizedValue":"dtaylor","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0005","role":"actor_user"},{"entityId":"host:WKSTN-04","type":"host","rawValue":"WKSTN-04","normalizedValue":"WKSTN-04","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0005","role":"source_host"},{"entityId":"host:AUTH-SRV-02","type":"host","rawValue":"AUTH-SRV-02","normalizedValue":"AUTH-SRV-02","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0005","role":"dest_host"},{"entityId":"ipv4:10.0.3.78","type":"ipv4","rawValue":"10.0.3.78","normalizedValue":"10.0.3.78","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0005","role":"source_ip"}],"attributes":{"username":"dtaylor","source_host":"WKSTN-04","dest_host":"AUTH-SRV-02","logon_type":"interactive","result":"success","source_ip":"10.0.3.78"},"raw":{"event_id":"EVT-0005","source_type":"auth","timestamp":"2026-06-11T03:21:03.937588Z","event_name":"user_logon","username":"dtaylor","source_host":"WKSTN-04","dest_host":"AUTH-SRV-02","logon_type":"interactive","result":"success","source_ip":"10.0.3.78"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0100","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-11T03:59:42.264363Z","entities":[{"entityId":"ipv4:10.0.1.17","type":"ipv4","rawValue":"10.0.1.17","normalizedValue":"10.0.1.17","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0100","role":"src_ip"},{"entityId":"ipv4:10.0.2.16","type":"ipv4","rawValue":"10.0.2.16","normalizedValue":"10.0.2.16","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0100","role":"dst_ip"},{"entityId":"endpoint:10.0.2.16:443","type":"endpoint","rawValue":"10.0.2.16:443","normalizedValue":"10.0.2.16:443","normalizationMethod":"verbatim","sourceObservationId":"EVT-0100","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.1.17","dst_ip":"10.0.2.16","dst_port":443,"protocol":"UDP","bytes_sent":27447,"bytes_recv":43263,"action":"allowed","firewall_rule":"ALLOW-OUT-120"},"raw":{"event_id":"EVT-0100","source_type":"network","timestamp":"2026-06-11T03:59:42.264363Z","event_name":"network_connection","src_ip":"10.0.1.17","dst_ip":"10.0.2.16","dst_port":443,"protocol":"UDP","bytes_sent":27447,"bytes_recv":43263,"action":"allowed","firewall_rule":"ALLOW-OUT-120"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0191","sourceType":"cloud_storage","eventType":"file_share","timestamp":"2026-06-11T04:22:17.617130Z","entities":[{"entityId":"user:fmartinez","type":"user","rawValue":"fmartinez","normalizedValue":"fmartinez","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0191","role":"actor_user"},{"entityId":"ipv4:10.0.2.24","type":"ipv4","rawValue":"10.0.2.24","normalizedValue":"10.0.2.24","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0191","role":"source_ip"},{"entityId":"bucket:corp-documents","type":"bucket","rawValue":"corp-documents","normalizedValue":"corp-documents","normalizationMethod":"verbatim","sourceObservationId":"EVT-0191","role":"bucket"},{"entityId":"cloud_object:corp-documents/Product_Roadmap_v3.pptx","type":"cloud_object","rawValue":"corp-documents/Product_Roadmap_v3.pptx","normalizedValue":"corp-documents/Product_Roadmap_v3.pptx","normalizationMethod":"verbatim","sourceObservationId":"EVT-0191","role":"cloud_object"}],"attributes":{"username":"fmartinez","source_ip":"10.0.2.24","file_name":"Product_Roadmap_v3.pptx","file_size_bytes":4095450,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"raw":{"event_id":"EVT-0191","source_type":"cloud_storage","timestamp":"2026-06-11T04:22:17.617130Z","event_name":"file_share","username":"fmartinez","source_ip":"10.0.2.24","file_name":"Product_Roadmap_v3.pptx","file_size_bytes":4095450,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0112","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-11T04:44:54.143200Z","entities":[{"entityId":"ipv4:10.0.1.12","type":"ipv4","rawValue":"10.0.1.12","normalizedValue":"10.0.1.12","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0112","role":"src_ip"},{"entityId":"ipv4:10.0.3.10","type":"ipv4","rawValue":"10.0.3.10","normalizedValue":"10.0.3.10","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0112","role":"dst_ip"},{"entityId":"endpoint:10.0.3.10:80","type":"endpoint","rawValue":"10.0.3.10:80","normalizedValue":"10.0.3.10:80","normalizationMethod":"verbatim","sourceObservationId":"EVT-0112","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.1.12","dst_ip":"10.0.3.10","dst_port":80,"protocol":"UDP","bytes_sent":14363,"bytes_recv":90142,"action":"allowed","firewall_rule":"ALLOW-OUT-182"},"raw":{"event_id":"EVT-0112","source_type":"network","timestamp":"2026-06-11T04:44:54.143200Z","event_name":"network_connection","src_ip":"10.0.1.12","dst_ip":"10.0.3.10","dst_port":80,"protocol":"UDP","bytes_sent":14363,"bytes_recv":90142,"action":"allowed","firewall_rule":"ALLOW-OUT-182"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0170","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-11T05:09:06.671408Z","entities":[{"entityId":"host:WKSTN-09","type":"host","rawValue":"WKSTN-09","normalizedValue":"WKSTN-09","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0170","role":"host"},{"entityId":"user:bwilliams","type":"user","rawValue":"bwilliams","normalizedValue":"bwilliams","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0170","role":"actor_user"},{"entityId":"process:WKSTN-09:8067","type":"process","rawValue":"8067","normalizedValue":"8067","normalizationMethod":"verbatim","sourceObservationId":"EVT-0170","role":"process"}],"attributes":{"hostname":"WKSTN-09","username":"bwilliams","process_name":"outlook.exe","parent_process":"teams.exe","process_path":"C:\\Program Files\\Slack\\","command_line":"","pid":8067,"integrity_level":"medium"},"raw":{"event_id":"EVT-0170","source_type":"endpoint","timestamp":"2026-06-11T05:09:06.671408Z","event_name":"process_create","hostname":"WKSTN-09","username":"bwilliams","process_name":"outlook.exe","parent_process":"teams.exe","process_path":"C:\\Program Files\\Slack\\","command_line":"","pid":8067,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0030","sourceType":"auth","eventType":"failed_logon","timestamp":"2026-06-11T05:25:54.996133Z","entities":[{"entityId":"user:hwalker","type":"user","rawValue":"hwalker","normalizedValue":"hwalker","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0030","role":"actor_user"},{"entityId":"host:WKSTN-01","type":"host","rawValue":"WKSTN-01","normalizedValue":"WKSTN-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0030","role":"source_host"},{"entityId":"host:AUTH-SRV-01","type":"host","rawValue":"AUTH-SRV-01","normalizedValue":"AUTH-SRV-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0030","role":"dest_host"},{"entityId":"ipv4:10.0.2.219","type":"ipv4","rawValue":"10.0.2.219","normalizedValue":"10.0.2.219","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0030","role":"source_ip"}],"attributes":{"username":"hwalker","source_host":"WKSTN-01","dest_host":"AUTH-SRV-01","logon_type":"remote_interactive","result":"success","source_ip":"10.0.2.219"},"raw":{"event_id":"EVT-0030","source_type":"auth","timestamp":"2026-06-11T05:25:54.996133Z","event_name":"failed_logon","username":"hwalker","source_host":"WKSTN-01","dest_host":"AUTH-SRV-01","logon_type":"remote_interactive","result":"success","source_ip":"10.0.2.219"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0208","sourceType":"cloud_storage","eventType":"file_upload","timestamp":"2026-06-11T05:53:30.217271Z","entities":[{"entityId":"user:fmartinez","type":"user","rawValue":"fmartinez","normalizedValue":"fmartinez","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0208","role":"actor_user"},{"entityId":"ipv4:10.0.1.21","type":"ipv4","rawValue":"10.0.1.21","normalizedValue":"10.0.1.21","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0208","role":"source_ip"},{"entityId":"bucket:corp-documents","type":"bucket","rawValue":"corp-documents","normalizedValue":"corp-documents","normalizationMethod":"verbatim","sourceObservationId":"EVT-0208","role":"bucket"},{"entityId":"cloud_object:corp-documents/Meeting_Notes_Jun10.docx","type":"cloud_object","rawValue":"corp-documents/Meeting_Notes_Jun10.docx","normalizedValue":"corp-documents/Meeting_Notes_Jun10.docx","normalizationMethod":"verbatim","sourceObservationId":"EVT-0208","role":"cloud_object"}],"attributes":{"username":"fmartinez","source_ip":"10.0.1.21","file_name":"Meeting_Notes_Jun10.docx","file_size_bytes":3556749,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"raw":{"event_id":"EVT-0208","source_type":"cloud_storage","timestamp":"2026-06-11T05:53:30.217271Z","event_name":"file_upload","username":"fmartinez","source_ip":"10.0.1.21","file_name":"Meeting_Notes_Jun10.docx","file_size_bytes":3556749,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0091","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-11T06:43:39.266514Z","entities":[{"entityId":"ipv4:10.0.1.11","type":"ipv4","rawValue":"10.0.1.11","normalizedValue":"10.0.1.11","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0091","role":"src_ip"},{"entityId":"ipv4:10.0.2.10","type":"ipv4","rawValue":"10.0.2.10","normalizedValue":"10.0.2.10","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0091","role":"dst_ip"},{"entityId":"endpoint:10.0.2.10:443","type":"endpoint","rawValue":"10.0.2.10:443","normalizedValue":"10.0.2.10:443","normalizationMethod":"verbatim","sourceObservationId":"EVT-0091","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.1.11","dst_ip":"10.0.2.10","dst_port":443,"protocol":"TCP","bytes_sent":3234,"bytes_recv":27679,"action":"allowed","firewall_rule":"ALLOW-OUT-161"},"raw":{"event_id":"EVT-0091","source_type":"network","timestamp":"2026-06-11T06:43:39.266514Z","event_name":"network_connection","src_ip":"10.0.1.11","dst_ip":"10.0.2.10","dst_port":443,"protocol":"TCP","bytes_sent":3234,"bytes_recv":27679,"action":"allowed","firewall_rule":"ALLOW-OUT-161"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0181","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-11T06:50:13.194708Z","entities":[{"entityId":"host:WKSTN-09","type":"host","rawValue":"WKSTN-09","normalizedValue":"WKSTN-09","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0181","role":"host"},{"entityId":"user:cjohnson","type":"user","rawValue":"cjohnson","normalizedValue":"cjohnson","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0181","role":"actor_user"},{"entityId":"process:WKSTN-09:6799","type":"process","rawValue":"6799","normalizedValue":"6799","normalizationMethod":"verbatim","sourceObservationId":"EVT-0181","role":"process"}],"attributes":{"hostname":"WKSTN-09","username":"cjohnson","process_name":"teams.exe","parent_process":"explorer.exe","process_path":"C:\\Program Files\\Microsoft\\","command_line":"","pid":6799,"integrity_level":"medium"},"raw":{"event_id":"EVT-0181","source_type":"endpoint","timestamp":"2026-06-11T06:50:13.194708Z","event_name":"process_create","hostname":"WKSTN-09","username":"cjohnson","process_name":"teams.exe","parent_process":"explorer.exe","process_path":"C:\\Program Files\\Microsoft\\","command_line":"","pid":6799,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0143","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-11T06:56:50.158387Z","entities":[{"entityId":"host:WKSTN-10","type":"host","rawValue":"WKSTN-10","normalizedValue":"WKSTN-10","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0143","role":"host"},{"entityId":"user:jclark","type":"user","rawValue":"jclark","normalizedValue":"jclark","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0143","role":"actor_user"},{"entityId":"process:WKSTN-10:1689","type":"process","rawValue":"1689","normalizedValue":"1689","normalizationMethod":"verbatim","sourceObservationId":"EVT-0143","role":"process"}],"attributes":{"hostname":"WKSTN-10","username":"jclark","process_name":"slack.exe","parent_process":"explorer.exe","process_path":"C:\\Program Files\\Slack\\","command_line":"","pid":1689,"integrity_level":"medium"},"raw":{"event_id":"EVT-0143","source_type":"endpoint","timestamp":"2026-06-11T06:56:50.158387Z","event_name":"process_create","hostname":"WKSTN-10","username":"jclark","process_name":"slack.exe","parent_process":"explorer.exe","process_path":"C:\\Program Files\\Slack\\","command_line":"","pid":1689,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0080","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-11T07:06:05.683843Z","entities":[{"entityId":"ipv4:10.0.1.12","type":"ipv4","rawValue":"10.0.1.12","normalizedValue":"10.0.1.12","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0080","role":"src_ip"},{"entityId":"ipv4:10.0.4.14","type":"ipv4","rawValue":"10.0.4.14","normalizedValue":"10.0.4.14","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0080","role":"dst_ip"},{"entityId":"endpoint:10.0.4.14:443","type":"endpoint","rawValue":"10.0.4.14:443","normalizedValue":"10.0.4.14:443","normalizationMethod":"verbatim","sourceObservationId":"EVT-0080","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.1.12","dst_ip":"10.0.4.14","dst_port":443,"protocol":"TCP","bytes_sent":44918,"bytes_recv":13829,"action":"allowed","firewall_rule":"ALLOW-OUT-126"},"raw":{"event_id":"EVT-0080","source_type":"network","timestamp":"2026-06-11T07:06:05.683843Z","event_name":"network_connection","src_ip":"10.0.1.12","dst_ip":"10.0.4.14","dst_port":443,"protocol":"TCP","bytes_sent":44918,"bytes_recv":13829,"action":"allowed","firewall_rule":"ALLOW-OUT-126"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0178","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-11T07:28:39.978902Z","entities":[{"entityId":"host:WKSTN-09","type":"host","rawValue":"WKSTN-09","normalizedValue":"WKSTN-09","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0178","role":"host"},{"entityId":"user:iharris","type":"user","rawValue":"iharris","normalizedValue":"iharris","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0178","role":"actor_user"},{"entityId":"process:WKSTN-09:3445","type":"process","rawValue":"3445","normalizedValue":"3445","normalizationMethod":"verbatim","sourceObservationId":"EVT-0178","role":"process"}],"attributes":{"hostname":"WKSTN-09","username":"iharris","process_name":"notepad.exe","parent_process":"explorer.exe","process_path":"C:\\Program Files\\Google\\","command_line":"","pid":3445,"integrity_level":"medium"},"raw":{"event_id":"EVT-0178","source_type":"endpoint","timestamp":"2026-06-11T07:28:39.978902Z","event_name":"process_create","hostname":"WKSTN-09","username":"iharris","process_name":"notepad.exe","parent_process":"explorer.exe","process_path":"C:\\Program Files\\Google\\","command_line":"","pid":3445,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0015","sourceType":"auth","eventType":"failed_logon","timestamp":"2026-06-11T07:40:22.208790Z","entities":[{"entityId":"user:fmartinez","type":"user","rawValue":"fmartinez","normalizedValue":"fmartinez","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0015","role":"actor_user"},{"entityId":"host:WKSTN-06","type":"host","rawValue":"WKSTN-06","normalizedValue":"WKSTN-06","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0015","role":"source_host"},{"entityId":"host:AUTH-SRV-02","type":"host","rawValue":"AUTH-SRV-02","normalizedValue":"AUTH-SRV-02","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0015","role":"dest_host"},{"entityId":"ipv4:10.0.4.247","type":"ipv4","rawValue":"10.0.4.247","normalizedValue":"10.0.4.247","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0015","role":"source_ip"}],"attributes":{"username":"fmartinez","source_host":"WKSTN-06","dest_host":"AUTH-SRV-02","logon_type":"network","result":"success","source_ip":"10.0.4.247"},"raw":{"event_id":"EVT-0015","source_type":"auth","timestamp":"2026-06-11T07:40:22.208790Z","event_name":"failed_logon","username":"fmartinez","source_host":"WKSTN-06","dest_host":"AUTH-SRV-02","logon_type":"network","result":"success","source_ip":"10.0.4.247"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0124","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-11T08:08:55.989392Z","entities":[{"entityId":"ipv4:10.0.1.17","type":"ipv4","rawValue":"10.0.1.17","normalizedValue":"10.0.1.17","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0124","role":"src_ip"},{"entityId":"ipv4:10.0.2.17","type":"ipv4","rawValue":"10.0.2.17","normalizedValue":"10.0.2.17","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0124","role":"dst_ip"},{"entityId":"endpoint:10.0.2.17:443","type":"endpoint","rawValue":"10.0.2.17:443","normalizedValue":"10.0.2.17:443","normalizationMethod":"verbatim","sourceObservationId":"EVT-0124","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.1.17","dst_ip":"10.0.2.17","dst_port":443,"protocol":"UDP","bytes_sent":20361,"bytes_recv":69727,"action":"allowed","firewall_rule":"ALLOW-OUT-176"},"raw":{"event_id":"EVT-0124","source_type":"network","timestamp":"2026-06-11T08:08:55.989392Z","event_name":"network_connection","src_ip":"10.0.1.17","dst_ip":"10.0.2.17","dst_port":443,"protocol":"UDP","bytes_sent":20361,"bytes_recv":69727,"action":"allowed","firewall_rule":"ALLOW-OUT-176"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0079","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-11T08:09:03.901158Z","entities":[{"entityId":"ipv4:10.0.4.25","type":"ipv4","rawValue":"10.0.4.25","normalizedValue":"10.0.4.25","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0079","role":"src_ip"},{"entityId":"ipv4:10.0.5.20","type":"ipv4","rawValue":"10.0.5.20","normalizedValue":"10.0.5.20","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0079","role":"dst_ip"},{"entityId":"endpoint:10.0.5.20:443","type":"endpoint","rawValue":"10.0.5.20:443","normalizedValue":"10.0.5.20:443","normalizationMethod":"verbatim","sourceObservationId":"EVT-0079","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.4.25","dst_ip":"10.0.5.20","dst_port":443,"protocol":"UDP","bytes_sent":13043,"bytes_recv":144136,"action":"allowed","firewall_rule":"ALLOW-OUT-183"},"raw":{"event_id":"EVT-0079","source_type":"network","timestamp":"2026-06-11T08:09:03.901158Z","event_name":"network_connection","src_ip":"10.0.4.25","dst_ip":"10.0.5.20","dst_port":443,"protocol":"UDP","bytes_sent":13043,"bytes_recv":144136,"action":"allowed","firewall_rule":"ALLOW-OUT-183"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0070","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-11T09:31:48.790384Z","entities":[{"entityId":"ipv4:10.0.5.25","type":"ipv4","rawValue":"10.0.5.25","normalizedValue":"10.0.5.25","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0070","role":"src_ip"},{"entityId":"ipv4:10.0.4.13","type":"ipv4","rawValue":"10.0.4.13","normalizedValue":"10.0.4.13","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0070","role":"dst_ip"},{"entityId":"endpoint:10.0.4.13:53","type":"endpoint","rawValue":"10.0.4.13:53","normalizedValue":"10.0.4.13:53","normalizationMethod":"verbatim","sourceObservationId":"EVT-0070","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.5.25","dst_ip":"10.0.4.13","dst_port":53,"protocol":"UDP","bytes_sent":28820,"bytes_recv":152845,"action":"allowed","firewall_rule":"ALLOW-OUT-142"},"raw":{"event_id":"EVT-0070","source_type":"network","timestamp":"2026-06-11T09:31:48.790384Z","event_name":"network_connection","src_ip":"10.0.5.25","dst_ip":"10.0.4.13","dst_port":53,"protocol":"UDP","bytes_sent":28820,"bytes_recv":152845,"action":"allowed","firewall_rule":"ALLOW-OUT-142"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0066","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-11T11:08:13.385686Z","entities":[{"entityId":"ipv4:10.0.4.14","type":"ipv4","rawValue":"10.0.4.14","normalizedValue":"10.0.4.14","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0066","role":"src_ip"},{"entityId":"ipv4:10.0.5.26","type":"ipv4","rawValue":"10.0.5.26","normalizedValue":"10.0.5.26","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0066","role":"dst_ip"},{"entityId":"endpoint:10.0.5.26:25","type":"endpoint","rawValue":"10.0.5.26:25","normalizedValue":"10.0.5.26:25","normalizationMethod":"verbatim","sourceObservationId":"EVT-0066","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.4.14","dst_ip":"10.0.5.26","dst_port":25,"protocol":"UDP","bytes_sent":3548,"bytes_recv":100575,"action":"allowed","firewall_rule":"ALLOW-OUT-101"},"raw":{"event_id":"EVT-0066","source_type":"network","timestamp":"2026-06-11T11:08:13.385686Z","event_name":"network_connection","src_ip":"10.0.4.14","dst_ip":"10.0.5.26","dst_port":25,"protocol":"UDP","bytes_sent":3548,"bytes_recv":100575,"action":"allowed","firewall_rule":"ALLOW-OUT-101"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0198","sourceType":"cloud_storage","eventType":"file_upload","timestamp":"2026-06-11T11:16:12.352464Z","entities":[{"entityId":"user:jclark","type":"user","rawValue":"jclark","normalizedValue":"jclark","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0198","role":"actor_user"},{"entityId":"ipv4:10.0.4.19","type":"ipv4","rawValue":"10.0.4.19","normalizedValue":"10.0.4.19","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0198","role":"source_ip"},{"entityId":"bucket:corp-documents","type":"bucket","rawValue":"corp-documents","normalizedValue":"corp-documents","normalizationMethod":"verbatim","sourceObservationId":"EVT-0198","role":"bucket"},{"entityId":"cloud_object:corp-documents/Product_Roadmap_v3.pptx","type":"cloud_object","rawValue":"corp-documents/Product_Roadmap_v3.pptx","normalizedValue":"corp-documents/Product_Roadmap_v3.pptx","normalizationMethod":"verbatim","sourceObservationId":"EVT-0198","role":"cloud_object"}],"attributes":{"username":"jclark","source_ip":"10.0.4.19","file_name":"Product_Roadmap_v3.pptx","file_size_bytes":333932,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"raw":{"event_id":"EVT-0198","source_type":"cloud_storage","timestamp":"2026-06-11T11:16:12.352464Z","event_name":"file_upload","username":"jclark","source_ip":"10.0.4.19","file_name":"Product_Roadmap_v3.pptx","file_size_bytes":333932,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0126","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-11T11:16:40.019911Z","entities":[{"entityId":"ipv4:10.0.4.20","type":"ipv4","rawValue":"10.0.4.20","normalizedValue":"10.0.4.20","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0126","role":"src_ip"},{"entityId":"ipv4:8.8.8.8","type":"ipv4","rawValue":"8.8.8.8","normalizedValue":"8.8.8.8","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0126","role":"dst_ip"},{"entityId":"endpoint:8.8.8.8:443","type":"endpoint","rawValue":"8.8.8.8:443","normalizedValue":"8.8.8.8:443","normalizationMethod":"verbatim","sourceObservationId":"EVT-0126","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.4.20","dst_ip":"8.8.8.8","dst_port":443,"protocol":"TCP","bytes_sent":29936,"bytes_recv":6734,"action":"allowed","firewall_rule":"ALLOW-OUT-150"},"raw":{"event_id":"EVT-0126","source_type":"network","timestamp":"2026-06-11T11:16:40.019911Z","event_name":"network_connection","src_ip":"10.0.4.20","dst_ip":"8.8.8.8","dst_port":443,"protocol":"TCP","bytes_sent":29936,"bytes_recv":6734,"action":"allowed","firewall_rule":"ALLOW-OUT-150"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0179","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-11T11:44:31.430862Z","entities":[{"entityId":"host:WKSTN-06","type":"host","rawValue":"WKSTN-06","normalizedValue":"WKSTN-06","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0179","role":"host"},{"entityId":"user:glee","type":"user","rawValue":"glee","normalizedValue":"glee","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0179","role":"actor_user"},{"entityId":"process:WKSTN-06:6493","type":"process","rawValue":"6493","normalizedValue":"6493","normalizationMethod":"verbatim","sourceObservationId":"EVT-0179","role":"process"}],"attributes":{"hostname":"WKSTN-06","username":"glee","process_name":"teams.exe","parent_process":"explorer.exe","process_path":"C:\\Program Files\\Microsoft\\","command_line":"","pid":6493,"integrity_level":"medium"},"raw":{"event_id":"EVT-0179","source_type":"endpoint","timestamp":"2026-06-11T11:44:31.430862Z","event_name":"process_create","hostname":"WKSTN-06","username":"glee","process_name":"teams.exe","parent_process":"explorer.exe","process_path":"C:\\Program Files\\Microsoft\\","command_line":"","pid":6493,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0044","sourceType":"auth","eventType":"user_logoff","timestamp":"2026-06-11T11:46:02.176941Z","entities":[{"entityId":"user:jclark","type":"user","rawValue":"jclark","normalizedValue":"jclark","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0044","role":"actor_user"},{"entityId":"host:WKSTN-05","type":"host","rawValue":"WKSTN-05","normalizedValue":"WKSTN-05","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0044","role":"source_host"},{"entityId":"host:AUTH-SRV-01","type":"host","rawValue":"AUTH-SRV-01","normalizedValue":"AUTH-SRV-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0044","role":"dest_host"},{"entityId":"ipv4:10.0.1.55","type":"ipv4","rawValue":"10.0.1.55","normalizedValue":"10.0.1.55","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0044","role":"source_ip"}],"attributes":{"username":"jclark","source_host":"WKSTN-05","dest_host":"AUTH-SRV-01","logon_type":"remote_interactive","result":"failure","source_ip":"10.0.1.55"},"raw":{"event_id":"EVT-0044","source_type":"auth","timestamp":"2026-06-11T11:46:02.176941Z","event_name":"user_logoff","username":"jclark","source_host":"WKSTN-05","dest_host":"AUTH-SRV-01","logon_type":"remote_interactive","result":"failure","source_ip":"10.0.1.55"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0026","sourceType":"auth","eventType":"user_logoff","timestamp":"2026-06-11T11:50:35.135756Z","entities":[{"entityId":"user:jclark","type":"user","rawValue":"jclark","normalizedValue":"jclark","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0026","role":"actor_user"},{"entityId":"host:WKSTN-01","type":"host","rawValue":"WKSTN-01","normalizedValue":"WKSTN-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0026","role":"source_host"},{"entityId":"host:AUTH-SRV-02","type":"host","rawValue":"AUTH-SRV-02","normalizedValue":"AUTH-SRV-02","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0026","role":"dest_host"},{"entityId":"ipv4:10.0.5.11","type":"ipv4","rawValue":"10.0.5.11","normalizedValue":"10.0.5.11","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0026","role":"source_ip"}],"attributes":{"username":"jclark","source_host":"WKSTN-01","dest_host":"AUTH-SRV-02","logon_type":"remote_interactive","result":"success","source_ip":"10.0.5.11"},"raw":{"event_id":"EVT-0026","source_type":"auth","timestamp":"2026-06-11T11:50:35.135756Z","event_name":"user_logoff","username":"jclark","source_host":"WKSTN-01","dest_host":"AUTH-SRV-02","logon_type":"remote_interactive","result":"success","source_ip":"10.0.5.11"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0059","sourceType":"auth","eventType":"failed_logon","timestamp":"2026-06-11T12:01:42.212359Z","entities":[{"entityId":"user:dtaylor","type":"user","rawValue":"dtaylor","normalizedValue":"dtaylor","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0059","role":"actor_user"},{"entityId":"host:WKSTN-06","type":"host","rawValue":"WKSTN-06","normalizedValue":"WKSTN-06","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0059","role":"source_host"},{"entityId":"host:AUTH-SRV-02","type":"host","rawValue":"AUTH-SRV-02","normalizedValue":"AUTH-SRV-02","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0059","role":"dest_host"},{"entityId":"ipv4:10.0.4.207","type":"ipv4","rawValue":"10.0.4.207","normalizedValue":"10.0.4.207","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0059","role":"source_ip"}],"attributes":{"username":"dtaylor","source_host":"WKSTN-06","dest_host":"AUTH-SRV-02","logon_type":"remote_interactive","result":"success","source_ip":"10.0.4.207"},"raw":{"event_id":"EVT-0059","source_type":"auth","timestamp":"2026-06-11T12:01:42.212359Z","event_name":"failed_logon","username":"dtaylor","source_host":"WKSTN-06","dest_host":"AUTH-SRV-02","logon_type":"remote_interactive","result":"success","source_ip":"10.0.4.207"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0171","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-11T12:29:43.990005Z","entities":[{"entityId":"host:WKSTN-01","type":"host","rawValue":"WKSTN-01","normalizedValue":"WKSTN-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0171","role":"host"},{"entityId":"user:dtaylor","type":"user","rawValue":"dtaylor","normalizedValue":"dtaylor","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0171","role":"actor_user"},{"entityId":"process:WKSTN-01:4253","type":"process","rawValue":"4253","normalizedValue":"4253","normalizationMethod":"verbatim","sourceObservationId":"EVT-0171","role":"process"}],"attributes":{"hostname":"WKSTN-01","username":"dtaylor","process_name":"notepad.exe","parent_process":"outlook.exe","process_path":"C:\\Program Files\\Microsoft\\","command_line":"","pid":4253,"integrity_level":"medium"},"raw":{"event_id":"EVT-0171","source_type":"endpoint","timestamp":"2026-06-11T12:29:43.990005Z","event_name":"process_create","hostname":"WKSTN-01","username":"dtaylor","process_name":"notepad.exe","parent_process":"outlook.exe","process_path":"C:\\Program Files\\Microsoft\\","command_line":"","pid":4253,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0128","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-11T12:31:15.304298Z","entities":[{"entityId":"ipv4:10.0.3.21","type":"ipv4","rawValue":"10.0.3.21","normalizedValue":"10.0.3.21","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0128","role":"src_ip"},{"entityId":"ipv4:10.0.3.18","type":"ipv4","rawValue":"10.0.3.18","normalizedValue":"10.0.3.18","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0128","role":"dst_ip"},{"entityId":"endpoint:10.0.3.18:53","type":"endpoint","rawValue":"10.0.3.18:53","normalizedValue":"10.0.3.18:53","normalizationMethod":"verbatim","sourceObservationId":"EVT-0128","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.3.21","dst_ip":"10.0.3.18","dst_port":53,"protocol":"UDP","bytes_sent":37204,"bytes_recv":65829,"action":"allowed","firewall_rule":"ALLOW-OUT-194"},"raw":{"event_id":"EVT-0128","source_type":"network","timestamp":"2026-06-11T12:31:15.304298Z","event_name":"network_connection","src_ip":"10.0.3.21","dst_ip":"10.0.3.18","dst_port":53,"protocol":"UDP","bytes_sent":37204,"bytes_recv":65829,"action":"allowed","firewall_rule":"ALLOW-OUT-194"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0202","sourceType":"cloud_storage","eventType":"file_share","timestamp":"2026-06-11T12:46:27.752751Z","entities":[{"entityId":"user:cjohnson","type":"user","rawValue":"cjohnson","normalizedValue":"cjohnson","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0202","role":"actor_user"},{"entityId":"ipv4:10.0.5.22","type":"ipv4","rawValue":"10.0.5.22","normalizedValue":"10.0.5.22","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0202","role":"source_ip"},{"entityId":"bucket:corp-documents","type":"bucket","rawValue":"corp-documents","normalizedValue":"corp-documents","normalizationMethod":"verbatim","sourceObservationId":"EVT-0202","role":"bucket"},{"entityId":"cloud_object:corp-documents/Client_Proposal_Acme.docx","type":"cloud_object","rawValue":"corp-documents/Client_Proposal_Acme.docx","normalizedValue":"corp-documents/Client_Proposal_Acme.docx","normalizationMethod":"verbatim","sourceObservationId":"EVT-0202","role":"cloud_object"}],"attributes":{"username":"cjohnson","source_ip":"10.0.5.22","file_name":"Client_Proposal_Acme.docx","file_size_bytes":198441,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"raw":{"event_id":"EVT-0202","source_type":"cloud_storage","timestamp":"2026-06-11T12:46:27.752751Z","event_name":"file_share","username":"cjohnson","source_ip":"10.0.5.22","file_name":"Client_Proposal_Acme.docx","file_size_bytes":198441,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0189","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-11T13:18:47.088963Z","entities":[{"entityId":"host:WKSTN-10","type":"host","rawValue":"WKSTN-10","normalizedValue":"WKSTN-10","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0189","role":"host"},{"entityId":"user:asmith","type":"user","rawValue":"asmith","normalizedValue":"asmith","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0189","role":"actor_user"},{"entityId":"process:WKSTN-10:8796","type":"process","rawValue":"8796","normalizedValue":"8796","normalizationMethod":"verbatim","sourceObservationId":"EVT-0189","role":"process"}],"attributes":{"hostname":"WKSTN-10","username":"asmith","process_name":"slack.exe","parent_process":"explorer.exe","process_path":"C:\\Program Files\\Google\\","command_line":"","pid":8796,"integrity_level":"medium"},"raw":{"event_id":"EVT-0189","source_type":"endpoint","timestamp":"2026-06-11T13:18:47.088963Z","event_name":"process_create","hostname":"WKSTN-10","username":"asmith","process_name":"slack.exe","parent_process":"explorer.exe","process_path":"C:\\Program Files\\Google\\","command_line":"","pid":8796,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0203","sourceType":"cloud_storage","eventType":"file_share","timestamp":"2026-06-11T13:56:04.379651Z","entities":[{"entityId":"user:asmith","type":"user","rawValue":"asmith","normalizedValue":"asmith","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0203","role":"actor_user"},{"entityId":"ipv4:10.0.4.10","type":"ipv4","rawValue":"10.0.4.10","normalizedValue":"10.0.4.10","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0203","role":"source_ip"},{"entityId":"bucket:corp-documents","type":"bucket","rawValue":"corp-documents","normalizedValue":"corp-documents","normalizationMethod":"verbatim","sourceObservationId":"EVT-0203","role":"bucket"},{"entityId":"cloud_object:corp-documents/Product_Roadmap_v3.pptx","type":"cloud_object","rawValue":"corp-documents/Product_Roadmap_v3.pptx","normalizedValue":"corp-documents/Product_Roadmap_v3.pptx","normalizationMethod":"verbatim","sourceObservationId":"EVT-0203","role":"cloud_object"}],"attributes":{"username":"asmith","source_ip":"10.0.4.10","file_name":"Product_Roadmap_v3.pptx","file_size_bytes":2407399,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"raw":{"event_id":"EVT-0203","source_type":"cloud_storage","timestamp":"2026-06-11T13:56:04.379651Z","event_name":"file_share","username":"asmith","source_ip":"10.0.4.10","file_name":"Product_Roadmap_v3.pptx","file_size_bytes":2407399,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0144","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-11T14:27:41.334185Z","entities":[{"entityId":"host:WKSTN-01","type":"host","rawValue":"WKSTN-01","normalizedValue":"WKSTN-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0144","role":"host"},{"entityId":"user:jclark","type":"user","rawValue":"jclark","normalizedValue":"jclark","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0144","role":"actor_user"},{"entityId":"process:WKSTN-01:9736","type":"process","rawValue":"9736","normalizedValue":"9736","normalizationMethod":"verbatim","sourceObservationId":"EVT-0144","role":"process"}],"attributes":{"hostname":"WKSTN-01","username":"jclark","process_name":"explorer.exe","parent_process":"outlook.exe","process_path":"C:\\Program Files\\Microsoft\\","command_line":"","pid":9736,"integrity_level":"medium"},"raw":{"event_id":"EVT-0144","source_type":"endpoint","timestamp":"2026-06-11T14:27:41.334185Z","event_name":"process_create","hostname":"WKSTN-01","username":"jclark","process_name":"explorer.exe","parent_process":"outlook.exe","process_path":"C:\\Program Files\\Microsoft\\","command_line":"","pid":9736,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0166","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-11T14:30:37.545256Z","entities":[{"entityId":"host:WKSTN-04","type":"host","rawValue":"WKSTN-04","normalizedValue":"WKSTN-04","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0166","role":"host"},{"entityId":"user:glee","type":"user","rawValue":"glee","normalizedValue":"glee","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0166","role":"actor_user"},{"entityId":"process:WKSTN-04:2244","type":"process","rawValue":"2244","normalizedValue":"2244","normalizationMethod":"verbatim","sourceObservationId":"EVT-0166","role":"process"}],"attributes":{"hostname":"WKSTN-04","username":"glee","process_name":"word.exe","parent_process":"teams.exe","process_path":"C:\\Program Files\\Google\\","command_line":"","pid":2244,"integrity_level":"medium"},"raw":{"event_id":"EVT-0166","source_type":"endpoint","timestamp":"2026-06-11T14:30:37.545256Z","event_name":"process_create","hostname":"WKSTN-04","username":"glee","process_name":"word.exe","parent_process":"teams.exe","process_path":"C:\\Program Files\\Google\\","command_line":"","pid":2244,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0099","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-11T14:41:08.113530Z","entities":[{"entityId":"ipv4:10.0.1.13","type":"ipv4","rawValue":"10.0.1.13","normalizedValue":"10.0.1.13","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0099","role":"src_ip"},{"entityId":"ipv4:10.0.4.12","type":"ipv4","rawValue":"10.0.4.12","normalizedValue":"10.0.4.12","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0099","role":"dst_ip"},{"entityId":"endpoint:10.0.4.12:22","type":"endpoint","rawValue":"10.0.4.12:22","normalizedValue":"10.0.4.12:22","normalizationMethod":"verbatim","sourceObservationId":"EVT-0099","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.1.13","dst_ip":"10.0.4.12","dst_port":22,"protocol":"UDP","bytes_sent":28367,"bytes_recv":148145,"action":"allowed","firewall_rule":"ALLOW-OUT-156"},"raw":{"event_id":"EVT-0099","source_type":"network","timestamp":"2026-06-11T14:41:08.113530Z","event_name":"network_connection","src_ip":"10.0.1.13","dst_ip":"10.0.4.12","dst_port":22,"protocol":"UDP","bytes_sent":28367,"bytes_recv":148145,"action":"allowed","firewall_rule":"ALLOW-OUT-156"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0137","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-11T14:45:34.167799Z","entities":[{"entityId":"ipv4:10.0.1.20","type":"ipv4","rawValue":"10.0.1.20","normalizedValue":"10.0.1.20","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0137","role":"src_ip"},{"entityId":"ipv4:10.0.3.27","type":"ipv4","rawValue":"10.0.3.27","normalizedValue":"10.0.3.27","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0137","role":"dst_ip"},{"entityId":"endpoint:10.0.3.27:53","type":"endpoint","rawValue":"10.0.3.27:53","normalizedValue":"10.0.3.27:53","normalizationMethod":"verbatim","sourceObservationId":"EVT-0137","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.1.20","dst_ip":"10.0.3.27","dst_port":53,"protocol":"TCP","bytes_sent":34757,"bytes_recv":57365,"action":"allowed","firewall_rule":"ALLOW-OUT-182"},"raw":{"event_id":"EVT-0137","source_type":"network","timestamp":"2026-06-11T14:45:34.167799Z","event_name":"network_connection","src_ip":"10.0.1.20","dst_ip":"10.0.3.27","dst_port":53,"protocol":"TCP","bytes_sent":34757,"bytes_recv":57365,"action":"allowed","firewall_rule":"ALLOW-OUT-182"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0127","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-11T15:04:19.669750Z","entities":[{"entityId":"ipv4:10.0.5.29","type":"ipv4","rawValue":"10.0.5.29","normalizedValue":"10.0.5.29","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0127","role":"src_ip"},{"entityId":"ipv4:10.0.1.26","type":"ipv4","rawValue":"10.0.1.26","normalizedValue":"10.0.1.26","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0127","role":"dst_ip"},{"entityId":"endpoint:10.0.1.26:443","type":"endpoint","rawValue":"10.0.1.26:443","normalizedValue":"10.0.1.26:443","normalizationMethod":"verbatim","sourceObservationId":"EVT-0127","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.5.29","dst_ip":"10.0.1.26","dst_port":443,"protocol":"TCP","bytes_sent":46522,"bytes_recv":197179,"action":"allowed","firewall_rule":"ALLOW-OUT-135"},"raw":{"event_id":"EVT-0127","source_type":"network","timestamp":"2026-06-11T15:04:19.669750Z","event_name":"network_connection","src_ip":"10.0.5.29","dst_ip":"10.0.1.26","dst_port":443,"protocol":"TCP","bytes_sent":46522,"bytes_recv":197179,"action":"allowed","firewall_rule":"ALLOW-OUT-135"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0220","sourceType":"cloud_storage","eventType":"file_share","timestamp":"2026-06-11T15:09:41.137709Z","entities":[{"entityId":"user:iharris","type":"user","rawValue":"iharris","normalizedValue":"iharris","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0220","role":"actor_user"},{"entityId":"ipv4:10.0.2.19","type":"ipv4","rawValue":"10.0.2.19","normalizedValue":"10.0.2.19","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0220","role":"source_ip"},{"entityId":"bucket:corp-documents","type":"bucket","rawValue":"corp-documents","normalizedValue":"corp-documents","normalizationMethod":"verbatim","sourceObservationId":"EVT-0220","role":"bucket"},{"entityId":"cloud_object:corp-documents/Client_Proposal_Acme.docx","type":"cloud_object","rawValue":"corp-documents/Client_Proposal_Acme.docx","normalizedValue":"corp-documents/Client_Proposal_Acme.docx","normalizationMethod":"verbatim","sourceObservationId":"EVT-0220","role":"cloud_object"}],"attributes":{"username":"iharris","source_ip":"10.0.2.19","file_name":"Client_Proposal_Acme.docx","file_size_bytes":3614950,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"raw":{"event_id":"EVT-0220","source_type":"cloud_storage","timestamp":"2026-06-11T15:09:41.137709Z","event_name":"file_share","username":"iharris","source_ip":"10.0.2.19","file_name":"Client_Proposal_Acme.docx","file_size_bytes":3614950,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0108","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-11T15:28:19.958592Z","entities":[{"entityId":"ipv4:10.0.4.12","type":"ipv4","rawValue":"10.0.4.12","normalizedValue":"10.0.4.12","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0108","role":"src_ip"},{"entityId":"ipv4:10.0.5.16","type":"ipv4","rawValue":"10.0.5.16","normalizedValue":"10.0.5.16","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0108","role":"dst_ip"},{"entityId":"endpoint:10.0.5.16:443","type":"endpoint","rawValue":"10.0.5.16:443","normalizedValue":"10.0.5.16:443","normalizationMethod":"verbatim","sourceObservationId":"EVT-0108","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.4.12","dst_ip":"10.0.5.16","dst_port":443,"protocol":"TCP","bytes_sent":21475,"bytes_recv":190376,"action":"allowed","firewall_rule":"ALLOW-OUT-134"},"raw":{"event_id":"EVT-0108","source_type":"network","timestamp":"2026-06-11T15:28:19.958592Z","event_name":"network_connection","src_ip":"10.0.4.12","dst_ip":"10.0.5.16","dst_port":443,"protocol":"TCP","bytes_sent":21475,"bytes_recv":190376,"action":"allowed","firewall_rule":"ALLOW-OUT-134"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0146","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-11T15:35:55.236814Z","entities":[{"entityId":"host:WKSTN-08","type":"host","rawValue":"WKSTN-08","normalizedValue":"WKSTN-08","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0146","role":"host"},{"entityId":"user:jclark","type":"user","rawValue":"jclark","normalizedValue":"jclark","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0146","role":"actor_user"},{"entityId":"process:WKSTN-08:3323","type":"process","rawValue":"3323","normalizedValue":"3323","normalizationMethod":"verbatim","sourceObservationId":"EVT-0146","role":"process"}],"attributes":{"hostname":"WKSTN-08","username":"jclark","process_name":"slack.exe","parent_process":"outlook.exe","process_path":"C:\\Program Files\\Microsoft\\","command_line":"","pid":3323,"integrity_level":"medium"},"raw":{"event_id":"EVT-0146","source_type":"endpoint","timestamp":"2026-06-11T15:35:55.236814Z","event_name":"process_create","hostname":"WKSTN-08","username":"jclark","process_name":"slack.exe","parent_process":"outlook.exe","process_path":"C:\\Program Files\\Microsoft\\","command_line":"","pid":3323,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0010","sourceType":"auth","eventType":"user_logon","timestamp":"2026-06-11T15:39:41.579066Z","entities":[{"entityId":"user:hwalker","type":"user","rawValue":"hwalker","normalizedValue":"hwalker","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0010","role":"actor_user"},{"entityId":"host:WKSTN-10","type":"host","rawValue":"WKSTN-10","normalizedValue":"WKSTN-10","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0010","role":"source_host"},{"entityId":"host:AUTH-SRV-01","type":"host","rawValue":"AUTH-SRV-01","normalizedValue":"AUTH-SRV-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0010","role":"dest_host"},{"entityId":"ipv4:10.0.1.12","type":"ipv4","rawValue":"10.0.1.12","normalizedValue":"10.0.1.12","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0010","role":"source_ip"}],"attributes":{"username":"hwalker","source_host":"WKSTN-10","dest_host":"AUTH-SRV-01","logon_type":"network","result":"success","source_ip":"10.0.1.12"},"raw":{"event_id":"EVT-0010","source_type":"auth","timestamp":"2026-06-11T15:39:41.579066Z","event_name":"user_logon","username":"hwalker","source_host":"WKSTN-10","dest_host":"AUTH-SRV-01","logon_type":"network","result":"success","source_ip":"10.0.1.12"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0063","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-11T16:01:55.100127Z","entities":[{"entityId":"ipv4:10.0.2.25","type":"ipv4","rawValue":"10.0.2.25","normalizedValue":"10.0.2.25","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0063","role":"src_ip"},{"entityId":"ipv4:10.0.4.14","type":"ipv4","rawValue":"10.0.4.14","normalizedValue":"10.0.4.14","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0063","role":"dst_ip"},{"entityId":"endpoint:10.0.4.14:443","type":"endpoint","rawValue":"10.0.4.14:443","normalizedValue":"10.0.4.14:443","normalizationMethod":"verbatim","sourceObservationId":"EVT-0063","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.2.25","dst_ip":"10.0.4.14","dst_port":443,"protocol":"TCP","bytes_sent":31129,"bytes_recv":130435,"action":"allowed","firewall_rule":"ALLOW-OUT-184"},"raw":{"event_id":"EVT-0063","source_type":"network","timestamp":"2026-06-11T16:01:55.100127Z","event_name":"network_connection","src_ip":"10.0.2.25","dst_ip":"10.0.4.14","dst_port":443,"protocol":"TCP","bytes_sent":31129,"bytes_recv":130435,"action":"allowed","firewall_rule":"ALLOW-OUT-184"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0173","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-11T16:31:53.576072Z","entities":[{"entityId":"host:WKSTN-04","type":"host","rawValue":"WKSTN-04","normalizedValue":"WKSTN-04","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0173","role":"host"},{"entityId":"user:bwilliams","type":"user","rawValue":"bwilliams","normalizedValue":"bwilliams","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0173","role":"actor_user"},{"entityId":"process:WKSTN-04:5341","type":"process","rawValue":"5341","normalizedValue":"5341","normalizationMethod":"verbatim","sourceObservationId":"EVT-0173","role":"process"}],"attributes":{"hostname":"WKSTN-04","username":"bwilliams","process_name":"teams.exe","parent_process":"teams.exe","process_path":"C:\\Program Files\\Microsoft\\","command_line":"","pid":5341,"integrity_level":"medium"},"raw":{"event_id":"EVT-0173","source_type":"endpoint","timestamp":"2026-06-11T16:31:53.576072Z","event_name":"process_create","hostname":"WKSTN-04","username":"bwilliams","process_name":"teams.exe","parent_process":"teams.exe","process_path":"C:\\Program Files\\Microsoft\\","command_line":"","pid":5341,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0147","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-11T16:38:31.959259Z","entities":[{"entityId":"host:WKSTN-09","type":"host","rawValue":"WKSTN-09","normalizedValue":"WKSTN-09","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0147","role":"host"},{"entityId":"user:fmartinez","type":"user","rawValue":"fmartinez","normalizedValue":"fmartinez","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0147","role":"actor_user"},{"entityId":"process:WKSTN-09:6515","type":"process","rawValue":"6515","normalizedValue":"6515","normalizationMethod":"verbatim","sourceObservationId":"EVT-0147","role":"process"}],"attributes":{"hostname":"WKSTN-09","username":"fmartinez","process_name":"slack.exe","parent_process":"outlook.exe","process_path":"C:\\Program Files\\Slack\\","command_line":"","pid":6515,"integrity_level":"medium"},"raw":{"event_id":"EVT-0147","source_type":"endpoint","timestamp":"2026-06-11T16:38:31.959259Z","event_name":"process_create","hostname":"WKSTN-09","username":"fmartinez","process_name":"slack.exe","parent_process":"outlook.exe","process_path":"C:\\Program Files\\Slack\\","command_line":"","pid":6515,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0050","sourceType":"auth","eventType":"failed_logon","timestamp":"2026-06-11T16:50:58.471757Z","entities":[{"entityId":"user:iharris","type":"user","rawValue":"iharris","normalizedValue":"iharris","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0050","role":"actor_user"},{"entityId":"host:WKSTN-09","type":"host","rawValue":"WKSTN-09","normalizedValue":"WKSTN-09","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0050","role":"source_host"},{"entityId":"host:AUTH-SRV-01","type":"host","rawValue":"AUTH-SRV-01","normalizedValue":"AUTH-SRV-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0050","role":"dest_host"},{"entityId":"ipv4:10.0.2.25","type":"ipv4","rawValue":"10.0.2.25","normalizedValue":"10.0.2.25","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0050","role":"source_ip"}],"attributes":{"username":"iharris","source_host":"WKSTN-09","dest_host":"AUTH-SRV-01","logon_type":"network","result":"success","source_ip":"10.0.2.25"},"raw":{"event_id":"EVT-0050","source_type":"auth","timestamp":"2026-06-11T16:50:58.471757Z","event_name":"failed_logon","username":"iharris","source_host":"WKSTN-09","dest_host":"AUTH-SRV-01","logon_type":"network","result":"success","source_ip":"10.0.2.25"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0118","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-11T16:54:50.880622Z","entities":[{"entityId":"ipv4:10.0.1.17","type":"ipv4","rawValue":"10.0.1.17","normalizedValue":"10.0.1.17","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0118","role":"src_ip"},{"entityId":"ipv4:10.0.3.11","type":"ipv4","rawValue":"10.0.3.11","normalizedValue":"10.0.3.11","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0118","role":"dst_ip"},{"entityId":"endpoint:10.0.3.11:443","type":"endpoint","rawValue":"10.0.3.11:443","normalizedValue":"10.0.3.11:443","normalizationMethod":"verbatim","sourceObservationId":"EVT-0118","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.1.17","dst_ip":"10.0.3.11","dst_port":443,"protocol":"TCP","bytes_sent":41133,"bytes_recv":101538,"action":"allowed","firewall_rule":"ALLOW-OUT-152"},"raw":{"event_id":"EVT-0118","source_type":"network","timestamp":"2026-06-11T16:54:50.880622Z","event_name":"network_connection","src_ip":"10.0.1.17","dst_ip":"10.0.3.11","dst_port":443,"protocol":"TCP","bytes_sent":41133,"bytes_recv":101538,"action":"allowed","firewall_rule":"ALLOW-OUT-152"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0158","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-11T17:07:26.334963Z","entities":[{"entityId":"host:WKSTN-04","type":"host","rawValue":"WKSTN-04","normalizedValue":"WKSTN-04","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0158","role":"host"},{"entityId":"user:iharris","type":"user","rawValue":"iharris","normalizedValue":"iharris","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0158","role":"actor_user"},{"entityId":"process:WKSTN-04:9163","type":"process","rawValue":"9163","normalizedValue":"9163","normalizationMethod":"verbatim","sourceObservationId":"EVT-0158","role":"process"}],"attributes":{"hostname":"WKSTN-04","username":"iharris","process_name":"outlook.exe","parent_process":"explorer.exe","process_path":"C:\\Program Files\\Microsoft\\","command_line":"","pid":9163,"integrity_level":"medium"},"raw":{"event_id":"EVT-0158","source_type":"endpoint","timestamp":"2026-06-11T17:07:26.334963Z","event_name":"process_create","hostname":"WKSTN-04","username":"iharris","process_name":"outlook.exe","parent_process":"explorer.exe","process_path":"C:\\Program Files\\Microsoft\\","command_line":"","pid":9163,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0043","sourceType":"auth","eventType":"user_logoff","timestamp":"2026-06-11T17:12:47.357821Z","entities":[{"entityId":"user:hwalker","type":"user","rawValue":"hwalker","normalizedValue":"hwalker","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0043","role":"actor_user"},{"entityId":"host:WKSTN-03","type":"host","rawValue":"WKSTN-03","normalizedValue":"WKSTN-03","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0043","role":"source_host"},{"entityId":"host:AUTH-SRV-02","type":"host","rawValue":"AUTH-SRV-02","normalizedValue":"AUTH-SRV-02","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0043","role":"dest_host"},{"entityId":"ipv4:10.0.1.192","type":"ipv4","rawValue":"10.0.1.192","normalizedValue":"10.0.1.192","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0043","role":"source_ip"}],"attributes":{"username":"hwalker","source_host":"WKSTN-03","dest_host":"AUTH-SRV-02","logon_type":"network","result":"success","source_ip":"10.0.1.192"},"raw":{"event_id":"EVT-0043","source_type":"auth","timestamp":"2026-06-11T17:12:47.357821Z","event_name":"user_logoff","username":"hwalker","source_host":"WKSTN-03","dest_host":"AUTH-SRV-02","logon_type":"network","result":"success","source_ip":"10.0.1.192"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0148","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-11T17:28:12.381788Z","entities":[{"entityId":"host:WKSTN-03","type":"host","rawValue":"WKSTN-03","normalizedValue":"WKSTN-03","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0148","role":"host"},{"entityId":"user:dtaylor","type":"user","rawValue":"dtaylor","normalizedValue":"dtaylor","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0148","role":"actor_user"},{"entityId":"process:WKSTN-03:5907","type":"process","rawValue":"5907","normalizedValue":"5907","normalizationMethod":"verbatim","sourceObservationId":"EVT-0148","role":"process"}],"attributes":{"hostname":"WKSTN-03","username":"dtaylor","process_name":"notepad.exe","parent_process":"teams.exe","process_path":"C:\\Program Files\\Microsoft\\","command_line":"","pid":5907,"integrity_level":"medium"},"raw":{"event_id":"EVT-0148","source_type":"endpoint","timestamp":"2026-06-11T17:28:12.381788Z","event_name":"process_create","hostname":"WKSTN-03","username":"dtaylor","process_name":"notepad.exe","parent_process":"teams.exe","process_path":"C:\\Program Files\\Microsoft\\","command_line":"","pid":5907,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0217","sourceType":"cloud_storage","eventType":"file_share","timestamp":"2026-06-11T18:06:53.786605Z","entities":[{"entityId":"user:glee","type":"user","rawValue":"glee","normalizedValue":"glee","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0217","role":"actor_user"},{"entityId":"ipv4:10.0.3.18","type":"ipv4","rawValue":"10.0.3.18","normalizedValue":"10.0.3.18","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0217","role":"source_ip"},{"entityId":"bucket:corp-documents","type":"bucket","rawValue":"corp-documents","normalizedValue":"corp-documents","normalizationMethod":"verbatim","sourceObservationId":"EVT-0217","role":"bucket"},{"entityId":"cloud_object:corp-documents/Q2_Budget_Draft.xlsx","type":"cloud_object","rawValue":"corp-documents/Q2_Budget_Draft.xlsx","normalizedValue":"corp-documents/Q2_Budget_Draft.xlsx","normalizationMethod":"verbatim","sourceObservationId":"EVT-0217","role":"cloud_object"}],"attributes":{"username":"glee","source_ip":"10.0.3.18","file_name":"Q2_Budget_Draft.xlsx","file_size_bytes":637246,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"raw":{"event_id":"EVT-0217","source_type":"cloud_storage","timestamp":"2026-06-11T18:06:53.786605Z","event_name":"file_share","username":"glee","source_ip":"10.0.3.18","file_name":"Q2_Budget_Draft.xlsx","file_size_bytes":637246,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0157","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-11T18:10:19.904909Z","entities":[{"entityId":"host:WKSTN-06","type":"host","rawValue":"WKSTN-06","normalizedValue":"WKSTN-06","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0157","role":"host"},{"entityId":"user:dtaylor","type":"user","rawValue":"dtaylor","normalizedValue":"dtaylor","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0157","role":"actor_user"},{"entityId":"process:WKSTN-06:5459","type":"process","rawValue":"5459","normalizedValue":"5459","normalizationMethod":"verbatim","sourceObservationId":"EVT-0157","role":"process"}],"attributes":{"hostname":"WKSTN-06","username":"dtaylor","process_name":"notepad.exe","parent_process":"teams.exe","process_path":"C:\\Program Files\\Google\\","command_line":"","pid":5459,"integrity_level":"medium"},"raw":{"event_id":"EVT-0157","source_type":"endpoint","timestamp":"2026-06-11T18:10:19.904909Z","event_name":"process_create","hostname":"WKSTN-06","username":"dtaylor","process_name":"notepad.exe","parent_process":"teams.exe","process_path":"C:\\Program Files\\Google\\","command_line":"","pid":5459,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0164","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-11T18:39:09.582038Z","entities":[{"entityId":"host:WKSTN-06","type":"host","rawValue":"WKSTN-06","normalizedValue":"WKSTN-06","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0164","role":"host"},{"entityId":"user:cjohnson","type":"user","rawValue":"cjohnson","normalizedValue":"cjohnson","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0164","role":"actor_user"},{"entityId":"process:WKSTN-06:9802","type":"process","rawValue":"9802","normalizedValue":"9802","normalizationMethod":"verbatim","sourceObservationId":"EVT-0164","role":"process"}],"attributes":{"hostname":"WKSTN-06","username":"cjohnson","process_name":"slack.exe","parent_process":"explorer.exe","process_path":"C:\\Program Files\\Microsoft\\","command_line":"","pid":9802,"integrity_level":"medium"},"raw":{"event_id":"EVT-0164","source_type":"endpoint","timestamp":"2026-06-11T18:39:09.582038Z","event_name":"process_create","hostname":"WKSTN-06","username":"cjohnson","process_name":"slack.exe","parent_process":"explorer.exe","process_path":"C:\\Program Files\\Microsoft\\","command_line":"","pid":9802,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0058","sourceType":"auth","eventType":"user_logon","timestamp":"2026-06-11T19:26:53.798600Z","entities":[{"entityId":"user:jclark","type":"user","rawValue":"jclark","normalizedValue":"jclark","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0058","role":"actor_user"},{"entityId":"host:WKSTN-06","type":"host","rawValue":"WKSTN-06","normalizedValue":"WKSTN-06","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0058","role":"source_host"},{"entityId":"host:AUTH-SRV-02","type":"host","rawValue":"AUTH-SRV-02","normalizedValue":"AUTH-SRV-02","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0058","role":"dest_host"},{"entityId":"ipv4:10.0.2.198","type":"ipv4","rawValue":"10.0.2.198","normalizedValue":"10.0.2.198","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0058","role":"source_ip"}],"attributes":{"username":"jclark","source_host":"WKSTN-06","dest_host":"AUTH-SRV-02","logon_type":"network","result":"failure","source_ip":"10.0.2.198"},"raw":{"event_id":"EVT-0058","source_type":"auth","timestamp":"2026-06-11T19:26:53.798600Z","event_name":"user_logon","username":"jclark","source_host":"WKSTN-06","dest_host":"AUTH-SRV-02","logon_type":"network","result":"failure","source_ip":"10.0.2.198"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0177","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-11T19:33:50.203756Z","entities":[{"entityId":"host:WKSTN-06","type":"host","rawValue":"WKSTN-06","normalizedValue":"WKSTN-06","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0177","role":"host"},{"entityId":"user:iharris","type":"user","rawValue":"iharris","normalizedValue":"iharris","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0177","role":"actor_user"},{"entityId":"process:WKSTN-06:4780","type":"process","rawValue":"4780","normalizedValue":"4780","normalizationMethod":"verbatim","sourceObservationId":"EVT-0177","role":"process"}],"attributes":{"hostname":"WKSTN-06","username":"iharris","process_name":"word.exe","parent_process":"teams.exe","process_path":"C:\\Program Files\\Google\\","command_line":"","pid":4780,"integrity_level":"medium"},"raw":{"event_id":"EVT-0177","source_type":"endpoint","timestamp":"2026-06-11T19:33:50.203756Z","event_name":"process_create","hostname":"WKSTN-06","username":"iharris","process_name":"word.exe","parent_process":"teams.exe","process_path":"C:\\Program Files\\Google\\","command_line":"","pid":4780,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0047","sourceType":"auth","eventType":"failed_logon","timestamp":"2026-06-11T19:35:25.309741Z","entities":[{"entityId":"user:asmith","type":"user","rawValue":"asmith","normalizedValue":"asmith","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0047","role":"actor_user"},{"entityId":"host:WKSTN-02","type":"host","rawValue":"WKSTN-02","normalizedValue":"WKSTN-02","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0047","role":"source_host"},{"entityId":"host:AUTH-SRV-01","type":"host","rawValue":"AUTH-SRV-01","normalizedValue":"AUTH-SRV-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0047","role":"dest_host"},{"entityId":"ipv4:10.0.3.112","type":"ipv4","rawValue":"10.0.3.112","normalizedValue":"10.0.3.112","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0047","role":"source_ip"}],"attributes":{"username":"asmith","source_host":"WKSTN-02","dest_host":"AUTH-SRV-01","logon_type":"remote_interactive","result":"success","source_ip":"10.0.3.112"},"raw":{"event_id":"EVT-0047","source_type":"auth","timestamp":"2026-06-11T19:35:25.309741Z","event_name":"failed_logon","username":"asmith","source_host":"WKSTN-02","dest_host":"AUTH-SRV-01","logon_type":"remote_interactive","result":"success","source_ip":"10.0.3.112"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0049","sourceType":"auth","eventType":"user_logon","timestamp":"2026-06-11T19:46:43.199688Z","entities":[{"entityId":"user:asmith","type":"user","rawValue":"asmith","normalizedValue":"asmith","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0049","role":"actor_user"},{"entityId":"host:WKSTN-01","type":"host","rawValue":"WKSTN-01","normalizedValue":"WKSTN-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0049","role":"source_host"},{"entityId":"host:AUTH-SRV-01","type":"host","rawValue":"AUTH-SRV-01","normalizedValue":"AUTH-SRV-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0049","role":"dest_host"},{"entityId":"ipv4:10.0.4.53","type":"ipv4","rawValue":"10.0.4.53","normalizedValue":"10.0.4.53","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0049","role":"source_ip"}],"attributes":{"username":"asmith","source_host":"WKSTN-01","dest_host":"AUTH-SRV-01","logon_type":"interactive","result":"success","source_ip":"10.0.4.53"},"raw":{"event_id":"EVT-0049","source_type":"auth","timestamp":"2026-06-11T19:46:43.199688Z","event_name":"user_logon","username":"asmith","source_host":"WKSTN-01","dest_host":"AUTH-SRV-01","logon_type":"interactive","result":"success","source_ip":"10.0.4.53"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0129","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-11T19:57:16.622968Z","entities":[{"entityId":"ipv4:10.0.1.19","type":"ipv4","rawValue":"10.0.1.19","normalizedValue":"10.0.1.19","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0129","role":"src_ip"},{"entityId":"ipv4:10.0.2.29","type":"ipv4","rawValue":"10.0.2.29","normalizedValue":"10.0.2.29","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0129","role":"dst_ip"},{"entityId":"endpoint:10.0.2.29:443","type":"endpoint","rawValue":"10.0.2.29:443","normalizedValue":"10.0.2.29:443","normalizationMethod":"verbatim","sourceObservationId":"EVT-0129","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.1.19","dst_ip":"10.0.2.29","dst_port":443,"protocol":"TCP","bytes_sent":47944,"bytes_recv":60889,"action":"allowed","firewall_rule":"ALLOW-OUT-185"},"raw":{"event_id":"EVT-0129","source_type":"network","timestamp":"2026-06-11T19:57:16.622968Z","event_name":"network_connection","src_ip":"10.0.1.19","dst_ip":"10.0.2.29","dst_port":443,"protocol":"TCP","bytes_sent":47944,"bytes_recv":60889,"action":"allowed","firewall_rule":"ALLOW-OUT-185"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0197","sourceType":"cloud_storage","eventType":"file_download","timestamp":"2026-06-11T20:13:59.578650Z","entities":[{"entityId":"user:hwalker","type":"user","rawValue":"hwalker","normalizedValue":"hwalker","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0197","role":"actor_user"},{"entityId":"ipv4:10.0.1.27","type":"ipv4","rawValue":"10.0.1.27","normalizedValue":"10.0.1.27","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0197","role":"source_ip"},{"entityId":"bucket:corp-documents","type":"bucket","rawValue":"corp-documents","normalizedValue":"corp-documents","normalizationMethod":"verbatim","sourceObservationId":"EVT-0197","role":"bucket"},{"entityId":"cloud_object:corp-documents/Meeting_Notes_Jun10.docx","type":"cloud_object","rawValue":"corp-documents/Meeting_Notes_Jun10.docx","normalizedValue":"corp-documents/Meeting_Notes_Jun10.docx","normalizationMethod":"verbatim","sourceObservationId":"EVT-0197","role":"cloud_object"}],"attributes":{"username":"hwalker","source_ip":"10.0.1.27","file_name":"Meeting_Notes_Jun10.docx","file_size_bytes":3443163,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"raw":{"event_id":"EVT-0197","source_type":"cloud_storage","timestamp":"2026-06-11T20:13:59.578650Z","event_name":"file_download","username":"hwalker","source_ip":"10.0.1.27","file_name":"Meeting_Notes_Jun10.docx","file_size_bytes":3443163,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0093","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-11T20:36:15.876223Z","entities":[{"entityId":"ipv4:10.0.5.17","type":"ipv4","rawValue":"10.0.5.17","normalizedValue":"10.0.5.17","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0093","role":"src_ip"},{"entityId":"ipv4:10.0.1.18","type":"ipv4","rawValue":"10.0.1.18","normalizedValue":"10.0.1.18","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0093","role":"dst_ip"},{"entityId":"endpoint:10.0.1.18:80","type":"endpoint","rawValue":"10.0.1.18:80","normalizedValue":"10.0.1.18:80","normalizationMethod":"verbatim","sourceObservationId":"EVT-0093","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.5.17","dst_ip":"10.0.1.18","dst_port":80,"protocol":"TCP","bytes_sent":41069,"bytes_recv":57118,"action":"allowed","firewall_rule":"ALLOW-OUT-199"},"raw":{"event_id":"EVT-0093","source_type":"network","timestamp":"2026-06-11T20:36:15.876223Z","event_name":"network_connection","src_ip":"10.0.5.17","dst_ip":"10.0.1.18","dst_port":80,"protocol":"TCP","bytes_sent":41069,"bytes_recv":57118,"action":"allowed","firewall_rule":"ALLOW-OUT-199"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0154","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-11T20:48:14.324572Z","entities":[{"entityId":"host:WKSTN-08","type":"host","rawValue":"WKSTN-08","normalizedValue":"WKSTN-08","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0154","role":"host"},{"entityId":"user:fmartinez","type":"user","rawValue":"fmartinez","normalizedValue":"fmartinez","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0154","role":"actor_user"},{"entityId":"process:WKSTN-08:2796","type":"process","rawValue":"2796","normalizedValue":"2796","normalizationMethod":"verbatim","sourceObservationId":"EVT-0154","role":"process"}],"attributes":{"hostname":"WKSTN-08","username":"fmartinez","process_name":"word.exe","parent_process":"teams.exe","process_path":"C:\\Program Files\\Google\\","command_line":"","pid":2796,"integrity_level":"medium"},"raw":{"event_id":"EVT-0154","source_type":"endpoint","timestamp":"2026-06-11T20:48:14.324572Z","event_name":"process_create","hostname":"WKSTN-08","username":"fmartinez","process_name":"word.exe","parent_process":"teams.exe","process_path":"C:\\Program Files\\Google\\","command_line":"","pid":2796,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0098","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-11T20:51:38.739876Z","entities":[{"entityId":"ipv4:10.0.4.11","type":"ipv4","rawValue":"10.0.4.11","normalizedValue":"10.0.4.11","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0098","role":"src_ip"},{"entityId":"ipv4:10.0.2.10","type":"ipv4","rawValue":"10.0.2.10","normalizedValue":"10.0.2.10","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0098","role":"dst_ip"},{"entityId":"endpoint:10.0.2.10:80","type":"endpoint","rawValue":"10.0.2.10:80","normalizedValue":"10.0.2.10:80","normalizationMethod":"verbatim","sourceObservationId":"EVT-0098","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.4.11","dst_ip":"10.0.2.10","dst_port":80,"protocol":"TCP","bytes_sent":976,"bytes_recv":118270,"action":"allowed","firewall_rule":"ALLOW-OUT-108"},"raw":{"event_id":"EVT-0098","source_type":"network","timestamp":"2026-06-11T20:51:38.739876Z","event_name":"network_connection","src_ip":"10.0.4.11","dst_ip":"10.0.2.10","dst_port":80,"protocol":"TCP","bytes_sent":976,"bytes_recv":118270,"action":"allowed","firewall_rule":"ALLOW-OUT-108"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0021","sourceType":"auth","eventType":"user_logoff","timestamp":"2026-06-11T21:01:27.094565Z","entities":[{"entityId":"user:jclark","type":"user","rawValue":"jclark","normalizedValue":"jclark","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0021","role":"actor_user"},{"entityId":"host:WKSTN-06","type":"host","rawValue":"WKSTN-06","normalizedValue":"WKSTN-06","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0021","role":"source_host"},{"entityId":"host:AUTH-SRV-02","type":"host","rawValue":"AUTH-SRV-02","normalizedValue":"AUTH-SRV-02","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0021","role":"dest_host"},{"entityId":"ipv4:10.0.4.162","type":"ipv4","rawValue":"10.0.4.162","normalizedValue":"10.0.4.162","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0021","role":"source_ip"}],"attributes":{"username":"jclark","source_host":"WKSTN-06","dest_host":"AUTH-SRV-02","logon_type":"remote_interactive","result":"success","source_ip":"10.0.4.162"},"raw":{"event_id":"EVT-0021","source_type":"auth","timestamp":"2026-06-11T21:01:27.094565Z","event_name":"user_logoff","username":"jclark","source_host":"WKSTN-06","dest_host":"AUTH-SRV-02","logon_type":"remote_interactive","result":"success","source_ip":"10.0.4.162"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0134","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-11T21:15:40.924019Z","entities":[{"entityId":"ipv4:10.0.2.12","type":"ipv4","rawValue":"10.0.2.12","normalizedValue":"10.0.2.12","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0134","role":"src_ip"},{"entityId":"ipv4:10.0.2.21","type":"ipv4","rawValue":"10.0.2.21","normalizedValue":"10.0.2.21","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0134","role":"dst_ip"},{"entityId":"endpoint:10.0.2.21:443","type":"endpoint","rawValue":"10.0.2.21:443","normalizedValue":"10.0.2.21:443","normalizationMethod":"verbatim","sourceObservationId":"EVT-0134","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.2.12","dst_ip":"10.0.2.21","dst_port":443,"protocol":"UDP","bytes_sent":24000,"bytes_recv":135376,"action":"allowed","firewall_rule":"ALLOW-OUT-166"},"raw":{"event_id":"EVT-0134","source_type":"network","timestamp":"2026-06-11T21:15:40.924019Z","event_name":"network_connection","src_ip":"10.0.2.12","dst_ip":"10.0.2.21","dst_port":443,"protocol":"UDP","bytes_sent":24000,"bytes_recv":135376,"action":"allowed","firewall_rule":"ALLOW-OUT-166"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0041","sourceType":"auth","eventType":"failed_logon","timestamp":"2026-06-11T21:18:42.135724Z","entities":[{"entityId":"user:glee","type":"user","rawValue":"glee","normalizedValue":"glee","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0041","role":"actor_user"},{"entityId":"host:WKSTN-09","type":"host","rawValue":"WKSTN-09","normalizedValue":"WKSTN-09","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0041","role":"source_host"},{"entityId":"host:AUTH-SRV-01","type":"host","rawValue":"AUTH-SRV-01","normalizedValue":"AUTH-SRV-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0041","role":"dest_host"},{"entityId":"ipv4:10.0.3.172","type":"ipv4","rawValue":"10.0.3.172","normalizedValue":"10.0.3.172","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0041","role":"source_ip"}],"attributes":{"username":"glee","source_host":"WKSTN-09","dest_host":"AUTH-SRV-01","logon_type":"interactive","result":"success","source_ip":"10.0.3.172"},"raw":{"event_id":"EVT-0041","source_type":"auth","timestamp":"2026-06-11T21:18:42.135724Z","event_name":"failed_logon","username":"glee","source_host":"WKSTN-09","dest_host":"AUTH-SRV-01","logon_type":"interactive","result":"success","source_ip":"10.0.3.172"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0218","sourceType":"cloud_storage","eventType":"file_download","timestamp":"2026-06-11T21:23:11.638878Z","entities":[{"entityId":"user:cjohnson","type":"user","rawValue":"cjohnson","normalizedValue":"cjohnson","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0218","role":"actor_user"},{"entityId":"ipv4:10.0.3.22","type":"ipv4","rawValue":"10.0.3.22","normalizedValue":"10.0.3.22","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0218","role":"source_ip"},{"entityId":"bucket:corp-documents","type":"bucket","rawValue":"corp-documents","normalizedValue":"corp-documents","normalizationMethod":"verbatim","sourceObservationId":"EVT-0218","role":"bucket"},{"entityId":"cloud_object:corp-documents/Client_Proposal_Acme.docx","type":"cloud_object","rawValue":"corp-documents/Client_Proposal_Acme.docx","normalizedValue":"corp-documents/Client_Proposal_Acme.docx","normalizationMethod":"verbatim","sourceObservationId":"EVT-0218","role":"cloud_object"}],"attributes":{"username":"cjohnson","source_ip":"10.0.3.22","file_name":"Client_Proposal_Acme.docx","file_size_bytes":237843,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"raw":{"event_id":"EVT-0218","source_type":"cloud_storage","timestamp":"2026-06-11T21:23:11.638878Z","event_name":"file_download","username":"cjohnson","source_ip":"10.0.3.22","file_name":"Client_Proposal_Acme.docx","file_size_bytes":237843,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0117","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-11T21:27:27.580114Z","entities":[{"entityId":"ipv4:10.0.1.23","type":"ipv4","rawValue":"10.0.1.23","normalizedValue":"10.0.1.23","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0117","role":"src_ip"},{"entityId":"ipv4:10.0.1.18","type":"ipv4","rawValue":"10.0.1.18","normalizedValue":"10.0.1.18","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0117","role":"dst_ip"},{"entityId":"endpoint:10.0.1.18:80","type":"endpoint","rawValue":"10.0.1.18:80","normalizedValue":"10.0.1.18:80","normalizationMethod":"verbatim","sourceObservationId":"EVT-0117","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.1.23","dst_ip":"10.0.1.18","dst_port":80,"protocol":"UDP","bytes_sent":5904,"bytes_recv":153648,"action":"allowed","firewall_rule":"ALLOW-OUT-134"},"raw":{"event_id":"EVT-0117","source_type":"network","timestamp":"2026-06-11T21:27:27.580114Z","event_name":"network_connection","src_ip":"10.0.1.23","dst_ip":"10.0.1.18","dst_port":80,"protocol":"UDP","bytes_sent":5904,"bytes_recv":153648,"action":"allowed","firewall_rule":"ALLOW-OUT-134"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0003","sourceType":"auth","eventType":"user_logoff","timestamp":"2026-06-11T21:44:08.561917Z","entities":[{"entityId":"user:bwilliams","type":"user","rawValue":"bwilliams","normalizedValue":"bwilliams","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0003","role":"actor_user"},{"entityId":"host:WKSTN-01","type":"host","rawValue":"WKSTN-01","normalizedValue":"WKSTN-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0003","role":"source_host"},{"entityId":"host:AUTH-SRV-02","type":"host","rawValue":"AUTH-SRV-02","normalizedValue":"AUTH-SRV-02","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0003","role":"dest_host"},{"entityId":"ipv4:10.0.5.137","type":"ipv4","rawValue":"10.0.5.137","normalizedValue":"10.0.5.137","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0003","role":"source_ip"}],"attributes":{"username":"bwilliams","source_host":"WKSTN-01","dest_host":"AUTH-SRV-02","logon_type":"network","result":"success","source_ip":"10.0.5.137"},"raw":{"event_id":"EVT-0003","source_type":"auth","timestamp":"2026-06-11T21:44:08.561917Z","event_name":"user_logoff","username":"bwilliams","source_host":"WKSTN-01","dest_host":"AUTH-SRV-02","logon_type":"network","result":"success","source_ip":"10.0.5.137"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0182","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-11T21:49:25.220591Z","entities":[{"entityId":"host:WKSTN-06","type":"host","rawValue":"WKSTN-06","normalizedValue":"WKSTN-06","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0182","role":"host"},{"entityId":"user:jclark","type":"user","rawValue":"jclark","normalizedValue":"jclark","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0182","role":"actor_user"},{"entityId":"process:WKSTN-06:1723","type":"process","rawValue":"1723","normalizedValue":"1723","normalizationMethod":"verbatim","sourceObservationId":"EVT-0182","role":"process"}],"attributes":{"hostname":"WKSTN-06","username":"jclark","process_name":"word.exe","parent_process":"outlook.exe","process_path":"C:\\Program Files\\Slack\\","command_line":"","pid":1723,"integrity_level":"medium"},"raw":{"event_id":"EVT-0182","source_type":"endpoint","timestamp":"2026-06-11T21:49:25.220591Z","event_name":"process_create","hostname":"WKSTN-06","username":"jclark","process_name":"word.exe","parent_process":"outlook.exe","process_path":"C:\\Program Files\\Slack\\","command_line":"","pid":1723,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0156","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-11T22:30:09.186275Z","entities":[{"entityId":"host:WKSTN-02","type":"host","rawValue":"WKSTN-02","normalizedValue":"WKSTN-02","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0156","role":"host"},{"entityId":"user:jclark","type":"user","rawValue":"jclark","normalizedValue":"jclark","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0156","role":"actor_user"},{"entityId":"process:WKSTN-02:2934","type":"process","rawValue":"2934","normalizedValue":"2934","normalizationMethod":"verbatim","sourceObservationId":"EVT-0156","role":"process"}],"attributes":{"hostname":"WKSTN-02","username":"jclark","process_name":"excel.exe","parent_process":"explorer.exe","process_path":"C:\\Program Files\\Microsoft\\","command_line":"","pid":2934,"integrity_level":"medium"},"raw":{"event_id":"EVT-0156","source_type":"endpoint","timestamp":"2026-06-11T22:30:09.186275Z","event_name":"process_create","hostname":"WKSTN-02","username":"jclark","process_name":"excel.exe","parent_process":"explorer.exe","process_path":"C:\\Program Files\\Microsoft\\","command_line":"","pid":2934,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0075","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-11T23:15:10.853857Z","entities":[{"entityId":"ipv4:10.0.1.23","type":"ipv4","rawValue":"10.0.1.23","normalizedValue":"10.0.1.23","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0075","role":"src_ip"},{"entityId":"ipv4:151.101.65.140","type":"ipv4","rawValue":"151.101.65.140","normalizedValue":"151.101.65.140","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0075","role":"dst_ip"},{"entityId":"endpoint:151.101.65.140:443","type":"endpoint","rawValue":"151.101.65.140:443","normalizedValue":"151.101.65.140:443","normalizationMethod":"verbatim","sourceObservationId":"EVT-0075","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.1.23","dst_ip":"151.101.65.140","dst_port":443,"protocol":"UDP","bytes_sent":844,"bytes_recv":176320,"action":"allowed","firewall_rule":"ALLOW-OUT-174"},"raw":{"event_id":"EVT-0075","source_type":"network","timestamp":"2026-06-11T23:15:10.853857Z","event_name":"network_connection","src_ip":"10.0.1.23","dst_ip":"151.101.65.140","dst_port":443,"protocol":"UDP","bytes_sent":844,"bytes_recv":176320,"action":"allowed","firewall_rule":"ALLOW-OUT-174"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0163","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-11T23:36:10.574094Z","entities":[{"entityId":"host:WKSTN-05","type":"host","rawValue":"WKSTN-05","normalizedValue":"WKSTN-05","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0163","role":"host"},{"entityId":"user:bwilliams","type":"user","rawValue":"bwilliams","normalizedValue":"bwilliams","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0163","role":"actor_user"},{"entityId":"process:WKSTN-05:4775","type":"process","rawValue":"4775","normalizedValue":"4775","normalizationMethod":"verbatim","sourceObservationId":"EVT-0163","role":"process"}],"attributes":{"hostname":"WKSTN-05","username":"bwilliams","process_name":"chrome.exe","parent_process":"explorer.exe","process_path":"C:\\Program Files\\Microsoft\\","command_line":"","pid":4775,"integrity_level":"medium"},"raw":{"event_id":"EVT-0163","source_type":"endpoint","timestamp":"2026-06-11T23:36:10.574094Z","event_name":"process_create","hostname":"WKSTN-05","username":"bwilliams","process_name":"chrome.exe","parent_process":"explorer.exe","process_path":"C:\\Program Files\\Microsoft\\","command_line":"","pid":4775,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0065","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-11T23:37:02.311519Z","entities":[{"entityId":"ipv4:10.0.1.16","type":"ipv4","rawValue":"10.0.1.16","normalizedValue":"10.0.1.16","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0065","role":"src_ip"},{"entityId":"ipv4:10.0.2.24","type":"ipv4","rawValue":"10.0.2.24","normalizedValue":"10.0.2.24","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0065","role":"dst_ip"},{"entityId":"endpoint:10.0.2.24:25","type":"endpoint","rawValue":"10.0.2.24:25","normalizedValue":"10.0.2.24:25","normalizationMethod":"verbatim","sourceObservationId":"EVT-0065","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.1.16","dst_ip":"10.0.2.24","dst_port":25,"protocol":"UDP","bytes_sent":12303,"bytes_recv":158631,"action":"allowed","firewall_rule":"ALLOW-OUT-129"},"raw":{"event_id":"EVT-0065","source_type":"network","timestamp":"2026-06-11T23:37:02.311519Z","event_name":"network_connection","src_ip":"10.0.1.16","dst_ip":"10.0.2.24","dst_port":25,"protocol":"UDP","bytes_sent":12303,"bytes_recv":158631,"action":"allowed","firewall_rule":"ALLOW-OUT-129"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0169","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-11T23:56:24.035700Z","entities":[{"entityId":"host:WKSTN-10","type":"host","rawValue":"WKSTN-10","normalizedValue":"WKSTN-10","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0169","role":"host"},{"entityId":"user:dtaylor","type":"user","rawValue":"dtaylor","normalizedValue":"dtaylor","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0169","role":"actor_user"},{"entityId":"process:WKSTN-10:7640","type":"process","rawValue":"7640","normalizedValue":"7640","normalizationMethod":"verbatim","sourceObservationId":"EVT-0169","role":"process"}],"attributes":{"hostname":"WKSTN-10","username":"dtaylor","process_name":"outlook.exe","parent_process":"explorer.exe","process_path":"C:\\Program Files\\Google\\","command_line":"","pid":7640,"integrity_level":"medium"},"raw":{"event_id":"EVT-0169","source_type":"endpoint","timestamp":"2026-06-11T23:56:24.035700Z","event_name":"process_create","hostname":"WKSTN-10","username":"dtaylor","process_name":"outlook.exe","parent_process":"explorer.exe","process_path":"C:\\Program Files\\Google\\","command_line":"","pid":7640,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0102","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-11T23:58:24.349240Z","entities":[{"entityId":"ipv4:10.0.1.24","type":"ipv4","rawValue":"10.0.1.24","normalizedValue":"10.0.1.24","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0102","role":"src_ip"},{"entityId":"ipv4:10.0.3.10","type":"ipv4","rawValue":"10.0.3.10","normalizedValue":"10.0.3.10","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0102","role":"dst_ip"},{"entityId":"endpoint:10.0.3.10:25","type":"endpoint","rawValue":"10.0.3.10:25","normalizedValue":"10.0.3.10:25","normalizationMethod":"verbatim","sourceObservationId":"EVT-0102","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.1.24","dst_ip":"10.0.3.10","dst_port":25,"protocol":"TCP","bytes_sent":20617,"bytes_recv":112551,"action":"allowed","firewall_rule":"ALLOW-OUT-130"},"raw":{"event_id":"EVT-0102","source_type":"network","timestamp":"2026-06-11T23:58:24.349240Z","event_name":"network_connection","src_ip":"10.0.1.24","dst_ip":"10.0.3.10","dst_port":25,"protocol":"TCP","bytes_sent":20617,"bytes_recv":112551,"action":"allowed","firewall_rule":"ALLOW-OUT-130"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0056","sourceType":"auth","eventType":"user_logoff","timestamp":"2026-06-12T00:08:42.310238Z","entities":[{"entityId":"user:dtaylor","type":"user","rawValue":"dtaylor","normalizedValue":"dtaylor","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0056","role":"actor_user"},{"entityId":"host:WKSTN-06","type":"host","rawValue":"WKSTN-06","normalizedValue":"WKSTN-06","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0056","role":"source_host"},{"entityId":"host:AUTH-SRV-02","type":"host","rawValue":"AUTH-SRV-02","normalizedValue":"AUTH-SRV-02","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0056","role":"dest_host"},{"entityId":"ipv4:10.0.3.195","type":"ipv4","rawValue":"10.0.3.195","normalizedValue":"10.0.3.195","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0056","role":"source_ip"}],"attributes":{"username":"dtaylor","source_host":"WKSTN-06","dest_host":"AUTH-SRV-02","logon_type":"interactive","result":"success","source_ip":"10.0.3.195"},"raw":{"event_id":"EVT-0056","source_type":"auth","timestamp":"2026-06-12T00:08:42.310238Z","event_name":"user_logoff","username":"dtaylor","source_host":"WKSTN-06","dest_host":"AUTH-SRV-02","logon_type":"interactive","result":"success","source_ip":"10.0.3.195"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0219","sourceType":"cloud_storage","eventType":"file_share","timestamp":"2026-06-12T00:13:31.309003Z","entities":[{"entityId":"user:hwalker","type":"user","rawValue":"hwalker","normalizedValue":"hwalker","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0219","role":"actor_user"},{"entityId":"ipv4:10.0.3.23","type":"ipv4","rawValue":"10.0.3.23","normalizedValue":"10.0.3.23","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0219","role":"source_ip"},{"entityId":"bucket:corp-documents","type":"bucket","rawValue":"corp-documents","normalizedValue":"corp-documents","normalizationMethod":"verbatim","sourceObservationId":"EVT-0219","role":"bucket"},{"entityId":"cloud_object:corp-documents/Team_OKRs_2026.xlsx","type":"cloud_object","rawValue":"corp-documents/Team_OKRs_2026.xlsx","normalizedValue":"corp-documents/Team_OKRs_2026.xlsx","normalizationMethod":"verbatim","sourceObservationId":"EVT-0219","role":"cloud_object"}],"attributes":{"username":"hwalker","source_ip":"10.0.3.23","file_name":"Team_OKRs_2026.xlsx","file_size_bytes":4686737,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"raw":{"event_id":"EVT-0219","source_type":"cloud_storage","timestamp":"2026-06-12T00:13:31.309003Z","event_name":"file_share","username":"hwalker","source_ip":"10.0.3.23","file_name":"Team_OKRs_2026.xlsx","file_size_bytes":4686737,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0136","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-12T00:36:20.944073Z","entities":[{"entityId":"ipv4:10.0.1.25","type":"ipv4","rawValue":"10.0.1.25","normalizedValue":"10.0.1.25","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0136","role":"src_ip"},{"entityId":"ipv4:10.0.3.13","type":"ipv4","rawValue":"10.0.3.13","normalizedValue":"10.0.3.13","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0136","role":"dst_ip"},{"entityId":"endpoint:10.0.3.13:25","type":"endpoint","rawValue":"10.0.3.13:25","normalizedValue":"10.0.3.13:25","normalizationMethod":"verbatim","sourceObservationId":"EVT-0136","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.1.25","dst_ip":"10.0.3.13","dst_port":25,"protocol":"UDP","bytes_sent":4377,"bytes_recv":199536,"action":"allowed","firewall_rule":"ALLOW-OUT-155"},"raw":{"event_id":"EVT-0136","source_type":"network","timestamp":"2026-06-12T00:36:20.944073Z","event_name":"network_connection","src_ip":"10.0.1.25","dst_ip":"10.0.3.13","dst_port":25,"protocol":"UDP","bytes_sent":4377,"bytes_recv":199536,"action":"allowed","firewall_rule":"ALLOW-OUT-155"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0145","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-12T00:44:33.219009Z","entities":[{"entityId":"host:WKSTN-10","type":"host","rawValue":"WKSTN-10","normalizedValue":"WKSTN-10","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0145","role":"host"},{"entityId":"user:bwilliams","type":"user","rawValue":"bwilliams","normalizedValue":"bwilliams","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0145","role":"actor_user"},{"entityId":"process:WKSTN-10:6661","type":"process","rawValue":"6661","normalizedValue":"6661","normalizationMethod":"verbatim","sourceObservationId":"EVT-0145","role":"process"}],"attributes":{"hostname":"WKSTN-10","username":"bwilliams","process_name":"word.exe","parent_process":"outlook.exe","process_path":"C:\\Program Files\\Google\\","command_line":"","pid":6661,"integrity_level":"medium"},"raw":{"event_id":"EVT-0145","source_type":"endpoint","timestamp":"2026-06-12T00:44:33.219009Z","event_name":"process_create","hostname":"WKSTN-10","username":"bwilliams","process_name":"word.exe","parent_process":"outlook.exe","process_path":"C:\\Program Files\\Google\\","command_line":"","pid":6661,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0205","sourceType":"cloud_storage","eventType":"file_view","timestamp":"2026-06-12T00:48:18.537661Z","entities":[{"entityId":"user:ewhite","type":"user","rawValue":"ewhite","normalizedValue":"ewhite","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0205","role":"actor_user"},{"entityId":"ipv4:10.0.5.14","type":"ipv4","rawValue":"10.0.5.14","normalizedValue":"10.0.5.14","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0205","role":"source_ip"},{"entityId":"bucket:corp-documents","type":"bucket","rawValue":"corp-documents","normalizedValue":"corp-documents","normalizationMethod":"verbatim","sourceObservationId":"EVT-0205","role":"bucket"},{"entityId":"cloud_object:corp-documents/Q2_Budget_Draft.xlsx","type":"cloud_object","rawValue":"corp-documents/Q2_Budget_Draft.xlsx","normalizedValue":"corp-documents/Q2_Budget_Draft.xlsx","normalizationMethod":"verbatim","sourceObservationId":"EVT-0205","role":"cloud_object"}],"attributes":{"username":"ewhite","source_ip":"10.0.5.14","file_name":"Q2_Budget_Draft.xlsx","file_size_bytes":667047,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"raw":{"event_id":"EVT-0205","source_type":"cloud_storage","timestamp":"2026-06-12T00:48:18.537661Z","event_name":"file_view","username":"ewhite","source_ip":"10.0.5.14","file_name":"Q2_Budget_Draft.xlsx","file_size_bytes":667047,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0034","sourceType":"auth","eventType":"user_logoff","timestamp":"2026-06-12T00:56:43.536471Z","entities":[{"entityId":"user:asmith","type":"user","rawValue":"asmith","normalizedValue":"asmith","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0034","role":"actor_user"},{"entityId":"host:WKSTN-08","type":"host","rawValue":"WKSTN-08","normalizedValue":"WKSTN-08","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0034","role":"source_host"},{"entityId":"host:AUTH-SRV-01","type":"host","rawValue":"AUTH-SRV-01","normalizedValue":"AUTH-SRV-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0034","role":"dest_host"},{"entityId":"ipv4:10.0.3.82","type":"ipv4","rawValue":"10.0.3.82","normalizedValue":"10.0.3.82","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0034","role":"source_ip"}],"attributes":{"username":"asmith","source_host":"WKSTN-08","dest_host":"AUTH-SRV-01","logon_type":"network","result":"success","source_ip":"10.0.3.82"},"raw":{"event_id":"EVT-0034","source_type":"auth","timestamp":"2026-06-12T00:56:43.536471Z","event_name":"user_logoff","username":"asmith","source_host":"WKSTN-08","dest_host":"AUTH-SRV-01","logon_type":"network","result":"success","source_ip":"10.0.3.82"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0113","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-12T00:57:06.986281Z","entities":[{"entityId":"ipv4:10.0.3.25","type":"ipv4","rawValue":"10.0.3.25","normalizedValue":"10.0.3.25","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0113","role":"src_ip"},{"entityId":"ipv4:10.0.1.22","type":"ipv4","rawValue":"10.0.1.22","normalizedValue":"10.0.1.22","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0113","role":"dst_ip"},{"entityId":"endpoint:10.0.1.22:22","type":"endpoint","rawValue":"10.0.1.22:22","normalizedValue":"10.0.1.22:22","normalizationMethod":"verbatim","sourceObservationId":"EVT-0113","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.3.25","dst_ip":"10.0.1.22","dst_port":22,"protocol":"UDP","bytes_sent":19012,"bytes_recv":33244,"action":"allowed","firewall_rule":"ALLOW-OUT-162"},"raw":{"event_id":"EVT-0113","source_type":"network","timestamp":"2026-06-12T00:57:06.986281Z","event_name":"network_connection","src_ip":"10.0.3.25","dst_ip":"10.0.1.22","dst_port":22,"protocol":"UDP","bytes_sent":19012,"bytes_recv":33244,"action":"allowed","firewall_rule":"ALLOW-OUT-162"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0101","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-12T01:12:07.786552Z","entities":[{"entityId":"ipv4:10.0.2.18","type":"ipv4","rawValue":"10.0.2.18","normalizedValue":"10.0.2.18","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0101","role":"src_ip"},{"entityId":"ipv4:10.0.2.27","type":"ipv4","rawValue":"10.0.2.27","normalizedValue":"10.0.2.27","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0101","role":"dst_ip"},{"entityId":"endpoint:10.0.2.27:443","type":"endpoint","rawValue":"10.0.2.27:443","normalizedValue":"10.0.2.27:443","normalizationMethod":"verbatim","sourceObservationId":"EVT-0101","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.2.18","dst_ip":"10.0.2.27","dst_port":443,"protocol":"TCP","bytes_sent":24788,"bytes_recv":183009,"action":"allowed","firewall_rule":"ALLOW-OUT-181"},"raw":{"event_id":"EVT-0101","source_type":"network","timestamp":"2026-06-12T01:12:07.786552Z","event_name":"network_connection","src_ip":"10.0.2.18","dst_ip":"10.0.2.27","dst_port":443,"protocol":"TCP","bytes_sent":24788,"bytes_recv":183009,"action":"allowed","firewall_rule":"ALLOW-OUT-181"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0025","sourceType":"auth","eventType":"user_logoff","timestamp":"2026-06-12T01:40:25.507119Z","entities":[{"entityId":"user:hwalker","type":"user","rawValue":"hwalker","normalizedValue":"hwalker","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0025","role":"actor_user"},{"entityId":"host:WKSTN-03","type":"host","rawValue":"WKSTN-03","normalizedValue":"WKSTN-03","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0025","role":"source_host"},{"entityId":"host:AUTH-SRV-01","type":"host","rawValue":"AUTH-SRV-01","normalizedValue":"AUTH-SRV-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0025","role":"dest_host"},{"entityId":"ipv4:10.0.3.160","type":"ipv4","rawValue":"10.0.3.160","normalizedValue":"10.0.3.160","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0025","role":"source_ip"}],"attributes":{"username":"hwalker","source_host":"WKSTN-03","dest_host":"AUTH-SRV-01","logon_type":"network","result":"failure","source_ip":"10.0.3.160"},"raw":{"event_id":"EVT-0025","source_type":"auth","timestamp":"2026-06-12T01:40:25.507119Z","event_name":"user_logoff","username":"hwalker","source_host":"WKSTN-03","dest_host":"AUTH-SRV-01","logon_type":"network","result":"failure","source_ip":"10.0.3.160"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0053","sourceType":"auth","eventType":"user_logoff","timestamp":"2026-06-12T02:38:33.566378Z","entities":[{"entityId":"user:ewhite","type":"user","rawValue":"ewhite","normalizedValue":"ewhite","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0053","role":"actor_user"},{"entityId":"host:WKSTN-03","type":"host","rawValue":"WKSTN-03","normalizedValue":"WKSTN-03","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0053","role":"source_host"},{"entityId":"host:AUTH-SRV-01","type":"host","rawValue":"AUTH-SRV-01","normalizedValue":"AUTH-SRV-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0053","role":"dest_host"},{"entityId":"ipv4:10.0.4.205","type":"ipv4","rawValue":"10.0.4.205","normalizedValue":"10.0.4.205","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0053","role":"source_ip"}],"attributes":{"username":"ewhite","source_host":"WKSTN-03","dest_host":"AUTH-SRV-01","logon_type":"network","result":"success","source_ip":"10.0.4.205"},"raw":{"event_id":"EVT-0053","source_type":"auth","timestamp":"2026-06-12T02:38:33.566378Z","event_name":"user_logoff","username":"ewhite","source_host":"WKSTN-03","dest_host":"AUTH-SRV-01","logon_type":"network","result":"success","source_ip":"10.0.4.205"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0097","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-12T02:45:14.828451Z","entities":[{"entityId":"ipv4:10.0.4.11","type":"ipv4","rawValue":"10.0.4.11","normalizedValue":"10.0.4.11","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0097","role":"src_ip"},{"entityId":"ipv4:10.0.5.16","type":"ipv4","rawValue":"10.0.5.16","normalizedValue":"10.0.5.16","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0097","role":"dst_ip"},{"entityId":"endpoint:10.0.5.16:25","type":"endpoint","rawValue":"10.0.5.16:25","normalizedValue":"10.0.5.16:25","normalizationMethod":"verbatim","sourceObservationId":"EVT-0097","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.4.11","dst_ip":"10.0.5.16","dst_port":25,"protocol":"TCP","bytes_sent":13984,"bytes_recv":157086,"action":"allowed","firewall_rule":"ALLOW-OUT-128"},"raw":{"event_id":"EVT-0097","source_type":"network","timestamp":"2026-06-12T02:45:14.828451Z","event_name":"network_connection","src_ip":"10.0.4.11","dst_ip":"10.0.5.16","dst_port":25,"protocol":"TCP","bytes_sent":13984,"bytes_recv":157086,"action":"allowed","firewall_rule":"ALLOW-OUT-128"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0002","sourceType":"auth","eventType":"user_logoff","timestamp":"2026-06-12T02:59:42.234241Z","entities":[{"entityId":"user:cjohnson","type":"user","rawValue":"cjohnson","normalizedValue":"cjohnson","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0002","role":"actor_user"},{"entityId":"host:WKSTN-03","type":"host","rawValue":"WKSTN-03","normalizedValue":"WKSTN-03","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0002","role":"source_host"},{"entityId":"host:AUTH-SRV-02","type":"host","rawValue":"AUTH-SRV-02","normalizedValue":"AUTH-SRV-02","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0002","role":"dest_host"},{"entityId":"ipv4:10.0.5.26","type":"ipv4","rawValue":"10.0.5.26","normalizedValue":"10.0.5.26","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0002","role":"source_ip"}],"attributes":{"username":"cjohnson","source_host":"WKSTN-03","dest_host":"AUTH-SRV-02","logon_type":"remote_interactive","result":"success","source_ip":"10.0.5.26"},"raw":{"event_id":"EVT-0002","source_type":"auth","timestamp":"2026-06-12T02:59:42.234241Z","event_name":"user_logoff","username":"cjohnson","source_host":"WKSTN-03","dest_host":"AUTH-SRV-02","logon_type":"remote_interactive","result":"success","source_ip":"10.0.5.26"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0074","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-12T03:11:52.825935Z","entities":[{"entityId":"ipv4:10.0.4.24","type":"ipv4","rawValue":"10.0.4.24","normalizedValue":"10.0.4.24","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0074","role":"src_ip"},{"entityId":"ipv4:10.0.3.11","type":"ipv4","rawValue":"10.0.3.11","normalizedValue":"10.0.3.11","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0074","role":"dst_ip"},{"entityId":"endpoint:10.0.3.11:443","type":"endpoint","rawValue":"10.0.3.11:443","normalizedValue":"10.0.3.11:443","normalizationMethod":"verbatim","sourceObservationId":"EVT-0074","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.4.24","dst_ip":"10.0.3.11","dst_port":443,"protocol":"UDP","bytes_sent":12880,"bytes_recv":116410,"action":"allowed","firewall_rule":"ALLOW-OUT-182"},"raw":{"event_id":"EVT-0074","source_type":"network","timestamp":"2026-06-12T03:11:52.825935Z","event_name":"network_connection","src_ip":"10.0.4.24","dst_ip":"10.0.3.11","dst_port":443,"protocol":"UDP","bytes_sent":12880,"bytes_recv":116410,"action":"allowed","firewall_rule":"ALLOW-OUT-182"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0176","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-12T03:15:28.402358Z","entities":[{"entityId":"host:WKSTN-03","type":"host","rawValue":"WKSTN-03","normalizedValue":"WKSTN-03","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0176","role":"host"},{"entityId":"user:hwalker","type":"user","rawValue":"hwalker","normalizedValue":"hwalker","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0176","role":"actor_user"},{"entityId":"process:WKSTN-03:8230","type":"process","rawValue":"8230","normalizedValue":"8230","normalizationMethod":"verbatim","sourceObservationId":"EVT-0176","role":"process"}],"attributes":{"hostname":"WKSTN-03","username":"hwalker","process_name":"notepad.exe","parent_process":"outlook.exe","process_path":"C:\\Program Files\\Slack\\","command_line":"","pid":8230,"integrity_level":"medium"},"raw":{"event_id":"EVT-0176","source_type":"endpoint","timestamp":"2026-06-12T03:15:28.402358Z","event_name":"process_create","hostname":"WKSTN-03","username":"hwalker","process_name":"notepad.exe","parent_process":"outlook.exe","process_path":"C:\\Program Files\\Slack\\","command_line":"","pid":8230,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0104","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-12T03:16:40.664293Z","entities":[{"entityId":"ipv4:10.0.4.21","type":"ipv4","rawValue":"10.0.4.21","normalizedValue":"10.0.4.21","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0104","role":"src_ip"},{"entityId":"ipv4:10.0.4.14","type":"ipv4","rawValue":"10.0.4.14","normalizedValue":"10.0.4.14","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0104","role":"dst_ip"},{"entityId":"endpoint:10.0.4.14:443","type":"endpoint","rawValue":"10.0.4.14:443","normalizedValue":"10.0.4.14:443","normalizationMethod":"verbatim","sourceObservationId":"EVT-0104","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.4.21","dst_ip":"10.0.4.14","dst_port":443,"protocol":"UDP","bytes_sent":35448,"bytes_recv":109716,"action":"allowed","firewall_rule":"ALLOW-OUT-104"},"raw":{"event_id":"EVT-0104","source_type":"network","timestamp":"2026-06-12T03:16:40.664293Z","event_name":"network_connection","src_ip":"10.0.4.21","dst_ip":"10.0.4.14","dst_port":443,"protocol":"UDP","bytes_sent":35448,"bytes_recv":109716,"action":"allowed","firewall_rule":"ALLOW-OUT-104"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0081","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-12T03:40:17.529020Z","entities":[{"entityId":"ipv4:10.0.5.15","type":"ipv4","rawValue":"10.0.5.15","normalizedValue":"10.0.5.15","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0081","role":"src_ip"},{"entityId":"ipv4:10.0.5.22","type":"ipv4","rawValue":"10.0.5.22","normalizedValue":"10.0.5.22","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0081","role":"dst_ip"},{"entityId":"endpoint:10.0.5.22:80","type":"endpoint","rawValue":"10.0.5.22:80","normalizedValue":"10.0.5.22:80","normalizationMethod":"verbatim","sourceObservationId":"EVT-0081","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.5.15","dst_ip":"10.0.5.22","dst_port":80,"protocol":"UDP","bytes_sent":43219,"bytes_recv":106867,"action":"allowed","firewall_rule":"ALLOW-OUT-101"},"raw":{"event_id":"EVT-0081","source_type":"network","timestamp":"2026-06-12T03:40:17.529020Z","event_name":"network_connection","src_ip":"10.0.5.15","dst_ip":"10.0.5.22","dst_port":80,"protocol":"UDP","bytes_sent":43219,"bytes_recv":106867,"action":"allowed","firewall_rule":"ALLOW-OUT-101"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0135","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-12T04:00:39.646550Z","entities":[{"entityId":"ipv4:10.0.3.20","type":"ipv4","rawValue":"10.0.3.20","normalizedValue":"10.0.3.20","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0135","role":"src_ip"},{"entityId":"ipv4:10.0.4.17","type":"ipv4","rawValue":"10.0.4.17","normalizedValue":"10.0.4.17","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0135","role":"dst_ip"},{"entityId":"endpoint:10.0.4.17:80","type":"endpoint","rawValue":"10.0.4.17:80","normalizedValue":"10.0.4.17:80","normalizationMethod":"verbatim","sourceObservationId":"EVT-0135","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.3.20","dst_ip":"10.0.4.17","dst_port":80,"protocol":"TCP","bytes_sent":46934,"bytes_recv":180193,"action":"allowed","firewall_rule":"ALLOW-OUT-116"},"raw":{"event_id":"EVT-0135","source_type":"network","timestamp":"2026-06-12T04:00:39.646550Z","event_name":"network_connection","src_ip":"10.0.3.20","dst_ip":"10.0.4.17","dst_port":80,"protocol":"TCP","bytes_sent":46934,"bytes_recv":180193,"action":"allowed","firewall_rule":"ALLOW-OUT-116"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0200","sourceType":"cloud_storage","eventType":"file_upload","timestamp":"2026-06-12T04:20:27.971638Z","entities":[{"entityId":"user:jclark","type":"user","rawValue":"jclark","normalizedValue":"jclark","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0200","role":"actor_user"},{"entityId":"ipv4:10.0.1.29","type":"ipv4","rawValue":"10.0.1.29","normalizedValue":"10.0.1.29","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0200","role":"source_ip"},{"entityId":"bucket:corp-documents","type":"bucket","rawValue":"corp-documents","normalizedValue":"corp-documents","normalizationMethod":"verbatim","sourceObservationId":"EVT-0200","role":"bucket"},{"entityId":"cloud_object:corp-documents/Product_Roadmap_v3.pptx","type":"cloud_object","rawValue":"corp-documents/Product_Roadmap_v3.pptx","normalizedValue":"corp-documents/Product_Roadmap_v3.pptx","normalizationMethod":"verbatim","sourceObservationId":"EVT-0200","role":"cloud_object"}],"attributes":{"username":"jclark","source_ip":"10.0.1.29","file_name":"Product_Roadmap_v3.pptx","file_size_bytes":29871,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"raw":{"event_id":"EVT-0200","source_type":"cloud_storage","timestamp":"2026-06-12T04:20:27.971638Z","event_name":"file_upload","username":"jclark","source_ip":"10.0.1.29","file_name":"Product_Roadmap_v3.pptx","file_size_bytes":29871,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0068","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-12T04:40:04.900779Z","entities":[{"entityId":"ipv4:10.0.5.12","type":"ipv4","rawValue":"10.0.5.12","normalizedValue":"10.0.5.12","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0068","role":"src_ip"},{"entityId":"ipv4:10.0.5.13","type":"ipv4","rawValue":"10.0.5.13","normalizedValue":"10.0.5.13","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0068","role":"dst_ip"},{"entityId":"endpoint:10.0.5.13:80","type":"endpoint","rawValue":"10.0.5.13:80","normalizedValue":"10.0.5.13:80","normalizationMethod":"verbatim","sourceObservationId":"EVT-0068","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.5.12","dst_ip":"10.0.5.13","dst_port":80,"protocol":"TCP","bytes_sent":36115,"bytes_recv":188571,"action":"allowed","firewall_rule":"ALLOW-OUT-170"},"raw":{"event_id":"EVT-0068","source_type":"network","timestamp":"2026-06-12T04:40:04.900779Z","event_name":"network_connection","src_ip":"10.0.5.12","dst_ip":"10.0.5.13","dst_port":80,"protocol":"TCP","bytes_sent":36115,"bytes_recv":188571,"action":"allowed","firewall_rule":"ALLOW-OUT-170"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0115","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-12T05:12:48.010418Z","entities":[{"entityId":"ipv4:10.0.3.10","type":"ipv4","rawValue":"10.0.3.10","normalizedValue":"10.0.3.10","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0115","role":"src_ip"},{"entityId":"ipv4:10.0.4.18","type":"ipv4","rawValue":"10.0.4.18","normalizedValue":"10.0.4.18","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0115","role":"dst_ip"},{"entityId":"endpoint:10.0.4.18:443","type":"endpoint","rawValue":"10.0.4.18:443","normalizedValue":"10.0.4.18:443","normalizationMethod":"verbatim","sourceObservationId":"EVT-0115","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.3.10","dst_ip":"10.0.4.18","dst_port":443,"protocol":"TCP","bytes_sent":32087,"bytes_recv":81625,"action":"allowed","firewall_rule":"ALLOW-OUT-148"},"raw":{"event_id":"EVT-0115","source_type":"network","timestamp":"2026-06-12T05:12:48.010418Z","event_name":"network_connection","src_ip":"10.0.3.10","dst_ip":"10.0.4.18","dst_port":443,"protocol":"TCP","bytes_sent":32087,"bytes_recv":81625,"action":"allowed","firewall_rule":"ALLOW-OUT-148"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0062","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-12T06:00:13.395631Z","entities":[{"entityId":"ipv4:10.0.5.26","type":"ipv4","rawValue":"10.0.5.26","normalizedValue":"10.0.5.26","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0062","role":"src_ip"},{"entityId":"ipv4:10.0.2.20","type":"ipv4","rawValue":"10.0.2.20","normalizedValue":"10.0.2.20","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0062","role":"dst_ip"},{"entityId":"endpoint:10.0.2.20:53","type":"endpoint","rawValue":"10.0.2.20:53","normalizedValue":"10.0.2.20:53","normalizationMethod":"verbatim","sourceObservationId":"EVT-0062","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.5.26","dst_ip":"10.0.2.20","dst_port":53,"protocol":"TCP","bytes_sent":12779,"bytes_recv":188372,"action":"allowed","firewall_rule":"ALLOW-OUT-174"},"raw":{"event_id":"EVT-0062","source_type":"network","timestamp":"2026-06-12T06:00:13.395631Z","event_name":"network_connection","src_ip":"10.0.5.26","dst_ip":"10.0.2.20","dst_port":53,"protocol":"TCP","bytes_sent":12779,"bytes_recv":188372,"action":"allowed","firewall_rule":"ALLOW-OUT-174"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0055","sourceType":"auth","eventType":"user_logoff","timestamp":"2026-06-12T06:15:52.098136Z","entities":[{"entityId":"user:iharris","type":"user","rawValue":"iharris","normalizedValue":"iharris","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0055","role":"actor_user"},{"entityId":"host:WKSTN-05","type":"host","rawValue":"WKSTN-05","normalizedValue":"WKSTN-05","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0055","role":"source_host"},{"entityId":"host:AUTH-SRV-01","type":"host","rawValue":"AUTH-SRV-01","normalizedValue":"AUTH-SRV-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0055","role":"dest_host"},{"entityId":"ipv4:10.0.5.214","type":"ipv4","rawValue":"10.0.5.214","normalizedValue":"10.0.5.214","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0055","role":"source_ip"}],"attributes":{"username":"iharris","source_host":"WKSTN-05","dest_host":"AUTH-SRV-01","logon_type":"remote_interactive","result":"success","source_ip":"10.0.5.214"},"raw":{"event_id":"EVT-0055","source_type":"auth","timestamp":"2026-06-12T06:15:52.098136Z","event_name":"user_logoff","username":"iharris","source_host":"WKSTN-05","dest_host":"AUTH-SRV-01","logon_type":"remote_interactive","result":"success","source_ip":"10.0.5.214"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0012","sourceType":"auth","eventType":"user_logon","timestamp":"2026-06-12T06:32:59.499554Z","entities":[{"entityId":"user:iharris","type":"user","rawValue":"iharris","normalizedValue":"iharris","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0012","role":"actor_user"},{"entityId":"host:WKSTN-01","type":"host","rawValue":"WKSTN-01","normalizedValue":"WKSTN-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0012","role":"source_host"},{"entityId":"host:AUTH-SRV-01","type":"host","rawValue":"AUTH-SRV-01","normalizedValue":"AUTH-SRV-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0012","role":"dest_host"},{"entityId":"ipv4:10.0.1.94","type":"ipv4","rawValue":"10.0.1.94","normalizedValue":"10.0.1.94","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0012","role":"source_ip"}],"attributes":{"username":"iharris","source_host":"WKSTN-01","dest_host":"AUTH-SRV-01","logon_type":"network","result":"success","source_ip":"10.0.1.94"},"raw":{"event_id":"EVT-0012","source_type":"auth","timestamp":"2026-06-12T06:32:59.499554Z","event_name":"user_logon","username":"iharris","source_host":"WKSTN-01","dest_host":"AUTH-SRV-01","logon_type":"network","result":"success","source_ip":"10.0.1.94"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0114","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-12T07:55:54.736700Z","entities":[{"entityId":"ipv4:10.0.3.29","type":"ipv4","rawValue":"10.0.3.29","normalizedValue":"10.0.3.29","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0114","role":"src_ip"},{"entityId":"ipv4:10.0.2.29","type":"ipv4","rawValue":"10.0.2.29","normalizedValue":"10.0.2.29","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0114","role":"dst_ip"},{"entityId":"endpoint:10.0.2.29:443","type":"endpoint","rawValue":"10.0.2.29:443","normalizedValue":"10.0.2.29:443","normalizationMethod":"verbatim","sourceObservationId":"EVT-0114","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.3.29","dst_ip":"10.0.2.29","dst_port":443,"protocol":"UDP","bytes_sent":41406,"bytes_recv":116368,"action":"allowed","firewall_rule":"ALLOW-OUT-180"},"raw":{"event_id":"EVT-0114","source_type":"network","timestamp":"2026-06-12T07:55:54.736700Z","event_name":"network_connection","src_ip":"10.0.3.29","dst_ip":"10.0.2.29","dst_port":443,"protocol":"UDP","bytes_sent":41406,"bytes_recv":116368,"action":"allowed","firewall_rule":"ALLOW-OUT-180"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0077","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-12T08:06:15.898200Z","entities":[{"entityId":"ipv4:10.0.5.19","type":"ipv4","rawValue":"10.0.5.19","normalizedValue":"10.0.5.19","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0077","role":"src_ip"},{"entityId":"ipv4:10.0.1.28","type":"ipv4","rawValue":"10.0.1.28","normalizedValue":"10.0.1.28","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0077","role":"dst_ip"},{"entityId":"endpoint:10.0.1.28:22","type":"endpoint","rawValue":"10.0.1.28:22","normalizedValue":"10.0.1.28:22","normalizationMethod":"verbatim","sourceObservationId":"EVT-0077","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.5.19","dst_ip":"10.0.1.28","dst_port":22,"protocol":"UDP","bytes_sent":10153,"bytes_recv":16592,"action":"allowed","firewall_rule":"ALLOW-OUT-119"},"raw":{"event_id":"EVT-0077","source_type":"network","timestamp":"2026-06-12T08:06:15.898200Z","event_name":"network_connection","src_ip":"10.0.5.19","dst_ip":"10.0.1.28","dst_port":22,"protocol":"UDP","bytes_sent":10153,"bytes_recv":16592,"action":"allowed","firewall_rule":"ALLOW-OUT-119"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0185","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-12T08:16:33.013731Z","entities":[{"entityId":"host:WKSTN-04","type":"host","rawValue":"WKSTN-04","normalizedValue":"WKSTN-04","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0185","role":"host"},{"entityId":"user:hwalker","type":"user","rawValue":"hwalker","normalizedValue":"hwalker","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0185","role":"actor_user"},{"entityId":"process:WKSTN-04:5694","type":"process","rawValue":"5694","normalizedValue":"5694","normalizationMethod":"verbatim","sourceObservationId":"EVT-0185","role":"process"}],"attributes":{"hostname":"WKSTN-04","username":"hwalker","process_name":"chrome.exe","parent_process":"explorer.exe","process_path":"C:\\Program Files\\Google\\","command_line":"","pid":5694,"integrity_level":"medium"},"raw":{"event_id":"EVT-0185","source_type":"endpoint","timestamp":"2026-06-12T08:16:33.013731Z","event_name":"process_create","hostname":"WKSTN-04","username":"hwalker","process_name":"chrome.exe","parent_process":"explorer.exe","process_path":"C:\\Program Files\\Google\\","command_line":"","pid":5694,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0186","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-12T08:52:01.323938Z","entities":[{"entityId":"host:WKSTN-06","type":"host","rawValue":"WKSTN-06","normalizedValue":"WKSTN-06","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0186","role":"host"},{"entityId":"user:cjohnson","type":"user","rawValue":"cjohnson","normalizedValue":"cjohnson","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0186","role":"actor_user"},{"entityId":"process:WKSTN-06:2842","type":"process","rawValue":"2842","normalizedValue":"2842","normalizationMethod":"verbatim","sourceObservationId":"EVT-0186","role":"process"}],"attributes":{"hostname":"WKSTN-06","username":"cjohnson","process_name":"slack.exe","parent_process":"outlook.exe","process_path":"C:\\Program Files\\Google\\","command_line":"","pid":2842,"integrity_level":"medium"},"raw":{"event_id":"EVT-0186","source_type":"endpoint","timestamp":"2026-06-12T08:52:01.323938Z","event_name":"process_create","hostname":"WKSTN-06","username":"cjohnson","process_name":"slack.exe","parent_process":"outlook.exe","process_path":"C:\\Program Files\\Google\\","command_line":"","pid":2842,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0092","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-12T09:04:10.147368Z","entities":[{"entityId":"ipv4:10.0.3.12","type":"ipv4","rawValue":"10.0.3.12","normalizedValue":"10.0.3.12","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0092","role":"src_ip"},{"entityId":"ipv4:10.0.4.23","type":"ipv4","rawValue":"10.0.4.23","normalizedValue":"10.0.4.23","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0092","role":"dst_ip"},{"entityId":"endpoint:10.0.4.23:443","type":"endpoint","rawValue":"10.0.4.23:443","normalizedValue":"10.0.4.23:443","normalizationMethod":"verbatim","sourceObservationId":"EVT-0092","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.3.12","dst_ip":"10.0.4.23","dst_port":443,"protocol":"UDP","bytes_sent":38798,"bytes_recv":106117,"action":"allowed","firewall_rule":"ALLOW-OUT-136"},"raw":{"event_id":"EVT-0092","source_type":"network","timestamp":"2026-06-12T09:04:10.147368Z","event_name":"network_connection","src_ip":"10.0.3.12","dst_ip":"10.0.4.23","dst_port":443,"protocol":"UDP","bytes_sent":38798,"bytes_recv":106117,"action":"allowed","firewall_rule":"ALLOW-OUT-136"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0192","sourceType":"cloud_storage","eventType":"file_view","timestamp":"2026-06-12T09:04:13.235052Z","entities":[{"entityId":"user:dtaylor","type":"user","rawValue":"dtaylor","normalizedValue":"dtaylor","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0192","role":"actor_user"},{"entityId":"ipv4:10.0.1.16","type":"ipv4","rawValue":"10.0.1.16","normalizedValue":"10.0.1.16","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0192","role":"source_ip"},{"entityId":"bucket:corp-documents","type":"bucket","rawValue":"corp-documents","normalizedValue":"corp-documents","normalizationMethod":"verbatim","sourceObservationId":"EVT-0192","role":"bucket"},{"entityId":"cloud_object:corp-documents/HR_Policy_Update.pdf","type":"cloud_object","rawValue":"corp-documents/HR_Policy_Update.pdf","normalizedValue":"corp-documents/HR_Policy_Update.pdf","normalizationMethod":"verbatim","sourceObservationId":"EVT-0192","role":"cloud_object"}],"attributes":{"username":"dtaylor","source_ip":"10.0.1.16","file_name":"HR_Policy_Update.pdf","file_size_bytes":4744362,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"raw":{"event_id":"EVT-0192","source_type":"cloud_storage","timestamp":"2026-06-12T09:04:13.235052Z","event_name":"file_view","username":"dtaylor","source_ip":"10.0.1.16","file_name":"HR_Policy_Update.pdf","file_size_bytes":4744362,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0046","sourceType":"auth","eventType":"user_logoff","timestamp":"2026-06-12T09:07:30.394151Z","entities":[{"entityId":"user:jclark","type":"user","rawValue":"jclark","normalizedValue":"jclark","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0046","role":"actor_user"},{"entityId":"host:WKSTN-08","type":"host","rawValue":"WKSTN-08","normalizedValue":"WKSTN-08","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0046","role":"source_host"},{"entityId":"host:AUTH-SRV-02","type":"host","rawValue":"AUTH-SRV-02","normalizedValue":"AUTH-SRV-02","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0046","role":"dest_host"},{"entityId":"ipv4:10.0.3.197","type":"ipv4","rawValue":"10.0.3.197","normalizedValue":"10.0.3.197","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0046","role":"source_ip"}],"attributes":{"username":"jclark","source_host":"WKSTN-08","dest_host":"AUTH-SRV-02","logon_type":"interactive","result":"success","source_ip":"10.0.3.197"},"raw":{"event_id":"EVT-0046","source_type":"auth","timestamp":"2026-06-12T09:07:30.394151Z","event_name":"user_logoff","username":"jclark","source_host":"WKSTN-08","dest_host":"AUTH-SRV-02","logon_type":"interactive","result":"success","source_ip":"10.0.3.197"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0001","sourceType":"auth","eventType":"user_logon","timestamp":"2026-06-12T09:13:31.478890Z","entities":[{"entityId":"user:jclark","type":"user","rawValue":"jclark","normalizedValue":"jclark","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0001","role":"actor_user"},{"entityId":"host:WKSTN-05","type":"host","rawValue":"WKSTN-05","normalizedValue":"WKSTN-05","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0001","role":"source_host"},{"entityId":"host:AUTH-SRV-02","type":"host","rawValue":"AUTH-SRV-02","normalizedValue":"AUTH-SRV-02","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0001","role":"dest_host"},{"entityId":"ipv4:10.0.2.143","type":"ipv4","rawValue":"10.0.2.143","normalizedValue":"10.0.2.143","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0001","role":"source_ip"}],"attributes":{"username":"jclark","source_host":"WKSTN-05","dest_host":"AUTH-SRV-02","logon_type":"network","result":"success","source_ip":"10.0.2.143"},"raw":{"event_id":"EVT-0001","source_type":"auth","timestamp":"2026-06-12T09:13:31.478890Z","event_name":"user_logon","username":"jclark","source_host":"WKSTN-05","dest_host":"AUTH-SRV-02","logon_type":"network","result":"success","source_ip":"10.0.2.143"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0105","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-12T09:37:39.772267Z","entities":[{"entityId":"ipv4:10.0.5.21","type":"ipv4","rawValue":"10.0.5.21","normalizedValue":"10.0.5.21","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0105","role":"src_ip"},{"entityId":"ipv4:13.107.42.14","type":"ipv4","rawValue":"13.107.42.14","normalizedValue":"13.107.42.14","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0105","role":"dst_ip"},{"entityId":"endpoint:13.107.42.14:25","type":"endpoint","rawValue":"13.107.42.14:25","normalizedValue":"13.107.42.14:25","normalizationMethod":"verbatim","sourceObservationId":"EVT-0105","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.5.21","dst_ip":"13.107.42.14","dst_port":25,"protocol":"UDP","bytes_sent":4663,"bytes_recv":42356,"action":"allowed","firewall_rule":"ALLOW-OUT-152"},"raw":{"event_id":"EVT-0105","source_type":"network","timestamp":"2026-06-12T09:37:39.772267Z","event_name":"network_connection","src_ip":"10.0.5.21","dst_ip":"13.107.42.14","dst_port":25,"protocol":"UDP","bytes_sent":4663,"bytes_recv":42356,"action":"allowed","firewall_rule":"ALLOW-OUT-152"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0039","sourceType":"auth","eventType":"user_logoff","timestamp":"2026-06-12T10:09:41.598420Z","entities":[{"entityId":"user:hwalker","type":"user","rawValue":"hwalker","normalizedValue":"hwalker","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0039","role":"actor_user"},{"entityId":"host:WKSTN-01","type":"host","rawValue":"WKSTN-01","normalizedValue":"WKSTN-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0039","role":"source_host"},{"entityId":"host:AUTH-SRV-02","type":"host","rawValue":"AUTH-SRV-02","normalizedValue":"AUTH-SRV-02","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0039","role":"dest_host"},{"entityId":"ipv4:10.0.5.225","type":"ipv4","rawValue":"10.0.5.225","normalizedValue":"10.0.5.225","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0039","role":"source_ip"}],"attributes":{"username":"hwalker","source_host":"WKSTN-01","dest_host":"AUTH-SRV-02","logon_type":"remote_interactive","result":"success","source_ip":"10.0.5.225"},"raw":{"event_id":"EVT-0039","source_type":"auth","timestamp":"2026-06-12T10:09:41.598420Z","event_name":"user_logoff","username":"hwalker","source_host":"WKSTN-01","dest_host":"AUTH-SRV-02","logon_type":"remote_interactive","result":"success","source_ip":"10.0.5.225"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0038","sourceType":"auth","eventType":"failed_logon","timestamp":"2026-06-12T10:30:21.031344Z","entities":[{"entityId":"user:dtaylor","type":"user","rawValue":"dtaylor","normalizedValue":"dtaylor","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0038","role":"actor_user"},{"entityId":"host:WKSTN-03","type":"host","rawValue":"WKSTN-03","normalizedValue":"WKSTN-03","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0038","role":"source_host"},{"entityId":"host:AUTH-SRV-01","type":"host","rawValue":"AUTH-SRV-01","normalizedValue":"AUTH-SRV-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0038","role":"dest_host"},{"entityId":"ipv4:10.0.5.226","type":"ipv4","rawValue":"10.0.5.226","normalizedValue":"10.0.5.226","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0038","role":"source_ip"}],"attributes":{"username":"dtaylor","source_host":"WKSTN-03","dest_host":"AUTH-SRV-01","logon_type":"network","result":"success","source_ip":"10.0.5.226"},"raw":{"event_id":"EVT-0038","source_type":"auth","timestamp":"2026-06-12T10:30:21.031344Z","event_name":"failed_logon","username":"dtaylor","source_host":"WKSTN-03","dest_host":"AUTH-SRV-01","logon_type":"network","result":"success","source_ip":"10.0.5.226"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0107","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-12T10:30:57.120501Z","entities":[{"entityId":"ipv4:10.0.4.16","type":"ipv4","rawValue":"10.0.4.16","normalizedValue":"10.0.4.16","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0107","role":"src_ip"},{"entityId":"ipv4:10.0.3.14","type":"ipv4","rawValue":"10.0.3.14","normalizedValue":"10.0.3.14","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0107","role":"dst_ip"},{"entityId":"endpoint:10.0.3.14:443","type":"endpoint","rawValue":"10.0.3.14:443","normalizedValue":"10.0.3.14:443","normalizationMethod":"verbatim","sourceObservationId":"EVT-0107","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.4.16","dst_ip":"10.0.3.14","dst_port":443,"protocol":"UDP","bytes_sent":30625,"bytes_recv":82967,"action":"allowed","firewall_rule":"ALLOW-OUT-182"},"raw":{"event_id":"EVT-0107","source_type":"network","timestamp":"2026-06-12T10:30:57.120501Z","event_name":"network_connection","src_ip":"10.0.4.16","dst_ip":"10.0.3.14","dst_port":443,"protocol":"UDP","bytes_sent":30625,"bytes_recv":82967,"action":"allowed","firewall_rule":"ALLOW-OUT-182"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0008","sourceType":"auth","eventType":"user_logon","timestamp":"2026-06-12T10:38:43.187238Z","entities":[{"entityId":"user:hwalker","type":"user","rawValue":"hwalker","normalizedValue":"hwalker","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0008","role":"actor_user"},{"entityId":"host:WKSTN-04","type":"host","rawValue":"WKSTN-04","normalizedValue":"WKSTN-04","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0008","role":"source_host"},{"entityId":"host:AUTH-SRV-02","type":"host","rawValue":"AUTH-SRV-02","normalizedValue":"AUTH-SRV-02","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0008","role":"dest_host"},{"entityId":"ipv4:10.0.3.123","type":"ipv4","rawValue":"10.0.3.123","normalizedValue":"10.0.3.123","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0008","role":"source_ip"}],"attributes":{"username":"hwalker","source_host":"WKSTN-04","dest_host":"AUTH-SRV-02","logon_type":"interactive","result":"success","source_ip":"10.0.3.123"},"raw":{"event_id":"EVT-0008","source_type":"auth","timestamp":"2026-06-12T10:38:43.187238Z","event_name":"user_logon","username":"hwalker","source_host":"WKSTN-04","dest_host":"AUTH-SRV-02","logon_type":"interactive","result":"success","source_ip":"10.0.3.123"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0031","sourceType":"auth","eventType":"failed_logon","timestamp":"2026-06-12T11:17:50.636387Z","entities":[{"entityId":"user:ewhite","type":"user","rawValue":"ewhite","normalizedValue":"ewhite","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0031","role":"actor_user"},{"entityId":"host:WKSTN-09","type":"host","rawValue":"WKSTN-09","normalizedValue":"WKSTN-09","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0031","role":"source_host"},{"entityId":"host:AUTH-SRV-01","type":"host","rawValue":"AUTH-SRV-01","normalizedValue":"AUTH-SRV-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0031","role":"dest_host"},{"entityId":"ipv4:10.0.5.52","type":"ipv4","rawValue":"10.0.5.52","normalizedValue":"10.0.5.52","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0031","role":"source_ip"}],"attributes":{"username":"ewhite","source_host":"WKSTN-09","dest_host":"AUTH-SRV-01","logon_type":"network","result":"success","source_ip":"10.0.5.52"},"raw":{"event_id":"EVT-0031","source_type":"auth","timestamp":"2026-06-12T11:17:50.636387Z","event_name":"failed_logon","username":"ewhite","source_host":"WKSTN-09","dest_host":"AUTH-SRV-01","logon_type":"network","result":"success","source_ip":"10.0.5.52"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0061","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-12T11:39:04.098916Z","entities":[{"entityId":"ipv4:10.0.3.11","type":"ipv4","rawValue":"10.0.3.11","normalizedValue":"10.0.3.11","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0061","role":"src_ip"},{"entityId":"ipv4:10.0.2.19","type":"ipv4","rawValue":"10.0.2.19","normalizedValue":"10.0.2.19","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0061","role":"dst_ip"},{"entityId":"endpoint:10.0.2.19:53","type":"endpoint","rawValue":"10.0.2.19:53","normalizedValue":"10.0.2.19:53","normalizationMethod":"verbatim","sourceObservationId":"EVT-0061","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.3.11","dst_ip":"10.0.2.19","dst_port":53,"protocol":"TCP","bytes_sent":4990,"bytes_recv":148964,"action":"allowed","firewall_rule":"ALLOW-OUT-185"},"raw":{"event_id":"EVT-0061","source_type":"network","timestamp":"2026-06-12T11:39:04.098916Z","event_name":"network_connection","src_ip":"10.0.3.11","dst_ip":"10.0.2.19","dst_port":53,"protocol":"TCP","bytes_sent":4990,"bytes_recv":148964,"action":"allowed","firewall_rule":"ALLOW-OUT-185"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0121","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-12T12:02:46.441429Z","entities":[{"entityId":"ipv4:10.0.4.15","type":"ipv4","rawValue":"10.0.4.15","normalizedValue":"10.0.4.15","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0121","role":"src_ip"},{"entityId":"ipv4:10.0.1.16","type":"ipv4","rawValue":"10.0.1.16","normalizedValue":"10.0.1.16","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0121","role":"dst_ip"},{"entityId":"endpoint:10.0.1.16:25","type":"endpoint","rawValue":"10.0.1.16:25","normalizedValue":"10.0.1.16:25","normalizationMethod":"verbatim","sourceObservationId":"EVT-0121","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.4.15","dst_ip":"10.0.1.16","dst_port":25,"protocol":"TCP","bytes_sent":10990,"bytes_recv":93160,"action":"allowed","firewall_rule":"ALLOW-OUT-142"},"raw":{"event_id":"EVT-0121","source_type":"network","timestamp":"2026-06-12T12:02:46.441429Z","event_name":"network_connection","src_ip":"10.0.4.15","dst_ip":"10.0.1.16","dst_port":25,"protocol":"TCP","bytes_sent":10990,"bytes_recv":93160,"action":"allowed","firewall_rule":"ALLOW-OUT-142"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0083","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-12T12:16:29.046088Z","entities":[{"entityId":"ipv4:10.0.2.18","type":"ipv4","rawValue":"10.0.2.18","normalizedValue":"10.0.2.18","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0083","role":"src_ip"},{"entityId":"ipv4:10.0.5.16","type":"ipv4","rawValue":"10.0.5.16","normalizedValue":"10.0.5.16","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0083","role":"dst_ip"},{"entityId":"endpoint:10.0.5.16:22","type":"endpoint","rawValue":"10.0.5.16:22","normalizedValue":"10.0.5.16:22","normalizationMethod":"verbatim","sourceObservationId":"EVT-0083","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.2.18","dst_ip":"10.0.5.16","dst_port":22,"protocol":"UDP","bytes_sent":32624,"bytes_recv":46589,"action":"allowed","firewall_rule":"ALLOW-OUT-159"},"raw":{"event_id":"EVT-0083","source_type":"network","timestamp":"2026-06-12T12:16:29.046088Z","event_name":"network_connection","src_ip":"10.0.2.18","dst_ip":"10.0.5.16","dst_port":22,"protocol":"UDP","bytes_sent":32624,"bytes_recv":46589,"action":"allowed","firewall_rule":"ALLOW-OUT-159"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0027","sourceType":"auth","eventType":"failed_logon","timestamp":"2026-06-12T12:28:41.358556Z","entities":[{"entityId":"user:hwalker","type":"user","rawValue":"hwalker","normalizedValue":"hwalker","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0027","role":"actor_user"},{"entityId":"host:WKSTN-01","type":"host","rawValue":"WKSTN-01","normalizedValue":"WKSTN-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0027","role":"source_host"},{"entityId":"host:AUTH-SRV-01","type":"host","rawValue":"AUTH-SRV-01","normalizedValue":"AUTH-SRV-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0027","role":"dest_host"},{"entityId":"ipv4:10.0.2.89","type":"ipv4","rawValue":"10.0.2.89","normalizedValue":"10.0.2.89","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0027","role":"source_ip"}],"attributes":{"username":"hwalker","source_host":"WKSTN-01","dest_host":"AUTH-SRV-01","logon_type":"network","result":"failure","source_ip":"10.0.2.89"},"raw":{"event_id":"EVT-0027","source_type":"auth","timestamp":"2026-06-12T12:28:41.358556Z","event_name":"failed_logon","username":"hwalker","source_host":"WKSTN-01","dest_host":"AUTH-SRV-01","logon_type":"network","result":"failure","source_ip":"10.0.2.89"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0165","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-12T12:40:49.190476Z","entities":[{"entityId":"host:WKSTN-09","type":"host","rawValue":"WKSTN-09","normalizedValue":"WKSTN-09","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0165","role":"host"},{"entityId":"user:ewhite","type":"user","rawValue":"ewhite","normalizedValue":"ewhite","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0165","role":"actor_user"},{"entityId":"process:WKSTN-09:2916","type":"process","rawValue":"2916","normalizedValue":"2916","normalizationMethod":"verbatim","sourceObservationId":"EVT-0165","role":"process"}],"attributes":{"hostname":"WKSTN-09","username":"ewhite","process_name":"chrome.exe","parent_process":"explorer.exe","process_path":"C:\\Program Files\\Google\\","command_line":"","pid":2916,"integrity_level":"medium"},"raw":{"event_id":"EVT-0165","source_type":"endpoint","timestamp":"2026-06-12T12:40:49.190476Z","event_name":"process_create","hostname":"WKSTN-09","username":"ewhite","process_name":"chrome.exe","parent_process":"explorer.exe","process_path":"C:\\Program Files\\Google\\","command_line":"","pid":2916,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0214","sourceType":"cloud_storage","eventType":"file_download","timestamp":"2026-06-12T12:42:20.105292Z","entities":[{"entityId":"user:iharris","type":"user","rawValue":"iharris","normalizedValue":"iharris","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0214","role":"actor_user"},{"entityId":"ipv4:10.0.2.20","type":"ipv4","rawValue":"10.0.2.20","normalizedValue":"10.0.2.20","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0214","role":"source_ip"},{"entityId":"bucket:corp-documents","type":"bucket","rawValue":"corp-documents","normalizedValue":"corp-documents","normalizationMethod":"verbatim","sourceObservationId":"EVT-0214","role":"bucket"},{"entityId":"cloud_object:corp-documents/Client_Proposal_Acme.docx","type":"cloud_object","rawValue":"corp-documents/Client_Proposal_Acme.docx","normalizedValue":"corp-documents/Client_Proposal_Acme.docx","normalizationMethod":"verbatim","sourceObservationId":"EVT-0214","role":"cloud_object"}],"attributes":{"username":"iharris","source_ip":"10.0.2.20","file_name":"Client_Proposal_Acme.docx","file_size_bytes":2903121,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"raw":{"event_id":"EVT-0214","source_type":"cloud_storage","timestamp":"2026-06-12T12:42:20.105292Z","event_name":"file_download","username":"iharris","source_ip":"10.0.2.20","file_name":"Client_Proposal_Acme.docx","file_size_bytes":2903121,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0037","sourceType":"auth","eventType":"failed_logon","timestamp":"2026-06-12T13:01:06.466588Z","entities":[{"entityId":"user:asmith","type":"user","rawValue":"asmith","normalizedValue":"asmith","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0037","role":"actor_user"},{"entityId":"host:WKSTN-09","type":"host","rawValue":"WKSTN-09","normalizedValue":"WKSTN-09","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0037","role":"source_host"},{"entityId":"host:AUTH-SRV-02","type":"host","rawValue":"AUTH-SRV-02","normalizedValue":"AUTH-SRV-02","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0037","role":"dest_host"},{"entityId":"ipv4:10.0.3.154","type":"ipv4","rawValue":"10.0.3.154","normalizedValue":"10.0.3.154","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0037","role":"source_ip"}],"attributes":{"username":"asmith","source_host":"WKSTN-09","dest_host":"AUTH-SRV-02","logon_type":"interactive","result":"failure","source_ip":"10.0.3.154"},"raw":{"event_id":"EVT-0037","source_type":"auth","timestamp":"2026-06-12T13:01:06.466588Z","event_name":"failed_logon","username":"asmith","source_host":"WKSTN-09","dest_host":"AUTH-SRV-02","logon_type":"interactive","result":"failure","source_ip":"10.0.3.154"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0023","sourceType":"auth","eventType":"user_logoff","timestamp":"2026-06-12T13:29:54.225130Z","entities":[{"entityId":"user:fmartinez","type":"user","rawValue":"fmartinez","normalizedValue":"fmartinez","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0023","role":"actor_user"},{"entityId":"host:WKSTN-10","type":"host","rawValue":"WKSTN-10","normalizedValue":"WKSTN-10","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0023","role":"source_host"},{"entityId":"host:AUTH-SRV-02","type":"host","rawValue":"AUTH-SRV-02","normalizedValue":"AUTH-SRV-02","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0023","role":"dest_host"},{"entityId":"ipv4:10.0.5.175","type":"ipv4","rawValue":"10.0.5.175","normalizedValue":"10.0.5.175","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0023","role":"source_ip"}],"attributes":{"username":"fmartinez","source_host":"WKSTN-10","dest_host":"AUTH-SRV-02","logon_type":"network","result":"success","source_ip":"10.0.5.175"},"raw":{"event_id":"EVT-0023","source_type":"auth","timestamp":"2026-06-12T13:29:54.225130Z","event_name":"user_logoff","username":"fmartinez","source_host":"WKSTN-10","dest_host":"AUTH-SRV-02","logon_type":"network","result":"success","source_ip":"10.0.5.175"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0195","sourceType":"cloud_storage","eventType":"file_download","timestamp":"2026-06-12T14:04:23.602351Z","entities":[{"entityId":"user:cjohnson","type":"user","rawValue":"cjohnson","normalizedValue":"cjohnson","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0195","role":"actor_user"},{"entityId":"ipv4:10.0.5.11","type":"ipv4","rawValue":"10.0.5.11","normalizedValue":"10.0.5.11","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0195","role":"source_ip"},{"entityId":"bucket:corp-documents","type":"bucket","rawValue":"corp-documents","normalizedValue":"corp-documents","normalizationMethod":"verbatim","sourceObservationId":"EVT-0195","role":"bucket"},{"entityId":"cloud_object:corp-documents/Q2_Budget_Draft.xlsx","type":"cloud_object","rawValue":"corp-documents/Q2_Budget_Draft.xlsx","normalizedValue":"corp-documents/Q2_Budget_Draft.xlsx","normalizationMethod":"verbatim","sourceObservationId":"EVT-0195","role":"cloud_object"}],"attributes":{"username":"cjohnson","source_ip":"10.0.5.11","file_name":"Q2_Budget_Draft.xlsx","file_size_bytes":4646083,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"raw":{"event_id":"EVT-0195","source_type":"cloud_storage","timestamp":"2026-06-12T14:04:23.602351Z","event_name":"file_download","username":"cjohnson","source_ip":"10.0.5.11","file_name":"Q2_Budget_Draft.xlsx","file_size_bytes":4646083,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0201","sourceType":"cloud_storage","eventType":"file_share","timestamp":"2026-06-12T14:11:08.681998Z","entities":[{"entityId":"user:fmartinez","type":"user","rawValue":"fmartinez","normalizedValue":"fmartinez","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0201","role":"actor_user"},{"entityId":"ipv4:10.0.1.21","type":"ipv4","rawValue":"10.0.1.21","normalizedValue":"10.0.1.21","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0201","role":"source_ip"},{"entityId":"bucket:corp-documents","type":"bucket","rawValue":"corp-documents","normalizedValue":"corp-documents","normalizationMethod":"verbatim","sourceObservationId":"EVT-0201","role":"bucket"},{"entityId":"cloud_object:corp-documents/HR_Policy_Update.pdf","type":"cloud_object","rawValue":"corp-documents/HR_Policy_Update.pdf","normalizedValue":"corp-documents/HR_Policy_Update.pdf","normalizationMethod":"verbatim","sourceObservationId":"EVT-0201","role":"cloud_object"}],"attributes":{"username":"fmartinez","source_ip":"10.0.1.21","file_name":"HR_Policy_Update.pdf","file_size_bytes":1835748,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"raw":{"event_id":"EVT-0201","source_type":"cloud_storage","timestamp":"2026-06-12T14:11:08.681998Z","event_name":"file_share","username":"fmartinez","source_ip":"10.0.1.21","file_name":"HR_Policy_Update.pdf","file_size_bytes":1835748,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0035","sourceType":"auth","eventType":"failed_logon","timestamp":"2026-06-12T14:48:37.755262Z","entities":[{"entityId":"user:jclark","type":"user","rawValue":"jclark","normalizedValue":"jclark","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0035","role":"actor_user"},{"entityId":"host:WKSTN-06","type":"host","rawValue":"WKSTN-06","normalizedValue":"WKSTN-06","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0035","role":"source_host"},{"entityId":"host:AUTH-SRV-01","type":"host","rawValue":"AUTH-SRV-01","normalizedValue":"AUTH-SRV-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0035","role":"dest_host"},{"entityId":"ipv4:10.0.4.59","type":"ipv4","rawValue":"10.0.4.59","normalizedValue":"10.0.4.59","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0035","role":"source_ip"}],"attributes":{"username":"jclark","source_host":"WKSTN-06","dest_host":"AUTH-SRV-01","logon_type":"interactive","result":"success","source_ip":"10.0.4.59"},"raw":{"event_id":"EVT-0035","source_type":"auth","timestamp":"2026-06-12T14:48:37.755262Z","event_name":"failed_logon","username":"jclark","source_host":"WKSTN-06","dest_host":"AUTH-SRV-01","logon_type":"interactive","result":"success","source_ip":"10.0.4.59"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0153","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-12T15:10:02.539810Z","entities":[{"entityId":"host:WKSTN-02","type":"host","rawValue":"WKSTN-02","normalizedValue":"WKSTN-02","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0153","role":"host"},{"entityId":"user:hwalker","type":"user","rawValue":"hwalker","normalizedValue":"hwalker","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0153","role":"actor_user"},{"entityId":"process:WKSTN-02:7078","type":"process","rawValue":"7078","normalizedValue":"7078","normalizationMethod":"verbatim","sourceObservationId":"EVT-0153","role":"process"}],"attributes":{"hostname":"WKSTN-02","username":"hwalker","process_name":"outlook.exe","parent_process":"explorer.exe","process_path":"C:\\Program Files\\Slack\\","command_line":"","pid":7078,"integrity_level":"medium"},"raw":{"event_id":"EVT-0153","source_type":"endpoint","timestamp":"2026-06-12T15:10:02.539810Z","event_name":"process_create","hostname":"WKSTN-02","username":"hwalker","process_name":"outlook.exe","parent_process":"explorer.exe","process_path":"C:\\Program Files\\Slack\\","command_line":"","pid":7078,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0161","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-12T15:30:45.933847Z","entities":[{"entityId":"host:WKSTN-04","type":"host","rawValue":"WKSTN-04","normalizedValue":"WKSTN-04","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0161","role":"host"},{"entityId":"user:ewhite","type":"user","rawValue":"ewhite","normalizedValue":"ewhite","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0161","role":"actor_user"},{"entityId":"process:WKSTN-04:5409","type":"process","rawValue":"5409","normalizedValue":"5409","normalizationMethod":"verbatim","sourceObservationId":"EVT-0161","role":"process"}],"attributes":{"hostname":"WKSTN-04","username":"ewhite","process_name":"explorer.exe","parent_process":"outlook.exe","process_path":"C:\\Program Files\\Microsoft\\","command_line":"","pid":5409,"integrity_level":"medium"},"raw":{"event_id":"EVT-0161","source_type":"endpoint","timestamp":"2026-06-12T15:30:45.933847Z","event_name":"process_create","hostname":"WKSTN-04","username":"ewhite","process_name":"explorer.exe","parent_process":"outlook.exe","process_path":"C:\\Program Files\\Microsoft\\","command_line":"","pid":5409,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0213","sourceType":"cloud_storage","eventType":"file_share","timestamp":"2026-06-12T15:48:17.786338Z","entities":[{"entityId":"user:bwilliams","type":"user","rawValue":"bwilliams","normalizedValue":"bwilliams","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0213","role":"actor_user"},{"entityId":"ipv4:10.0.2.11","type":"ipv4","rawValue":"10.0.2.11","normalizedValue":"10.0.2.11","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0213","role":"source_ip"},{"entityId":"bucket:corp-documents","type":"bucket","rawValue":"corp-documents","normalizedValue":"corp-documents","normalizationMethod":"verbatim","sourceObservationId":"EVT-0213","role":"bucket"},{"entityId":"cloud_object:corp-documents/HR_Policy_Update.pdf","type":"cloud_object","rawValue":"corp-documents/HR_Policy_Update.pdf","normalizedValue":"corp-documents/HR_Policy_Update.pdf","normalizationMethod":"verbatim","sourceObservationId":"EVT-0213","role":"cloud_object"}],"attributes":{"username":"bwilliams","source_ip":"10.0.2.11","file_name":"HR_Policy_Update.pdf","file_size_bytes":1630409,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"raw":{"event_id":"EVT-0213","source_type":"cloud_storage","timestamp":"2026-06-12T15:48:17.786338Z","event_name":"file_share","username":"bwilliams","source_ip":"10.0.2.11","file_name":"HR_Policy_Update.pdf","file_size_bytes":1630409,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0151","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-12T16:48:39.361865Z","entities":[{"entityId":"host:WKSTN-08","type":"host","rawValue":"WKSTN-08","normalizedValue":"WKSTN-08","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0151","role":"host"},{"entityId":"user:jclark","type":"user","rawValue":"jclark","normalizedValue":"jclark","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0151","role":"actor_user"},{"entityId":"process:WKSTN-08:2949","type":"process","rawValue":"2949","normalizedValue":"2949","normalizationMethod":"verbatim","sourceObservationId":"EVT-0151","role":"process"}],"attributes":{"hostname":"WKSTN-08","username":"jclark","process_name":"explorer.exe","parent_process":"outlook.exe","process_path":"C:\\Program Files\\Slack\\","command_line":"","pid":2949,"integrity_level":"medium"},"raw":{"event_id":"EVT-0151","source_type":"endpoint","timestamp":"2026-06-12T16:48:39.361865Z","event_name":"process_create","hostname":"WKSTN-08","username":"jclark","process_name":"explorer.exe","parent_process":"outlook.exe","process_path":"C:\\Program Files\\Slack\\","command_line":"","pid":2949,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0036","sourceType":"auth","eventType":"failed_logon","timestamp":"2026-06-12T17:03:53.157508Z","entities":[{"entityId":"user:bwilliams","type":"user","rawValue":"bwilliams","normalizedValue":"bwilliams","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0036","role":"actor_user"},{"entityId":"host:WKSTN-09","type":"host","rawValue":"WKSTN-09","normalizedValue":"WKSTN-09","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0036","role":"source_host"},{"entityId":"host:AUTH-SRV-01","type":"host","rawValue":"AUTH-SRV-01","normalizedValue":"AUTH-SRV-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0036","role":"dest_host"},{"entityId":"ipv4:10.0.1.243","type":"ipv4","rawValue":"10.0.1.243","normalizedValue":"10.0.1.243","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0036","role":"source_ip"}],"attributes":{"username":"bwilliams","source_host":"WKSTN-09","dest_host":"AUTH-SRV-01","logon_type":"remote_interactive","result":"failure","source_ip":"10.0.1.243"},"raw":{"event_id":"EVT-0036","source_type":"auth","timestamp":"2026-06-12T17:03:53.157508Z","event_name":"failed_logon","username":"bwilliams","source_host":"WKSTN-09","dest_host":"AUTH-SRV-01","logon_type":"remote_interactive","result":"failure","source_ip":"10.0.1.243"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0188","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-12T17:10:30.174600Z","entities":[{"entityId":"host:WKSTN-10","type":"host","rawValue":"WKSTN-10","normalizedValue":"WKSTN-10","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0188","role":"host"},{"entityId":"user:ewhite","type":"user","rawValue":"ewhite","normalizedValue":"ewhite","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0188","role":"actor_user"},{"entityId":"process:WKSTN-10:4845","type":"process","rawValue":"4845","normalizedValue":"4845","normalizationMethod":"verbatim","sourceObservationId":"EVT-0188","role":"process"}],"attributes":{"hostname":"WKSTN-10","username":"ewhite","process_name":"slack.exe","parent_process":"outlook.exe","process_path":"C:\\Program Files\\Slack\\","command_line":"","pid":4845,"integrity_level":"medium"},"raw":{"event_id":"EVT-0188","source_type":"endpoint","timestamp":"2026-06-12T17:10:30.174600Z","event_name":"process_create","hostname":"WKSTN-10","username":"ewhite","process_name":"slack.exe","parent_process":"outlook.exe","process_path":"C:\\Program Files\\Slack\\","command_line":"","pid":4845,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0045","sourceType":"auth","eventType":"user_logon","timestamp":"2026-06-12T17:30:15.202796Z","entities":[{"entityId":"user:bwilliams","type":"user","rawValue":"bwilliams","normalizedValue":"bwilliams","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0045","role":"actor_user"},{"entityId":"host:WKSTN-02","type":"host","rawValue":"WKSTN-02","normalizedValue":"WKSTN-02","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0045","role":"source_host"},{"entityId":"host:AUTH-SRV-01","type":"host","rawValue":"AUTH-SRV-01","normalizedValue":"AUTH-SRV-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0045","role":"dest_host"},{"entityId":"ipv4:10.0.4.44","type":"ipv4","rawValue":"10.0.4.44","normalizedValue":"10.0.4.44","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0045","role":"source_ip"}],"attributes":{"username":"bwilliams","source_host":"WKSTN-02","dest_host":"AUTH-SRV-01","logon_type":"remote_interactive","result":"failure","source_ip":"10.0.4.44"},"raw":{"event_id":"EVT-0045","source_type":"auth","timestamp":"2026-06-12T17:30:15.202796Z","event_name":"user_logon","username":"bwilliams","source_host":"WKSTN-02","dest_host":"AUTH-SRV-01","logon_type":"remote_interactive","result":"failure","source_ip":"10.0.4.44"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0004","sourceType":"auth","eventType":"failed_logon","timestamp":"2026-06-12T17:54:45.864623Z","entities":[{"entityId":"user:dtaylor","type":"user","rawValue":"dtaylor","normalizedValue":"dtaylor","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0004","role":"actor_user"},{"entityId":"host:WKSTN-03","type":"host","rawValue":"WKSTN-03","normalizedValue":"WKSTN-03","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0004","role":"source_host"},{"entityId":"host:AUTH-SRV-01","type":"host","rawValue":"AUTH-SRV-01","normalizedValue":"AUTH-SRV-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0004","role":"dest_host"},{"entityId":"ipv4:10.0.4.209","type":"ipv4","rawValue":"10.0.4.209","normalizedValue":"10.0.4.209","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0004","role":"source_ip"}],"attributes":{"username":"dtaylor","source_host":"WKSTN-03","dest_host":"AUTH-SRV-01","logon_type":"network","result":"success","source_ip":"10.0.4.209"},"raw":{"event_id":"EVT-0004","source_type":"auth","timestamp":"2026-06-12T17:54:45.864623Z","event_name":"failed_logon","username":"dtaylor","source_host":"WKSTN-03","dest_host":"AUTH-SRV-01","logon_type":"network","result":"success","source_ip":"10.0.4.209"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0090","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-12T18:01:04.842883Z","entities":[{"entityId":"ipv4:10.0.4.11","type":"ipv4","rawValue":"10.0.4.11","normalizedValue":"10.0.4.11","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0090","role":"src_ip"},{"entityId":"ipv4:10.0.4.18","type":"ipv4","rawValue":"10.0.4.18","normalizedValue":"10.0.4.18","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0090","role":"dst_ip"},{"entityId":"endpoint:10.0.4.18:22","type":"endpoint","rawValue":"10.0.4.18:22","normalizedValue":"10.0.4.18:22","normalizationMethod":"verbatim","sourceObservationId":"EVT-0090","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.4.11","dst_ip":"10.0.4.18","dst_port":22,"protocol":"TCP","bytes_sent":16510,"bytes_recv":57976,"action":"allowed","firewall_rule":"ALLOW-OUT-166"},"raw":{"event_id":"EVT-0090","source_type":"network","timestamp":"2026-06-12T18:01:04.842883Z","event_name":"network_connection","src_ip":"10.0.4.11","dst_ip":"10.0.4.18","dst_port":22,"protocol":"TCP","bytes_sent":16510,"bytes_recv":57976,"action":"allowed","firewall_rule":"ALLOW-OUT-166"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0160","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-12T18:08:37.149034Z","entities":[{"entityId":"host:WKSTN-02","type":"host","rawValue":"WKSTN-02","normalizedValue":"WKSTN-02","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0160","role":"host"},{"entityId":"user:dtaylor","type":"user","rawValue":"dtaylor","normalizedValue":"dtaylor","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0160","role":"actor_user"},{"entityId":"process:WKSTN-02:4419","type":"process","rawValue":"4419","normalizedValue":"4419","normalizationMethod":"verbatim","sourceObservationId":"EVT-0160","role":"process"}],"attributes":{"hostname":"WKSTN-02","username":"dtaylor","process_name":"word.exe","parent_process":"teams.exe","process_path":"C:\\Program Files\\Slack\\","command_line":"","pid":4419,"integrity_level":"medium"},"raw":{"event_id":"EVT-0160","source_type":"endpoint","timestamp":"2026-06-12T18:08:37.149034Z","event_name":"process_create","hostname":"WKSTN-02","username":"dtaylor","process_name":"word.exe","parent_process":"teams.exe","process_path":"C:\\Program Files\\Slack\\","command_line":"","pid":4419,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0073","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-12T18:10:52.596043Z","entities":[{"entityId":"ipv4:10.0.1.13","type":"ipv4","rawValue":"10.0.1.13","normalizedValue":"10.0.1.13","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0073","role":"src_ip"},{"entityId":"ipv4:10.0.4.24","type":"ipv4","rawValue":"10.0.4.24","normalizedValue":"10.0.4.24","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0073","role":"dst_ip"},{"entityId":"endpoint:10.0.4.24:53","type":"endpoint","rawValue":"10.0.4.24:53","normalizedValue":"10.0.4.24:53","normalizationMethod":"verbatim","sourceObservationId":"EVT-0073","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.1.13","dst_ip":"10.0.4.24","dst_port":53,"protocol":"UDP","bytes_sent":29167,"bytes_recv":152497,"action":"allowed","firewall_rule":"ALLOW-OUT-117"},"raw":{"event_id":"EVT-0073","source_type":"network","timestamp":"2026-06-12T18:10:52.596043Z","event_name":"network_connection","src_ip":"10.0.1.13","dst_ip":"10.0.4.24","dst_port":53,"protocol":"UDP","bytes_sent":29167,"bytes_recv":152497,"action":"allowed","firewall_rule":"ALLOW-OUT-117"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0133","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-12T18:53:52.382561Z","entities":[{"entityId":"ipv4:10.0.4.26","type":"ipv4","rawValue":"10.0.4.26","normalizedValue":"10.0.4.26","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0133","role":"src_ip"},{"entityId":"ipv4:10.0.4.20","type":"ipv4","rawValue":"10.0.4.20","normalizedValue":"10.0.4.20","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0133","role":"dst_ip"},{"entityId":"endpoint:10.0.4.20:443","type":"endpoint","rawValue":"10.0.4.20:443","normalizedValue":"10.0.4.20:443","normalizationMethod":"verbatim","sourceObservationId":"EVT-0133","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.4.26","dst_ip":"10.0.4.20","dst_port":443,"protocol":"UDP","bytes_sent":47938,"bytes_recv":110067,"action":"allowed","firewall_rule":"ALLOW-OUT-107"},"raw":{"event_id":"EVT-0133","source_type":"network","timestamp":"2026-06-12T18:53:52.382561Z","event_name":"network_connection","src_ip":"10.0.4.26","dst_ip":"10.0.4.20","dst_port":443,"protocol":"UDP","bytes_sent":47938,"bytes_recv":110067,"action":"allowed","firewall_rule":"ALLOW-OUT-107"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0082","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-12T18:55:43.289178Z","entities":[{"entityId":"ipv4:10.0.4.26","type":"ipv4","rawValue":"10.0.4.26","normalizedValue":"10.0.4.26","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0082","role":"src_ip"},{"entityId":"ipv4:10.0.5.22","type":"ipv4","rawValue":"10.0.5.22","normalizedValue":"10.0.5.22","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0082","role":"dst_ip"},{"entityId":"endpoint:10.0.5.22:443","type":"endpoint","rawValue":"10.0.5.22:443","normalizedValue":"10.0.5.22:443","normalizationMethod":"verbatim","sourceObservationId":"EVT-0082","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.4.26","dst_ip":"10.0.5.22","dst_port":443,"protocol":"UDP","bytes_sent":16664,"bytes_recv":11681,"action":"allowed","firewall_rule":"ALLOW-OUT-161"},"raw":{"event_id":"EVT-0082","source_type":"network","timestamp":"2026-06-12T18:55:43.289178Z","event_name":"network_connection","src_ip":"10.0.4.26","dst_ip":"10.0.5.22","dst_port":443,"protocol":"UDP","bytes_sent":16664,"bytes_recv":11681,"action":"allowed","firewall_rule":"ALLOW-OUT-161"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0048","sourceType":"auth","eventType":"user_logon","timestamp":"2026-06-12T18:59:04.644060Z","entities":[{"entityId":"user:ewhite","type":"user","rawValue":"ewhite","normalizedValue":"ewhite","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0048","role":"actor_user"},{"entityId":"host:WKSTN-10","type":"host","rawValue":"WKSTN-10","normalizedValue":"WKSTN-10","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0048","role":"source_host"},{"entityId":"host:AUTH-SRV-01","type":"host","rawValue":"AUTH-SRV-01","normalizedValue":"AUTH-SRV-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0048","role":"dest_host"},{"entityId":"ipv4:10.0.3.78","type":"ipv4","rawValue":"10.0.3.78","normalizedValue":"10.0.3.78","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0048","role":"source_ip"}],"attributes":{"username":"ewhite","source_host":"WKSTN-10","dest_host":"AUTH-SRV-01","logon_type":"interactive","result":"success","source_ip":"10.0.3.78"},"raw":{"event_id":"EVT-0048","source_type":"auth","timestamp":"2026-06-12T18:59:04.644060Z","event_name":"user_logon","username":"ewhite","source_host":"WKSTN-10","dest_host":"AUTH-SRV-01","logon_type":"interactive","result":"success","source_ip":"10.0.3.78"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0016","sourceType":"auth","eventType":"user_logon","timestamp":"2026-06-12T20:02:27.306774Z","entities":[{"entityId":"user:ewhite","type":"user","rawValue":"ewhite","normalizedValue":"ewhite","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0016","role":"actor_user"},{"entityId":"host:WKSTN-10","type":"host","rawValue":"WKSTN-10","normalizedValue":"WKSTN-10","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0016","role":"source_host"},{"entityId":"host:AUTH-SRV-02","type":"host","rawValue":"AUTH-SRV-02","normalizedValue":"AUTH-SRV-02","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0016","role":"dest_host"},{"entityId":"ipv4:10.0.5.218","type":"ipv4","rawValue":"10.0.5.218","normalizedValue":"10.0.5.218","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0016","role":"source_ip"}],"attributes":{"username":"ewhite","source_host":"WKSTN-10","dest_host":"AUTH-SRV-02","logon_type":"interactive","result":"failure","source_ip":"10.0.5.218"},"raw":{"event_id":"EVT-0016","source_type":"auth","timestamp":"2026-06-12T20:02:27.306774Z","event_name":"user_logon","username":"ewhite","source_host":"WKSTN-10","dest_host":"AUTH-SRV-02","logon_type":"interactive","result":"failure","source_ip":"10.0.5.218"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0060","sourceType":"auth","eventType":"user_logoff","timestamp":"2026-06-12T20:35:47.779696Z","entities":[{"entityId":"user:fmartinez","type":"user","rawValue":"fmartinez","normalizedValue":"fmartinez","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0060","role":"actor_user"},{"entityId":"host:WKSTN-02","type":"host","rawValue":"WKSTN-02","normalizedValue":"WKSTN-02","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0060","role":"source_host"},{"entityId":"host:AUTH-SRV-01","type":"host","rawValue":"AUTH-SRV-01","normalizedValue":"AUTH-SRV-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0060","role":"dest_host"},{"entityId":"ipv4:10.0.1.219","type":"ipv4","rawValue":"10.0.1.219","normalizedValue":"10.0.1.219","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0060","role":"source_ip"}],"attributes":{"username":"fmartinez","source_host":"WKSTN-02","dest_host":"AUTH-SRV-01","logon_type":"network","result":"success","source_ip":"10.0.1.219"},"raw":{"event_id":"EVT-0060","source_type":"auth","timestamp":"2026-06-12T20:35:47.779696Z","event_name":"user_logoff","username":"fmartinez","source_host":"WKSTN-02","dest_host":"AUTH-SRV-01","logon_type":"network","result":"success","source_ip":"10.0.1.219"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0172","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-12T21:00:27.515647Z","entities":[{"entityId":"host:WKSTN-02","type":"host","rawValue":"WKSTN-02","normalizedValue":"WKSTN-02","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0172","role":"host"},{"entityId":"user:ewhite","type":"user","rawValue":"ewhite","normalizedValue":"ewhite","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0172","role":"actor_user"},{"entityId":"process:WKSTN-02:7632","type":"process","rawValue":"7632","normalizedValue":"7632","normalizationMethod":"verbatim","sourceObservationId":"EVT-0172","role":"process"}],"attributes":{"hostname":"WKSTN-02","username":"ewhite","process_name":"excel.exe","parent_process":"explorer.exe","process_path":"C:\\Program Files\\Slack\\","command_line":"","pid":7632,"integrity_level":"medium"},"raw":{"event_id":"EVT-0172","source_type":"endpoint","timestamp":"2026-06-12T21:00:27.515647Z","event_name":"process_create","hostname":"WKSTN-02","username":"ewhite","process_name":"excel.exe","parent_process":"explorer.exe","process_path":"C:\\Program Files\\Slack\\","command_line":"","pid":7632,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0116","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-12T21:43:29.098438Z","entities":[{"entityId":"ipv4:10.0.3.22","type":"ipv4","rawValue":"10.0.3.22","normalizedValue":"10.0.3.22","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0116","role":"src_ip"},{"entityId":"ipv4:10.0.3.18","type":"ipv4","rawValue":"10.0.3.18","normalizedValue":"10.0.3.18","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0116","role":"dst_ip"},{"entityId":"endpoint:10.0.3.18:25","type":"endpoint","rawValue":"10.0.3.18:25","normalizedValue":"10.0.3.18:25","normalizationMethod":"verbatim","sourceObservationId":"EVT-0116","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.3.22","dst_ip":"10.0.3.18","dst_port":25,"protocol":"TCP","bytes_sent":26049,"bytes_recv":133643,"action":"allowed","firewall_rule":"ALLOW-OUT-110"},"raw":{"event_id":"EVT-0116","source_type":"network","timestamp":"2026-06-12T21:43:29.098438Z","event_name":"network_connection","src_ip":"10.0.3.22","dst_ip":"10.0.3.18","dst_port":25,"protocol":"TCP","bytes_sent":26049,"bytes_recv":133643,"action":"allowed","firewall_rule":"ALLOW-OUT-110"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0196","sourceType":"cloud_storage","eventType":"file_view","timestamp":"2026-06-12T22:00:13.327519Z","entities":[{"entityId":"user:fmartinez","type":"user","rawValue":"fmartinez","normalizedValue":"fmartinez","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0196","role":"actor_user"},{"entityId":"ipv4:10.0.3.14","type":"ipv4","rawValue":"10.0.3.14","normalizedValue":"10.0.3.14","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0196","role":"source_ip"},{"entityId":"bucket:corp-documents","type":"bucket","rawValue":"corp-documents","normalizedValue":"corp-documents","normalizationMethod":"verbatim","sourceObservationId":"EVT-0196","role":"bucket"},{"entityId":"cloud_object:corp-documents/Q2_Budget_Draft.xlsx","type":"cloud_object","rawValue":"corp-documents/Q2_Budget_Draft.xlsx","normalizedValue":"corp-documents/Q2_Budget_Draft.xlsx","normalizationMethod":"verbatim","sourceObservationId":"EVT-0196","role":"cloud_object"}],"attributes":{"username":"fmartinez","source_ip":"10.0.3.14","file_name":"Q2_Budget_Draft.xlsx","file_size_bytes":1109467,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"raw":{"event_id":"EVT-0196","source_type":"cloud_storage","timestamp":"2026-06-12T22:00:13.327519Z","event_name":"file_view","username":"fmartinez","source_ip":"10.0.3.14","file_name":"Q2_Budget_Draft.xlsx","file_size_bytes":1109467,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0122","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-12T22:21:21.756883Z","entities":[{"entityId":"ipv4:10.0.5.13","type":"ipv4","rawValue":"10.0.5.13","normalizedValue":"10.0.5.13","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0122","role":"src_ip"},{"entityId":"ipv4:10.0.2.12","type":"ipv4","rawValue":"10.0.2.12","normalizedValue":"10.0.2.12","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0122","role":"dst_ip"},{"entityId":"endpoint:10.0.2.12:53","type":"endpoint","rawValue":"10.0.2.12:53","normalizedValue":"10.0.2.12:53","normalizationMethod":"verbatim","sourceObservationId":"EVT-0122","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.5.13","dst_ip":"10.0.2.12","dst_port":53,"protocol":"UDP","bytes_sent":18683,"bytes_recv":75005,"action":"allowed","firewall_rule":"ALLOW-OUT-189"},"raw":{"event_id":"EVT-0122","source_type":"network","timestamp":"2026-06-12T22:21:21.756883Z","event_name":"network_connection","src_ip":"10.0.5.13","dst_ip":"10.0.2.12","dst_port":53,"protocol":"UDP","bytes_sent":18683,"bytes_recv":75005,"action":"allowed","firewall_rule":"ALLOW-OUT-189"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0017","sourceType":"auth","eventType":"failed_logon","timestamp":"2026-06-12T22:25:32.646863Z","entities":[{"entityId":"user:bwilliams","type":"user","rawValue":"bwilliams","normalizedValue":"bwilliams","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0017","role":"actor_user"},{"entityId":"host:WKSTN-04","type":"host","rawValue":"WKSTN-04","normalizedValue":"WKSTN-04","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0017","role":"source_host"},{"entityId":"host:AUTH-SRV-01","type":"host","rawValue":"AUTH-SRV-01","normalizedValue":"AUTH-SRV-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0017","role":"dest_host"},{"entityId":"ipv4:10.0.2.72","type":"ipv4","rawValue":"10.0.2.72","normalizedValue":"10.0.2.72","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0017","role":"source_ip"}],"attributes":{"username":"bwilliams","source_host":"WKSTN-04","dest_host":"AUTH-SRV-01","logon_type":"interactive","result":"success","source_ip":"10.0.2.72"},"raw":{"event_id":"EVT-0017","source_type":"auth","timestamp":"2026-06-12T22:25:32.646863Z","event_name":"failed_logon","username":"bwilliams","source_host":"WKSTN-04","dest_host":"AUTH-SRV-01","logon_type":"interactive","result":"success","source_ip":"10.0.2.72"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0155","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-12T22:39:14.761511Z","entities":[{"entityId":"host:WKSTN-01","type":"host","rawValue":"WKSTN-01","normalizedValue":"WKSTN-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0155","role":"host"},{"entityId":"user:cjohnson","type":"user","rawValue":"cjohnson","normalizedValue":"cjohnson","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0155","role":"actor_user"},{"entityId":"process:WKSTN-01:9612","type":"process","rawValue":"9612","normalizedValue":"9612","normalizationMethod":"verbatim","sourceObservationId":"EVT-0155","role":"process"}],"attributes":{"hostname":"WKSTN-01","username":"cjohnson","process_name":"excel.exe","parent_process":"teams.exe","process_path":"C:\\Program Files\\Google\\","command_line":"","pid":9612,"integrity_level":"medium"},"raw":{"event_id":"EVT-0155","source_type":"endpoint","timestamp":"2026-06-12T22:39:14.761511Z","event_name":"process_create","hostname":"WKSTN-01","username":"cjohnson","process_name":"excel.exe","parent_process":"teams.exe","process_path":"C:\\Program Files\\Google\\","command_line":"","pid":9612,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0106","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-12T22:45:45.706980Z","entities":[{"entityId":"ipv4:10.0.3.15","type":"ipv4","rawValue":"10.0.3.15","normalizedValue":"10.0.3.15","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0106","role":"src_ip"},{"entityId":"ipv4:10.0.3.27","type":"ipv4","rawValue":"10.0.3.27","normalizedValue":"10.0.3.27","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0106","role":"dst_ip"},{"entityId":"endpoint:10.0.3.27:443","type":"endpoint","rawValue":"10.0.3.27:443","normalizedValue":"10.0.3.27:443","normalizationMethod":"verbatim","sourceObservationId":"EVT-0106","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.3.15","dst_ip":"10.0.3.27","dst_port":443,"protocol":"UDP","bytes_sent":20889,"bytes_recv":93949,"action":"allowed","firewall_rule":"ALLOW-OUT-145"},"raw":{"event_id":"EVT-0106","source_type":"network","timestamp":"2026-06-12T22:45:45.706980Z","event_name":"network_connection","src_ip":"10.0.3.15","dst_ip":"10.0.3.27","dst_port":443,"protocol":"UDP","bytes_sent":20889,"bytes_recv":93949,"action":"allowed","firewall_rule":"ALLOW-OUT-145"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0207","sourceType":"cloud_storage","eventType":"file_upload","timestamp":"2026-06-12T22:59:45.883199Z","entities":[{"entityId":"user:asmith","type":"user","rawValue":"asmith","normalizedValue":"asmith","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0207","role":"actor_user"},{"entityId":"ipv4:10.0.1.16","type":"ipv4","rawValue":"10.0.1.16","normalizedValue":"10.0.1.16","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0207","role":"source_ip"},{"entityId":"bucket:corp-documents","type":"bucket","rawValue":"corp-documents","normalizedValue":"corp-documents","normalizationMethod":"verbatim","sourceObservationId":"EVT-0207","role":"bucket"},{"entityId":"cloud_object:corp-documents/Client_Proposal_Acme.docx","type":"cloud_object","rawValue":"corp-documents/Client_Proposal_Acme.docx","normalizedValue":"corp-documents/Client_Proposal_Acme.docx","normalizationMethod":"verbatim","sourceObservationId":"EVT-0207","role":"cloud_object"}],"attributes":{"username":"asmith","source_ip":"10.0.1.16","file_name":"Client_Proposal_Acme.docx","file_size_bytes":4246678,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"raw":{"event_id":"EVT-0207","source_type":"cloud_storage","timestamp":"2026-06-12T22:59:45.883199Z","event_name":"file_upload","username":"asmith","source_ip":"10.0.1.16","file_name":"Client_Proposal_Acme.docx","file_size_bytes":4246678,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0086","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-12T23:13:04.715288Z","entities":[{"entityId":"ipv4:10.0.3.10","type":"ipv4","rawValue":"10.0.3.10","normalizedValue":"10.0.3.10","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0086","role":"src_ip"},{"entityId":"ipv4:10.0.1.29","type":"ipv4","rawValue":"10.0.1.29","normalizedValue":"10.0.1.29","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0086","role":"dst_ip"},{"entityId":"endpoint:10.0.1.29:443","type":"endpoint","rawValue":"10.0.1.29:443","normalizedValue":"10.0.1.29:443","normalizationMethod":"verbatim","sourceObservationId":"EVT-0086","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.3.10","dst_ip":"10.0.1.29","dst_port":443,"protocol":"TCP","bytes_sent":44870,"bytes_recv":2776,"action":"allowed","firewall_rule":"ALLOW-OUT-196"},"raw":{"event_id":"EVT-0086","source_type":"network","timestamp":"2026-06-12T23:13:04.715288Z","event_name":"network_connection","src_ip":"10.0.3.10","dst_ip":"10.0.1.29","dst_port":443,"protocol":"TCP","bytes_sent":44870,"bytes_recv":2776,"action":"allowed","firewall_rule":"ALLOW-OUT-196"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0111","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-12T23:22:21.189980Z","entities":[{"entityId":"ipv4:10.0.1.16","type":"ipv4","rawValue":"10.0.1.16","normalizedValue":"10.0.1.16","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0111","role":"src_ip"},{"entityId":"ipv4:10.0.4.26","type":"ipv4","rawValue":"10.0.4.26","normalizedValue":"10.0.4.26","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0111","role":"dst_ip"},{"entityId":"endpoint:10.0.4.26:443","type":"endpoint","rawValue":"10.0.4.26:443","normalizedValue":"10.0.4.26:443","normalizationMethod":"verbatim","sourceObservationId":"EVT-0111","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.1.16","dst_ip":"10.0.4.26","dst_port":443,"protocol":"UDP","bytes_sent":971,"bytes_recv":103000,"action":"allowed","firewall_rule":"ALLOW-OUT-175"},"raw":{"event_id":"EVT-0111","source_type":"network","timestamp":"2026-06-12T23:22:21.189980Z","event_name":"network_connection","src_ip":"10.0.1.16","dst_ip":"10.0.4.26","dst_port":443,"protocol":"UDP","bytes_sent":971,"bytes_recv":103000,"action":"allowed","firewall_rule":"ALLOW-OUT-175"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0064","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-12T23:58:44.972517Z","entities":[{"entityId":"ipv4:10.0.2.24","type":"ipv4","rawValue":"10.0.2.24","normalizedValue":"10.0.2.24","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0064","role":"src_ip"},{"entityId":"ipv4:10.0.1.26","type":"ipv4","rawValue":"10.0.1.26","normalizedValue":"10.0.1.26","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0064","role":"dst_ip"},{"entityId":"endpoint:10.0.1.26:80","type":"endpoint","rawValue":"10.0.1.26:80","normalizedValue":"10.0.1.26:80","normalizationMethod":"verbatim","sourceObservationId":"EVT-0064","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.2.24","dst_ip":"10.0.1.26","dst_port":80,"protocol":"UDP","bytes_sent":18962,"bytes_recv":59332,"action":"allowed","firewall_rule":"ALLOW-OUT-148"},"raw":{"event_id":"EVT-0064","source_type":"network","timestamp":"2026-06-12T23:58:44.972517Z","event_name":"network_connection","src_ip":"10.0.2.24","dst_ip":"10.0.1.26","dst_port":80,"protocol":"UDP","bytes_sent":18962,"bytes_recv":59332,"action":"allowed","firewall_rule":"ALLOW-OUT-148"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0119","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-13T00:04:04.195656Z","entities":[{"entityId":"ipv4:10.0.3.29","type":"ipv4","rawValue":"10.0.3.29","normalizedValue":"10.0.3.29","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0119","role":"src_ip"},{"entityId":"ipv4:10.0.5.18","type":"ipv4","rawValue":"10.0.5.18","normalizedValue":"10.0.5.18","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0119","role":"dst_ip"},{"entityId":"endpoint:10.0.5.18:22","type":"endpoint","rawValue":"10.0.5.18:22","normalizedValue":"10.0.5.18:22","normalizationMethod":"verbatim","sourceObservationId":"EVT-0119","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.3.29","dst_ip":"10.0.5.18","dst_port":22,"protocol":"UDP","bytes_sent":6301,"bytes_recv":181329,"action":"allowed","firewall_rule":"ALLOW-OUT-157"},"raw":{"event_id":"EVT-0119","source_type":"network","timestamp":"2026-06-13T00:04:04.195656Z","event_name":"network_connection","src_ip":"10.0.3.29","dst_ip":"10.0.5.18","dst_port":22,"protocol":"UDP","bytes_sent":6301,"bytes_recv":181329,"action":"allowed","firewall_rule":"ALLOW-OUT-157"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0018","sourceType":"auth","eventType":"failed_logon","timestamp":"2026-06-13T00:47:41.254884Z","entities":[{"entityId":"user:fmartinez","type":"user","rawValue":"fmartinez","normalizedValue":"fmartinez","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0018","role":"actor_user"},{"entityId":"host:WKSTN-01","type":"host","rawValue":"WKSTN-01","normalizedValue":"WKSTN-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0018","role":"source_host"},{"entityId":"host:AUTH-SRV-01","type":"host","rawValue":"AUTH-SRV-01","normalizedValue":"AUTH-SRV-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0018","role":"dest_host"},{"entityId":"ipv4:10.0.1.129","type":"ipv4","rawValue":"10.0.1.129","normalizedValue":"10.0.1.129","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0018","role":"source_ip"}],"attributes":{"username":"fmartinez","source_host":"WKSTN-01","dest_host":"AUTH-SRV-01","logon_type":"interactive","result":"failure","source_ip":"10.0.1.129"},"raw":{"event_id":"EVT-0018","source_type":"auth","timestamp":"2026-06-13T00:47:41.254884Z","event_name":"failed_logon","username":"fmartinez","source_host":"WKSTN-01","dest_host":"AUTH-SRV-01","logon_type":"interactive","result":"failure","source_ip":"10.0.1.129"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0087","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-13T02:11:29.423126Z","entities":[{"entityId":"ipv4:10.0.4.20","type":"ipv4","rawValue":"10.0.4.20","normalizedValue":"10.0.4.20","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0087","role":"src_ip"},{"entityId":"ipv4:10.0.3.29","type":"ipv4","rawValue":"10.0.3.29","normalizedValue":"10.0.3.29","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0087","role":"dst_ip"},{"entityId":"endpoint:10.0.3.29:443","type":"endpoint","rawValue":"10.0.3.29:443","normalizedValue":"10.0.3.29:443","normalizationMethod":"verbatim","sourceObservationId":"EVT-0087","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.4.20","dst_ip":"10.0.3.29","dst_port":443,"protocol":"TCP","bytes_sent":41121,"bytes_recv":72707,"action":"allowed","firewall_rule":"ALLOW-OUT-103"},"raw":{"event_id":"EVT-0087","source_type":"network","timestamp":"2026-06-13T02:11:29.423126Z","event_name":"network_connection","src_ip":"10.0.4.20","dst_ip":"10.0.3.29","dst_port":443,"protocol":"TCP","bytes_sent":41121,"bytes_recv":72707,"action":"allowed","firewall_rule":"ALLOW-OUT-103"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0069","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-13T02:16:28.485202Z","entities":[{"entityId":"ipv4:10.0.2.15","type":"ipv4","rawValue":"10.0.2.15","normalizedValue":"10.0.2.15","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0069","role":"src_ip"},{"entityId":"ipv4:10.0.2.26","type":"ipv4","rawValue":"10.0.2.26","normalizedValue":"10.0.2.26","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0069","role":"dst_ip"},{"entityId":"endpoint:10.0.2.26:22","type":"endpoint","rawValue":"10.0.2.26:22","normalizedValue":"10.0.2.26:22","normalizationMethod":"verbatim","sourceObservationId":"EVT-0069","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.2.15","dst_ip":"10.0.2.26","dst_port":22,"protocol":"TCP","bytes_sent":3792,"bytes_recv":106187,"action":"allowed","firewall_rule":"ALLOW-OUT-149"},"raw":{"event_id":"EVT-0069","source_type":"network","timestamp":"2026-06-13T02:16:28.485202Z","event_name":"network_connection","src_ip":"10.0.2.15","dst_ip":"10.0.2.26","dst_port":22,"protocol":"TCP","bytes_sent":3792,"bytes_recv":106187,"action":"allowed","firewall_rule":"ALLOW-OUT-149"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0057","sourceType":"auth","eventType":"failed_logon","timestamp":"2026-06-13T02:22:03.427384Z","entities":[{"entityId":"user:glee","type":"user","rawValue":"glee","normalizedValue":"glee","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0057","role":"actor_user"},{"entityId":"host:WKSTN-06","type":"host","rawValue":"WKSTN-06","normalizedValue":"WKSTN-06","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0057","role":"source_host"},{"entityId":"host:AUTH-SRV-01","type":"host","rawValue":"AUTH-SRV-01","normalizedValue":"AUTH-SRV-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0057","role":"dest_host"},{"entityId":"ipv4:10.0.5.165","type":"ipv4","rawValue":"10.0.5.165","normalizedValue":"10.0.5.165","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0057","role":"source_ip"}],"attributes":{"username":"glee","source_host":"WKSTN-06","dest_host":"AUTH-SRV-01","logon_type":"interactive","result":"success","source_ip":"10.0.5.165"},"raw":{"event_id":"EVT-0057","source_type":"auth","timestamp":"2026-06-13T02:22:03.427384Z","event_name":"failed_logon","username":"glee","source_host":"WKSTN-06","dest_host":"AUTH-SRV-01","logon_type":"interactive","result":"success","source_ip":"10.0.5.165"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0211","sourceType":"cloud_storage","eventType":"file_upload","timestamp":"2026-06-13T02:42:29.565021Z","entities":[{"entityId":"user:iharris","type":"user","rawValue":"iharris","normalizedValue":"iharris","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0211","role":"actor_user"},{"entityId":"ipv4:10.0.5.10","type":"ipv4","rawValue":"10.0.5.10","normalizedValue":"10.0.5.10","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0211","role":"source_ip"},{"entityId":"bucket:corp-documents","type":"bucket","rawValue":"corp-documents","normalizedValue":"corp-documents","normalizationMethod":"verbatim","sourceObservationId":"EVT-0211","role":"bucket"},{"entityId":"cloud_object:corp-documents/Product_Roadmap_v3.pptx","type":"cloud_object","rawValue":"corp-documents/Product_Roadmap_v3.pptx","normalizedValue":"corp-documents/Product_Roadmap_v3.pptx","normalizationMethod":"verbatim","sourceObservationId":"EVT-0211","role":"cloud_object"}],"attributes":{"username":"iharris","source_ip":"10.0.5.10","file_name":"Product_Roadmap_v3.pptx","file_size_bytes":2605871,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"raw":{"event_id":"EVT-0211","source_type":"cloud_storage","timestamp":"2026-06-13T02:42:29.565021Z","event_name":"file_upload","username":"iharris","source_ip":"10.0.5.10","file_name":"Product_Roadmap_v3.pptx","file_size_bytes":2605871,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0120","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-13T02:45:58.680196Z","entities":[{"entityId":"ipv4:10.0.2.22","type":"ipv4","rawValue":"10.0.2.22","normalizedValue":"10.0.2.22","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0120","role":"src_ip"},{"entityId":"ipv4:10.0.1.11","type":"ipv4","rawValue":"10.0.1.11","normalizedValue":"10.0.1.11","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0120","role":"dst_ip"},{"entityId":"endpoint:10.0.1.11:25","type":"endpoint","rawValue":"10.0.1.11:25","normalizedValue":"10.0.1.11:25","normalizationMethod":"verbatim","sourceObservationId":"EVT-0120","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.2.22","dst_ip":"10.0.1.11","dst_port":25,"protocol":"UDP","bytes_sent":14583,"bytes_recv":70210,"action":"allowed","firewall_rule":"ALLOW-OUT-102"},"raw":{"event_id":"EVT-0120","source_type":"network","timestamp":"2026-06-13T02:45:58.680196Z","event_name":"network_connection","src_ip":"10.0.2.22","dst_ip":"10.0.1.11","dst_port":25,"protocol":"UDP","bytes_sent":14583,"bytes_recv":70210,"action":"allowed","firewall_rule":"ALLOW-OUT-102"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0033","sourceType":"auth","eventType":"user_logoff","timestamp":"2026-06-13T02:58:23.165329Z","entities":[{"entityId":"user:cjohnson","type":"user","rawValue":"cjohnson","normalizedValue":"cjohnson","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0033","role":"actor_user"},{"entityId":"host:WKSTN-05","type":"host","rawValue":"WKSTN-05","normalizedValue":"WKSTN-05","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0033","role":"source_host"},{"entityId":"host:AUTH-SRV-01","type":"host","rawValue":"AUTH-SRV-01","normalizedValue":"AUTH-SRV-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0033","role":"dest_host"},{"entityId":"ipv4:10.0.4.187","type":"ipv4","rawValue":"10.0.4.187","normalizedValue":"10.0.4.187","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0033","role":"source_ip"}],"attributes":{"username":"cjohnson","source_host":"WKSTN-05","dest_host":"AUTH-SRV-01","logon_type":"interactive","result":"success","source_ip":"10.0.4.187"},"raw":{"event_id":"EVT-0033","source_type":"auth","timestamp":"2026-06-13T02:58:23.165329Z","event_name":"user_logoff","username":"cjohnson","source_host":"WKSTN-05","dest_host":"AUTH-SRV-01","logon_type":"interactive","result":"success","source_ip":"10.0.4.187"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0141","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-13T03:04:15.015833Z","entities":[{"entityId":"host:WKSTN-08","type":"host","rawValue":"WKSTN-08","normalizedValue":"WKSTN-08","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0141","role":"host"},{"entityId":"user:cjohnson","type":"user","rawValue":"cjohnson","normalizedValue":"cjohnson","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0141","role":"actor_user"},{"entityId":"process:WKSTN-08:6181","type":"process","rawValue":"6181","normalizedValue":"6181","normalizationMethod":"verbatim","sourceObservationId":"EVT-0141","role":"process"}],"attributes":{"hostname":"WKSTN-08","username":"cjohnson","process_name":"notepad.exe","parent_process":"explorer.exe","process_path":"C:\\Program Files\\Google\\","command_line":"","pid":6181,"integrity_level":"medium"},"raw":{"event_id":"EVT-0141","source_type":"endpoint","timestamp":"2026-06-13T03:04:15.015833Z","event_name":"process_create","hostname":"WKSTN-08","username":"cjohnson","process_name":"notepad.exe","parent_process":"explorer.exe","process_path":"C:\\Program Files\\Google\\","command_line":"","pid":6181,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0032","sourceType":"auth","eventType":"failed_logon","timestamp":"2026-06-13T03:34:49.698945Z","entities":[{"entityId":"user:dtaylor","type":"user","rawValue":"dtaylor","normalizedValue":"dtaylor","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0032","role":"actor_user"},{"entityId":"host:WKSTN-06","type":"host","rawValue":"WKSTN-06","normalizedValue":"WKSTN-06","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0032","role":"source_host"},{"entityId":"host:AUTH-SRV-02","type":"host","rawValue":"AUTH-SRV-02","normalizedValue":"AUTH-SRV-02","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0032","role":"dest_host"},{"entityId":"ipv4:10.0.4.182","type":"ipv4","rawValue":"10.0.4.182","normalizedValue":"10.0.4.182","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0032","role":"source_ip"}],"attributes":{"username":"dtaylor","source_host":"WKSTN-06","dest_host":"AUTH-SRV-02","logon_type":"remote_interactive","result":"success","source_ip":"10.0.4.182"},"raw":{"event_id":"EVT-0032","source_type":"auth","timestamp":"2026-06-13T03:34:49.698945Z","event_name":"failed_logon","username":"dtaylor","source_host":"WKSTN-06","dest_host":"AUTH-SRV-02","logon_type":"remote_interactive","result":"success","source_ip":"10.0.4.182"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0190","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-13T04:07:27.113794Z","entities":[{"entityId":"host:WKSTN-01","type":"host","rawValue":"WKSTN-01","normalizedValue":"WKSTN-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0190","role":"host"},{"entityId":"user:iharris","type":"user","rawValue":"iharris","normalizedValue":"iharris","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0190","role":"actor_user"},{"entityId":"process:WKSTN-01:3131","type":"process","rawValue":"3131","normalizedValue":"3131","normalizationMethod":"verbatim","sourceObservationId":"EVT-0190","role":"process"}],"attributes":{"hostname":"WKSTN-01","username":"iharris","process_name":"chrome.exe","parent_process":"outlook.exe","process_path":"C:\\Program Files\\Slack\\","command_line":"","pid":3131,"integrity_level":"medium"},"raw":{"event_id":"EVT-0190","source_type":"endpoint","timestamp":"2026-06-13T04:07:27.113794Z","event_name":"process_create","hostname":"WKSTN-01","username":"iharris","process_name":"chrome.exe","parent_process":"outlook.exe","process_path":"C:\\Program Files\\Slack\\","command_line":"","pid":3131,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0162","sourceType":"endpoint","eventType":"process_create","timestamp":"2026-06-13T04:08:50.678413Z","entities":[{"entityId":"host:WKSTN-01","type":"host","rawValue":"WKSTN-01","normalizedValue":"WKSTN-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0162","role":"host"},{"entityId":"user:bwilliams","type":"user","rawValue":"bwilliams","normalizedValue":"bwilliams","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0162","role":"actor_user"},{"entityId":"process:WKSTN-01:9691","type":"process","rawValue":"9691","normalizedValue":"9691","normalizationMethod":"verbatim","sourceObservationId":"EVT-0162","role":"process"}],"attributes":{"hostname":"WKSTN-01","username":"bwilliams","process_name":"explorer.exe","parent_process":"outlook.exe","process_path":"C:\\Program Files\\Google\\","command_line":"","pid":9691,"integrity_level":"medium"},"raw":{"event_id":"EVT-0162","source_type":"endpoint","timestamp":"2026-06-13T04:08:50.678413Z","event_name":"process_create","hostname":"WKSTN-01","username":"bwilliams","process_name":"explorer.exe","parent_process":"outlook.exe","process_path":"C:\\Program Files\\Google\\","command_line":"","pid":9691,"integrity_level":"medium"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0109","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-13T04:21:51.608932Z","entities":[{"entityId":"ipv4:10.0.5.15","type":"ipv4","rawValue":"10.0.5.15","normalizedValue":"10.0.5.15","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0109","role":"src_ip"},{"entityId":"ipv4:10.0.3.14","type":"ipv4","rawValue":"10.0.3.14","normalizedValue":"10.0.3.14","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0109","role":"dst_ip"},{"entityId":"endpoint:10.0.3.14:443","type":"endpoint","rawValue":"10.0.3.14:443","normalizedValue":"10.0.3.14:443","normalizationMethod":"verbatim","sourceObservationId":"EVT-0109","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.5.15","dst_ip":"10.0.3.14","dst_port":443,"protocol":"UDP","bytes_sent":47532,"bytes_recv":53845,"action":"allowed","firewall_rule":"ALLOW-OUT-145"},"raw":{"event_id":"EVT-0109","source_type":"network","timestamp":"2026-06-13T04:21:51.608932Z","event_name":"network_connection","src_ip":"10.0.5.15","dst_ip":"10.0.3.14","dst_port":443,"protocol":"UDP","bytes_sent":47532,"bytes_recv":53845,"action":"allowed","firewall_rule":"ALLOW-OUT-145"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0212","sourceType":"cloud_storage","eventType":"file_download","timestamp":"2026-06-13T04:51:58.957297Z","entities":[{"entityId":"user:jclark","type":"user","rawValue":"jclark","normalizedValue":"jclark","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0212","role":"actor_user"},{"entityId":"ipv4:10.0.3.23","type":"ipv4","rawValue":"10.0.3.23","normalizedValue":"10.0.3.23","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0212","role":"source_ip"},{"entityId":"bucket:corp-documents","type":"bucket","rawValue":"corp-documents","normalizedValue":"corp-documents","normalizationMethod":"verbatim","sourceObservationId":"EVT-0212","role":"bucket"},{"entityId":"cloud_object:corp-documents/Meeting_Notes_Jun10.docx","type":"cloud_object","rawValue":"corp-documents/Meeting_Notes_Jun10.docx","normalizedValue":"corp-documents/Meeting_Notes_Jun10.docx","normalizationMethod":"verbatim","sourceObservationId":"EVT-0212","role":"cloud_object"}],"attributes":{"username":"jclark","source_ip":"10.0.3.23","file_name":"Meeting_Notes_Jun10.docx","file_size_bytes":2148713,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"raw":{"event_id":"EVT-0212","source_type":"cloud_storage","timestamp":"2026-06-13T04:51:58.957297Z","event_name":"file_download","username":"jclark","source_ip":"10.0.3.23","file_name":"Meeting_Notes_Jun10.docx","file_size_bytes":2148713,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0138","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-13T05:07:38.576349Z","entities":[{"entityId":"ipv4:10.0.1.27","type":"ipv4","rawValue":"10.0.1.27","normalizedValue":"10.0.1.27","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0138","role":"src_ip"},{"entityId":"ipv4:10.0.2.14","type":"ipv4","rawValue":"10.0.2.14","normalizedValue":"10.0.2.14","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0138","role":"dst_ip"},{"entityId":"endpoint:10.0.2.14:443","type":"endpoint","rawValue":"10.0.2.14:443","normalizedValue":"10.0.2.14:443","normalizationMethod":"verbatim","sourceObservationId":"EVT-0138","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.1.27","dst_ip":"10.0.2.14","dst_port":443,"protocol":"UDP","bytes_sent":38504,"bytes_recv":106676,"action":"allowed","firewall_rule":"ALLOW-OUT-192"},"raw":{"event_id":"EVT-0138","source_type":"network","timestamp":"2026-06-13T05:07:38.576349Z","event_name":"network_connection","src_ip":"10.0.1.27","dst_ip":"10.0.2.14","dst_port":443,"protocol":"UDP","bytes_sent":38504,"bytes_recv":106676,"action":"allowed","firewall_rule":"ALLOW-OUT-192"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0193","sourceType":"cloud_storage","eventType":"file_view","timestamp":"2026-06-13T05:39:45.933394Z","entities":[{"entityId":"user:dtaylor","type":"user","rawValue":"dtaylor","normalizedValue":"dtaylor","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0193","role":"actor_user"},{"entityId":"ipv4:10.0.1.12","type":"ipv4","rawValue":"10.0.1.12","normalizedValue":"10.0.1.12","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0193","role":"source_ip"},{"entityId":"bucket:corp-documents","type":"bucket","rawValue":"corp-documents","normalizedValue":"corp-documents","normalizationMethod":"verbatim","sourceObservationId":"EVT-0193","role":"bucket"},{"entityId":"cloud_object:corp-documents/Meeting_Notes_Jun10.docx","type":"cloud_object","rawValue":"corp-documents/Meeting_Notes_Jun10.docx","normalizedValue":"corp-documents/Meeting_Notes_Jun10.docx","normalizationMethod":"verbatim","sourceObservationId":"EVT-0193","role":"cloud_object"}],"attributes":{"username":"dtaylor","source_ip":"10.0.1.12","file_name":"Meeting_Notes_Jun10.docx","file_size_bytes":3549898,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"raw":{"event_id":"EVT-0193","source_type":"cloud_storage","timestamp":"2026-06-13T05:39:45.933394Z","event_name":"file_view","username":"dtaylor","source_ip":"10.0.1.12","file_name":"Meeting_Notes_Jun10.docx","file_size_bytes":3549898,"bucket":"corp-documents","action":"allowed","user_agent":"OneDriveSyncClient/22.201"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0013","sourceType":"auth","eventType":"user_logon","timestamp":"2026-06-13T05:44:47.093107Z","entities":[{"entityId":"user:ewhite","type":"user","rawValue":"ewhite","normalizedValue":"ewhite","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0013","role":"actor_user"},{"entityId":"host:WKSTN-01","type":"host","rawValue":"WKSTN-01","normalizedValue":"WKSTN-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0013","role":"source_host"},{"entityId":"host:AUTH-SRV-01","type":"host","rawValue":"AUTH-SRV-01","normalizedValue":"AUTH-SRV-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0013","role":"dest_host"},{"entityId":"ipv4:10.0.5.189","type":"ipv4","rawValue":"10.0.5.189","normalizedValue":"10.0.5.189","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0013","role":"source_ip"}],"attributes":{"username":"ewhite","source_host":"WKSTN-01","dest_host":"AUTH-SRV-01","logon_type":"interactive","result":"success","source_ip":"10.0.5.189"},"raw":{"event_id":"EVT-0013","source_type":"auth","timestamp":"2026-06-13T05:44:47.093107Z","event_name":"user_logon","username":"ewhite","source_host":"WKSTN-01","dest_host":"AUTH-SRV-01","logon_type":"interactive","result":"success","source_ip":"10.0.5.189"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0022","sourceType":"auth","eventType":"user_logon","timestamp":"2026-06-13T06:28:21.009868Z","entities":[{"entityId":"user:cjohnson","type":"user","rawValue":"cjohnson","normalizedValue":"cjohnson","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0022","role":"actor_user"},{"entityId":"host:WKSTN-08","type":"host","rawValue":"WKSTN-08","normalizedValue":"WKSTN-08","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0022","role":"source_host"},{"entityId":"host:AUTH-SRV-01","type":"host","rawValue":"AUTH-SRV-01","normalizedValue":"AUTH-SRV-01","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0022","role":"dest_host"},{"entityId":"ipv4:10.0.3.134","type":"ipv4","rawValue":"10.0.3.134","normalizedValue":"10.0.3.134","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0022","role":"source_ip"}],"attributes":{"username":"cjohnson","source_host":"WKSTN-08","dest_host":"AUTH-SRV-01","logon_type":"network","result":"success","source_ip":"10.0.3.134"},"raw":{"event_id":"EVT-0022","source_type":"auth","timestamp":"2026-06-13T06:28:21.009868Z","event_name":"user_logon","username":"cjohnson","source_host":"WKSTN-08","dest_host":"AUTH-SRV-01","logon_type":"network","result":"success","source_ip":"10.0.3.134"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0103","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-13T06:54:52.808353Z","entities":[{"entityId":"ipv4:10.0.1.17","type":"ipv4","rawValue":"10.0.1.17","normalizedValue":"10.0.1.17","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0103","role":"src_ip"},{"entityId":"ipv4:10.0.5.10","type":"ipv4","rawValue":"10.0.5.10","normalizedValue":"10.0.5.10","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0103","role":"dst_ip"},{"entityId":"endpoint:10.0.5.10:22","type":"endpoint","rawValue":"10.0.5.10:22","normalizedValue":"10.0.5.10:22","normalizationMethod":"verbatim","sourceObservationId":"EVT-0103","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.1.17","dst_ip":"10.0.5.10","dst_port":22,"protocol":"TCP","bytes_sent":15613,"bytes_recv":174398,"action":"allowed","firewall_rule":"ALLOW-OUT-194"},"raw":{"event_id":"EVT-0103","source_type":"network","timestamp":"2026-06-13T06:54:52.808353Z","event_name":"network_connection","src_ip":"10.0.1.17","dst_ip":"10.0.5.10","dst_port":22,"protocol":"TCP","bytes_sent":15613,"bytes_recv":174398,"action":"allowed","firewall_rule":"ALLOW-OUT-194"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0007","sourceType":"auth","eventType":"user_logon","timestamp":"2026-06-13T07:19:39.837409Z","entities":[{"entityId":"user:bwilliams","type":"user","rawValue":"bwilliams","normalizedValue":"bwilliams","normalizationMethod":"lowercase-user","sourceObservationId":"EVT-0007","role":"actor_user"},{"entityId":"host:WKSTN-02","type":"host","rawValue":"WKSTN-02","normalizedValue":"WKSTN-02","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0007","role":"source_host"},{"entityId":"host:AUTH-SRV-02","type":"host","rawValue":"AUTH-SRV-02","normalizedValue":"AUTH-SRV-02","normalizationMethod":"uppercase-host","sourceObservationId":"EVT-0007","role":"dest_host"},{"entityId":"ipv4:10.0.3.144","type":"ipv4","rawValue":"10.0.3.144","normalizedValue":"10.0.3.144","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0007","role":"source_ip"}],"attributes":{"username":"bwilliams","source_host":"WKSTN-02","dest_host":"AUTH-SRV-02","logon_type":"interactive","result":"failure","source_ip":"10.0.3.144"},"raw":{"event_id":"EVT-0007","source_type":"auth","timestamp":"2026-06-13T07:19:39.837409Z","event_name":"user_logon","username":"bwilliams","source_host":"WKSTN-02","dest_host":"AUTH-SRV-02","logon_type":"interactive","result":"failure","source_ip":"10.0.3.144"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0085","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-13T07:24:21.751627Z","entities":[{"entityId":"ipv4:10.0.3.27","type":"ipv4","rawValue":"10.0.3.27","normalizedValue":"10.0.3.27","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0085","role":"src_ip"},{"entityId":"ipv4:10.0.4.23","type":"ipv4","rawValue":"10.0.4.23","normalizedValue":"10.0.4.23","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0085","role":"dst_ip"},{"entityId":"endpoint:10.0.4.23:22","type":"endpoint","rawValue":"10.0.4.23:22","normalizedValue":"10.0.4.23:22","normalizationMethod":"verbatim","sourceObservationId":"EVT-0085","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.3.27","dst_ip":"10.0.4.23","dst_port":22,"protocol":"TCP","bytes_sent":6806,"bytes_recv":141311,"action":"allowed","firewall_rule":"ALLOW-OUT-104"},"raw":{"event_id":"EVT-0085","source_type":"network","timestamp":"2026-06-13T07:24:21.751627Z","event_name":"network_connection","src_ip":"10.0.3.27","dst_ip":"10.0.4.23","dst_port":22,"protocol":"TCP","bytes_sent":6806,"bytes_recv":141311,"action":"allowed","firewall_rule":"ALLOW-OUT-104"},"adapter":{"id":"siem-json","version":"1"}},{"observationId":"EVT-0078","sourceType":"network","eventType":"network_connection","timestamp":"2026-06-13T07:41:34.251699Z","entities":[{"entityId":"ipv4:10.0.5.27","type":"ipv4","rawValue":"10.0.5.27","normalizedValue":"10.0.5.27","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0078","role":"src_ip"},{"entityId":"ipv4:151.101.65.140","type":"ipv4","rawValue":"151.101.65.140","normalizedValue":"151.101.65.140","normalizationMethod":"verbatim-ip","sourceObservationId":"EVT-0078","role":"dst_ip"},{"entityId":"endpoint:151.101.65.140:22","type":"endpoint","rawValue":"151.101.65.140:22","normalizedValue":"151.101.65.140:22","normalizationMethod":"verbatim","sourceObservationId":"EVT-0078","role":"dest_endpoint"}],"attributes":{"src_ip":"10.0.5.27","dst_ip":"151.101.65.140","dst_port":22,"protocol":"TCP","bytes_sent":37648,"bytes_recv":176992,"action":"allowed","firewall_rule":"ALLOW-OUT-132"},"raw":{"event_id":"EVT-0078","source_type":"network","timestamp":"2026-06-13T07:41:34.251699Z","event_name":"network_connection","src_ip":"10.0.5.27","dst_ip":"151.101.65.140","dst_port":22,"protocol":"TCP","bytes_sent":37648,"bytes_recv":176992,"action":"allowed","firewall_rule":"ALLOW-OUT-132"},"adapter":{"id":"siem-json","version":"1"}}],"relationships":[{"relationshipId":"rel_0939f1e464f16e02","relationshipType":"actor_host_activity","observationRefs":["EVT-0221","EVT-0222"],"entityRefs":["host:WKSTN-07","user:jdavis","process:WKSTN-07:4872","process:WKSTN-07:5104"],"rule":{"id":"actor-host-activity","version":"1"},"score":100,"maxScore":100,"explanation":{"matchedFactors":[{"factor":"sameHost","description":"Both actions occur on the same host","weight":30,"matched":true,"value":"host:WKSTN-07"},{"factor":"sameUser","description":"Both actions are attributed to the same user","weight":30,"matched":true,"value":"user:jdavis"},{"factor":"consecutive","description":"The two actions are temporally adjacent for that user on that host","weight":25,"matched":true},{"factor":"withinWindow","description":"Second action falls within the activity window","weight":15,"matched":true,"value":2000}],"unmatchedFactors":[]},"startTime":"2026-06-10T08:12:33Z","endTime":"2026-06-10T08:12:35Z"},{"relationshipId":"rel_7677da129f60f5ff","relationshipType":"process_lineage","observationRefs":["EVT-0221","EVT-0222"],"entityRefs":["host:WKSTN-07","user:jdavis","process:WKSTN-07:4872","process:WKSTN-07:5104"],"rule":{"id":"process-lineage","version":"1"},"score":100,"maxScore":100,"explanation":{"matchedFactors":[{"factor":"sameHost","description":"Both observations occur on the same host","weight":30,"matched":true,"value":"host:WKSTN-07"},{"factor":"sameUser","description":"Both observations share the same user","weight":20,"matched":true,"value":"user:jdavis"},{"factor":"directLineage","description":"child.parent_process equals parent.process_name","weight":30,"matched":true,"value":"cmd.exe -> powershell.exe"},{"factor":"withinWindow","description":"Observations fall inside the configured time window","weight":10,"matched":true,"value":2000},{"factor":"monotonicTime","description":"child starts at or after parent","weight":10,"matched":true}],"unmatchedFactors":[]},"startTime":"2026-06-10T08:12:33Z","endTime":"2026-06-10T08:12:35Z"},{"relationshipId":"rel_6b8664fc8ea94ca2","relationshipType":"process_egress","observationRefs":["EVT-0221","EVT-0223"],"entityRefs":["host:WKSTN-07","user:jdavis","process:WKSTN-07:4872","ipv4:10.0.2.47","ipv4:185.220.101.45","endpoint:185.220.101.45:443"],"rule":{"id":"process-network","version":"1"},"score":100,"maxScore":100,"explanation":{"matchedFactors":[{"factor":"sameHost","description":"The network egress originates from the host where the process ran","weight":35,"matched":true,"value":"host:WKSTN-07"},{"factor":"processThenEgress","description":"An outbound external connection follows a process launch on that host","weight":35,"matched":true,"value":"EVT-0221 -> EVT-0223"},{"factor":"externalDestination","description":"The connection targets an external address","weight":20,"matched":true,"value":"185.220.101.45"},{"factor":"interpreter","description":"The preceding process is a script interpreter/shell (common C2 launcher)","weight":10,"matched":true,"value":"cmd.exe"}],"unmatchedFactors":[]},"startTime":"2026-06-10T08:12:33Z","endTime":"2026-06-10T09:03:17Z"},{"relationshipId":"rel_41e1d389af71e938","relationshipType":"process_egress","observationRefs":["EVT-0222","EVT-0223"],"entityRefs":["host:WKSTN-07","user:jdavis","process:WKSTN-07:5104","ipv4:10.0.2.47","ipv4:185.220.101.45","endpoint:185.220.101.45:443"],"rule":{"id":"process-network","version":"1"},"score":100,"maxScore":100,"explanation":{"matchedFactors":[{"factor":"sameHost","description":"The network egress originates from the host where the process ran","weight":35,"matched":true,"value":"host:WKSTN-07"},{"factor":"processThenEgress","description":"An outbound external connection follows a process launch on that host","weight":35,"matched":true,"value":"EVT-0222 -> EVT-0223"},{"factor":"externalDestination","description":"The connection targets an external address","weight":20,"matched":true,"value":"185.220.101.45"},{"factor":"interpreter","description":"The preceding process is a script interpreter/shell (common C2 launcher)","weight":10,"matched":true,"value":"powershell.exe"}],"unmatchedFactors":[]},"startTime":"2026-06-10T08:12:35Z","endTime":"2026-06-10T09:03:17Z"},{"relationshipId":"rel_84f2efde7f63e0df","relationshipType":"c2_beacon","observationRefs":["EVT-0223","EVT-0224","EVT-0225"],"entityRefs":["ipv4:10.0.2.47","ipv4:185.220.101.45","host:WKSTN-07","endpoint:185.220.101.45:443"],"rule":{"id":"c2-beacon","version":"1"},"score":100,"maxScore":100,"explanation":{"matchedFactors":[{"factor":"repeatedExternalContact","description":"The same internal host contacts the same external IP more than once","weight":45,"matched":true,"value":3},{"factor":"sameDestPort","description":"Repeated contacts use the same destination port","weight":20,"matched":true,"value":443},{"factor":"regularCadence","description":"Contacts recur at a roughly regular cadence (beaconing)","weight":25,"matched":true,"value":0.005},{"factor":"namedHost","description":"The internal endpoint resolves to a named host","weight":10,"matched":true,"value":"host:WKSTN-07"}],"unmatchedFactors":[]},"startTime":"2026-06-10T09:03:17Z","endTime":"2026-06-10T09:34:21Z"},{"relationshipId":"rel_7cff5a58b6dcf055","relationshipType":"egress_flow","observationRefs":["EVT-0223"],"entityRefs":["ipv4:10.0.2.47","ipv4:185.220.101.45","host:WKSTN-07","endpoint:185.220.101.45:443"],"rule":{"id":"host-network-flow","version":"1"},"score":100,"maxScore":100,"explanation":{"matchedFactors":[{"factor":"outboundExternal","description":"Connection egresses from an internal host to an external destination","weight":40,"matched":true,"value":"10.0.2.47 -> 185.220.101.45"},{"factor":"allowed","description":"Firewall action allowed the connection","weight":15,"matched":true,"value":"allowed"},{"factor":"namedSourceHost","description":"Source IP resolves to a named host","weight":25,"matched":true,"value":"host:WKSTN-07"},{"factor":"significantVolume","description":"Bytes transferred exceed a nominal beacon threshold","weight":20,"matched":true,"value":86855}],"unmatchedFactors":[]},"startTime":"2026-06-10T09:03:17Z","endTime":"2026-06-10T09:03:17Z"},{"relationshipId":"rel_bc30fe02ac81c27f","relationshipType":"egress_flow","observationRefs":["EVT-0224"],"entityRefs":["ipv4:10.0.2.47","ipv4:185.220.101.45","host:WKSTN-07","endpoint:185.220.101.45:443"],"rule":{"id":"host-network-flow","version":"1"},"score":100,"maxScore":100,"explanation":{"matchedFactors":[{"factor":"outboundExternal","description":"Connection egresses from an internal host to an external destination","weight":40,"matched":true,"value":"10.0.2.47 -> 185.220.101.45"},{"factor":"allowed","description":"Firewall action allowed the connection","weight":15,"matched":true,"value":"allowed"},{"factor":"namedSourceHost","description":"Source IP resolves to a named host","weight":25,"matched":true,"value":"host:WKSTN-07"},{"factor":"significantVolume","description":"Bytes transferred exceed a nominal beacon threshold","weight":20,"matched":true,"value":5613}],"unmatchedFactors":[]},"startTime":"2026-06-10T09:18:44Z","endTime":"2026-06-10T09:18:44Z"},{"relationshipId":"rel_e185f43459a19b77","relationshipType":"egress_flow","observationRefs":["EVT-0225"],"entityRefs":["ipv4:10.0.2.47","ipv4:185.220.101.45","host:WKSTN-07","endpoint:185.220.101.45:443"],"rule":{"id":"host-network-flow","version":"1"},"score":100,"maxScore":100,"explanation":{"matchedFactors":[{"factor":"outboundExternal","description":"Connection egresses from an internal host to an external destination","weight":40,"matched":true,"value":"10.0.2.47 -> 185.220.101.45"},{"factor":"allowed","description":"Firewall action allowed the connection","weight":15,"matched":true,"value":"allowed"},{"factor":"namedSourceHost","description":"Source IP resolves to a named host","weight":25,"matched":true,"value":"host:WKSTN-07"},{"factor":"significantVolume","description":"Bytes transferred exceed a nominal beacon threshold","weight":20,"matched":true,"value":4188}],"unmatchedFactors":[]},"startTime":"2026-06-10T09:34:21Z","endTime":"2026-06-10T09:34:21Z"},{"relationshipId":"rel_2fc1e2d819f1d0d1","relationshipType":"actor_host_activity","observationRefs":["EVT-0226","EVT-0227"],"entityRefs":["host:WKSTN-07","user:jdavis","process:WKSTN-07:5104","process:WKSTN-07:612","file:C:\\Users\\jdavis\\AppData\\Local\\Temp\\~df4a12.tmp"],"rule":{"id":"actor-host-activity","version":"1"},"score":100,"maxScore":100,"explanation":{"matchedFactors":[{"factor":"sameHost","description":"Both actions occur on the same host","weight":30,"matched":true,"value":"host:WKSTN-07"},{"factor":"sameUser","description":"Both actions are attributed to the same user","weight":30,"matched":true,"value":"user:jdavis"},{"factor":"consecutive","description":"The two actions are temporally adjacent for that user on that host","weight":25,"matched":true},{"factor":"withinWindow","description":"Second action falls within the activity window","weight":15,"matched":true,"value":12000}],"unmatchedFactors":[]},"startTime":"2026-06-10T10:07:51Z","endTime":"2026-06-10T10:08:03Z"},{"relationshipId":"rel_911fbdf121802983","relationshipType":"credential_access","observationRefs":["EVT-0226","EVT-0227"],"entityRefs":["host:WKSTN-07","user:jdavis","process:WKSTN-07:5104","process:WKSTN-07:612","file:C:\\Users\\jdavis\\AppData\\Local\\Temp\\~df4a12.tmp"],"rule":{"id":"credential-access","version":"1"},"score":100,"maxScore":100,"explanation":{"matchedFactors":[{"factor":"processAccess","description":"A process_access observation targets a sensitive system process","weight":45,"matched":true,"value":"lsass.exe"},{"factor":"sameHost","description":"The follow-on file is created on the same host","weight":20,"matched":true,"value":"host:WKSTN-07"},{"factor":"fileWriteAfter","description":"A file_create follows the access within the window","weight":25,"matched":true,"value":"EVT-0227"},{"factor":"largeArtifact","description":"The written file is large enough to be a memory dump","weight":10,"matched":true,"value":14823322}],"unmatchedFactors":[]},"startTime":"2026-06-10T10:07:51Z","endTime":"2026-06-10T10:08:03Z"},{"relationshipId":"rel_e19519e87f175b93","relationshipType":"remote_authentication","observationRefs":["EVT-0228","EVT-0229"],"entityRefs":["user:jdavis","host:WKSTN-07","host:AUTH-SRV-01","ipv4:10.0.2.47","ipv4:10.0.1.10","process:AUTH-SRV-01:2341"],"rule":{"id":"remote-authentication","version":"1"},"score":100,"maxScore":100,"explanation":{"matchedFactors":[{"factor":"networkLogon","description":"A successful network logon lands on the destination host","weight":35,"matched":true,"value":"host:AUTH-SRV-01"},{"factor":"activityOnDest","description":"Endpoint activity by the same user follows on the destination host","weight":35,"matched":true,"value":"EVT-0229"},{"factor":"sameUser","description":"The logon and the follow-on activity share the same user","weight":20,"matched":true,"value":"user:jdavis"},{"factor":"elevated","description":"The follow-on activity runs elevated","weight":10,"matched":true,"value":"high"}],"unmatchedFactors":[]},"startTime":"2026-06-10T11:22:14Z","endTime":"2026-06-10T11:23:08Z"},{"relationshipId":"rel_30e54ca7752ab77e","relationshipType":"actor_host_activity","observationRefs":["EVT-0229","EVT-0230"],"entityRefs":["host:AUTH-SRV-01","user:jdavis","process:AUTH-SRV-01:2341","process:AUTH-SRV-01:2398"],"rule":{"id":"actor-host-activity","version":"1"},"score":100,"maxScore":100,"explanation":{"matchedFactors":[{"factor":"sameHost","description":"Both actions occur on the same host","weight":30,"matched":true,"value":"host:AUTH-SRV-01"},{"factor":"sameUser","description":"Both actions are attributed to the same user","weight":30,"matched":true,"value":"user:jdavis"},{"factor":"consecutive","description":"The two actions are temporally adjacent for that user on that host","weight":25,"matched":true},{"factor":"withinWindow","description":"Second action falls within the activity window","weight":15,"matched":true,"value":334000}],"unmatchedFactors":[]},"startTime":"2026-06-10T11:23:08Z","endTime":"2026-06-10T11:28:42Z"},{"relationshipId":"rel_1d0a35a5c29aa141","relationshipType":"process_lineage","observationRefs":["EVT-0180","EVT-0190"],"entityRefs":["host:WKSTN-01","user:bwilliams","process:WKSTN-01:2577","user:iharris","process:WKSTN-01:3131"],"rule":{"id":"process-lineage","version":"1"},"score":70,"maxScore":100,"explanation":{"matchedFactors":[{"factor":"sameHost","description":"Both observations occur on the same host","weight":30,"matched":true,"value":"host:WKSTN-01"},{"factor":"directLineage","description":"child.parent_process equals parent.process_name","weight":30,"matched":true,"value":"outlook.exe -> chrome.exe"},{"factor":"monotonicTime","description":"child starts at or after parent","weight":10,"matched":true}],"unmatchedFactors":[{"factor":"sameUser","description":"Both observations share the same user","weight":20,"matched":false,"value":"user:iharris"},{"factor":"withinWindow","description":"Observations fall inside the configured time window","weight":10,"matched":false,"value":230428285}]},"startTime":"2026-06-10T12:06:58.828725Z","endTime":"2026-06-13T04:07:27.113794Z"},{"relationshipId":"rel_2909cdb826efd836","relationshipType":"process_lineage","observationRefs":["EVT-0180","EVT-0162"],"entityRefs":["host:WKSTN-01","user:bwilliams","process:WKSTN-01:2577","process:WKSTN-01:9691"],"rule":{"id":"process-lineage","version":"1"},"score":90,"maxScore":100,"explanation":{"matchedFactors":[{"factor":"sameHost","description":"Both observations occur on the same host","weight":30,"matched":true,"value":"host:WKSTN-01"},{"factor":"sameUser","description":"Both observations share the same user","weight":20,"matched":true,"value":"user:bwilliams"},{"factor":"directLineage","description":"child.parent_process equals parent.process_name","weight":30,"matched":true,"value":"outlook.exe -> explorer.exe"},{"factor":"monotonicTime","description":"child starts at or after parent","weight":10,"matched":true}],"unmatchedFactors":[{"factor":"withinWindow","description":"Observations fall inside the configured time window","weight":10,"matched":false,"value":230511850}]},"startTime":"2026-06-10T12:06:58.828725Z","endTime":"2026-06-13T04:08:50.678413Z"},{"relationshipId":"rel_85245e6d2010f6b9","relationshipType":"process_lineage","observationRefs":["EVT-0180","EVT-0171"],"entityRefs":["host:WKSTN-01","user:bwilliams","process:WKSTN-01:2577","user:dtaylor","process:WKSTN-01:4253"],"rule":{"id":"process-lineage","version":"1"},"score":70,"maxScore":100,"explanation":{"matchedFactors":[{"factor":"sameHost","description":"Both observations occur on the same host","weight":30,"matched":true,"value":"host:WKSTN-01"},{"factor":"directLineage","description":"child.parent_process equals parent.process_name","weight":30,"matched":true,"value":"outlook.exe -> notepad.exe"},{"factor":"monotonicTime","description":"child starts at or after parent","weight":10,"matched":true}],"unmatchedFactors":[{"factor":"sameUser","description":"Both observations share the same user","weight":20,"matched":false,"value":"user:dtaylor"},{"factor":"withinWindow","description":"Observations fall inside the configured time window","weight":10,"matched":false,"value":87765162}]},"startTime":"2026-06-10T12:06:58.828725Z","endTime":"2026-06-11T12:29:43.990005Z"},{"relationshipId":"rel_a6afab38abbaa54a","relationshipType":"process_lineage","observationRefs":["EVT-0180","EVT-0144"],"entityRefs":["host:WKSTN-01","user:bwilliams","process:WKSTN-01:2577","user:jclark","process:WKSTN-01:9736"],"rule":{"id":"process-lineage","version":"1"},"score":70,"maxScore":100,"explanation":{"matchedFactors":[{"factor":"sameHost","description":"Both observations occur on the same host","weight":30,"matched":true,"value":"host:WKSTN-01"},{"factor":"directLineage","description":"child.parent_process equals parent.process_name","weight":30,"matched":true,"value":"outlook.exe -> explorer.exe"},{"factor":"monotonicTime","description":"child starts at or after parent","weight":10,"matched":true}],"unmatchedFactors":[{"factor":"sameUser","description":"Both observations share the same user","weight":20,"matched":false,"value":"user:jclark"},{"factor":"withinWindow","description":"Observations fall inside the configured time window","weight":10,"matched":false,"value":94842506}]},"startTime":"2026-06-10T12:06:58.828725Z","endTime":"2026-06-11T14:27:41.334185Z"},{"relationshipId":"rel_e01f16b7077efdad","relationshipType":"lateral_movement","observationRefs":["EVT-0231","EVT-0232"],"entityRefs":["ipv4:10.0.1.10","ipv4:10.0.1.22","host:AUTH-SRV-01","host:FILE-SRV-02","endpoint:10.0.1.22:445","user:jdavis","service:FILE-SRV-02:PSEXESVC"],"rule":{"id":"lateral-movement","version":"1"},"score":100,"maxScore":100,"explanation":{"matchedFactors":[{"factor":"internalPair","description":"Connection is between two internal hosts","weight":25,"matched":true,"value":"10.0.1.10 -> 10.0.1.22"},{"factor":"namedHostPair","description":"Both source and destination resolve to named hosts","weight":25,"matched":true,"value":"host:AUTH-SRV-01 -> host:FILE-SRV-02"},{"factor":"adminPort","description":"Destination port is a remote-admin/lateral port (445/3389/5985/22/135)","weight":30,"matched":true,"value":445},{"factor":"followedByExecution","description":"A process/service is created on the destination host shortly after","weight":20,"matched":true,"value":"EVT-0232"}],"unmatchedFactors":[]},"startTime":"2026-06-10T13:11:33Z","endTime":"2026-06-10T13:12:04Z"},{"relationshipId":"rel_377b5e159dfa11bb","relationshipType":"actor_host_activity","observationRefs":["EVT-0232","EVT-0233"],"entityRefs":["host:FILE-SRV-02","user:jdavis","service:FILE-SRV-02:PSEXESVC","process:FILE-SRV-02:3871"],"rule":{"id":"actor-host-activity","version":"1"},"score":100,"maxScore":100,"explanation":{"matchedFactors":[{"factor":"sameHost","description":"Both actions occur on the same host","weight":30,"matched":true,"value":"host:FILE-SRV-02"},{"factor":"sameUser","description":"Both actions are attributed to the same user","weight":30,"matched":true,"value":"user:jdavis"},{"factor":"consecutive","description":"The two actions are temporally adjacent for that user on that host","weight":25,"matched":true},{"factor":"withinWindow","description":"Second action falls within the activity window","weight":15,"matched":true,"value":3000}],"unmatchedFactors":[]},"startTime":"2026-06-10T13:12:04Z","endTime":"2026-06-10T13:12:07Z"},{"relationshipId":"rel_94a3dff146addda7","relationshipType":"indicator_removal","observationRefs":["EVT-0232","EVT-0241"],"entityRefs":["host:FILE-SRV-02","user:jdavis","service:FILE-SRV-02:PSEXESVC"],"rule":{"id":"indicator-removal","version":"1"},"score":100,"maxScore":100,"explanation":{"matchedFactors":[{"factor":"removesPriorArtifact","description":"Deletion targets a file or service that was created earlier on the same host","weight":55,"matched":true,"value":"psexesvc"},{"factor":"sameHost","description":"Creation and removal occur on the same host","weight":25,"matched":true,"value":"host:FILE-SRV-02"},{"factor":"afterCreate","description":"Removal happens after the creation","weight":20,"matched":true}],"unmatchedFactors":[]},"startTime":"2026-06-10T13:12:04Z","endTime":"2026-06-10T20:05:38Z"},{"relationshipId":"rel_c3149da4d35bf861","relationshipType":"service_execution","observationRefs":["EVT-0232","EVT-0233"],"entityRefs":["host:FILE-SRV-02","user:jdavis","service:FILE-SRV-02:PSEXESVC","process:FILE-SRV-02:3871"],"rule":{"id":"service-execution","version":"1"},"score":100,"maxScore":100,"explanation":{"matchedFactors":[{"factor":"serviceCreate","description":"A service is created on the host","weight":30,"matched":true,"value":"PSEXESVC"},{"factor":"childProcessFromService","description":"A process is spawned whose parent is the created service binary","weight":40,"matched":true,"value":"cmd.exe"},{"factor":"elevated","description":"The spawned process runs at high/system integrity","weight":20,"matched":true,"value":"system"},{"factor":"withinWindow","description":"Process spawns within the window of service creation","weight":10,"matched":true,"value":3000}],"unmatchedFactors":[]},"startTime":"2026-06-10T13:12:04Z","endTime":"2026-06-10T13:12:07Z"},{"relationshipId":"rel_80a7f1a9e48c203f","relationshipType":"process_lineage","observationRefs":["EVT-0233","EVT-0234"],"entityRefs":["host:FILE-SRV-02","user:jdavis","process:FILE-SRV-02:3871","process:FILE-SRV-02:4012"],"rule":{"id":"process-lineage","version":"1"},"score":90,"maxScore":100,"explanation":{"matchedFactors":[{"factor":"sameHost","description":"Both observations occur on the same host","weight":30,"matched":true,"value":"host:FILE-SRV-02"},{"factor":"sameUser","description":"Both observations share the same user","weight":20,"matched":true,"value":"user:jdavis"},{"factor":"directLineage","description":"child.parent_process equals parent.process_name","weight":30,"matched":true,"value":"cmd.exe -> net.exe"},{"factor":"monotonicTime","description":"child starts at or after parent","weight":10,"matched":true}],"unmatchedFactors":[{"factor":"withinWindow","description":"Observations fall inside the configured time window","weight":10,"matched":false,"value":3195000}]},"startTime":"2026-06-10T13:12:07Z","endTime":"2026-06-10T14:05:22Z"},{"relationshipId":"rel_c3504efdff29d0bd","relationshipType":"process_lineage","observationRefs":["EVT-0233","EVT-0235"],"entityRefs":["host:FILE-SRV-02","user:jdavis","process:FILE-SRV-02:3871","process:FILE-SRV-02:4044"],"rule":{"id":"process-lineage","version":"1"},"score":90,"maxScore":100,"explanation":{"matchedFactors":[{"factor":"sameHost","description":"Both observations occur on the same host","weight":30,"matched":true,"value":"host:FILE-SRV-02"},{"factor":"sameUser","description":"Both observations share the same user","weight":20,"matched":true,"value":"user:jdavis"},{"factor":"directLineage","description":"child.parent_process equals parent.process_name","weight":30,"matched":true,"value":"cmd.exe -> cmd.exe"},{"factor":"monotonicTime","description":"child starts at or after parent","weight":10,"matched":true}],"unmatchedFactors":[{"factor":"withinWindow","description":"Observations fall inside the configured time window","weight":10,"matched":false,"value":3348000}]},"startTime":"2026-06-10T13:12:07Z","endTime":"2026-06-10T14:07:55Z"},{"relationshipId":"rel_cb1574c78f6d4056","relationshipType":"process_lineage","observationRefs":["EVT-0233","EVT-0236"],"entityRefs":["host:FILE-SRV-02","user:jdavis","process:FILE-SRV-02:3871","process:FILE-SRV-02:5521"],"rule":{"id":"process-lineage","version":"1"},"score":90,"maxScore":100,"explanation":{"matchedFactors":[{"factor":"sameHost","description":"Both observations occur on the same host","weight":30,"matched":true,"value":"host:FILE-SRV-02"},{"factor":"sameUser","description":"Both observations share the same user","weight":20,"matched":true,"value":"user:jdavis"},{"factor":"directLineage","description":"child.parent_process equals parent.process_name","weight":30,"matched":true,"value":"cmd.exe -> 7z.exe"},{"factor":"monotonicTime","description":"child starts at or after parent","weight":10,"matched":true}],"unmatchedFactors":[{"factor":"withinWindow","description":"Observations fall inside the configured time window","weight":10,"matched":false,"value":12125000}]},"startTime":"2026-06-10T13:12:07Z","endTime":"2026-06-10T16:34:12Z"},{"relationshipId":"rel_0780f89e83cc23a9","relationshipType":"actor_host_activity","observationRefs":["EVT-0234","EVT-0235"],"entityRefs":["host:FILE-SRV-02","user:jdavis","process:FILE-SRV-02:4012","process:FILE-SRV-02:4044"],"rule":{"id":"actor-host-activity","version":"1"},"score":100,"maxScore":100,"explanation":{"matchedFactors":[{"factor":"sameHost","description":"Both actions occur on the same host","weight":30,"matched":true,"value":"host:FILE-SRV-02"},{"factor":"sameUser","description":"Both actions are attributed to the same user","weight":30,"matched":true,"value":"user:jdavis"},{"factor":"consecutive","description":"The two actions are temporally adjacent for that user on that host","weight":25,"matched":true},{"factor":"withinWindow","description":"Second action falls within the activity window","weight":15,"matched":true,"value":153000}],"unmatchedFactors":[]},"startTime":"2026-06-10T14:05:22Z","endTime":"2026-06-10T14:07:55Z"},{"relationshipId":"rel_bf63a511d673f1d5","relationshipType":"process_lineage","observationRefs":["EVT-0235","EVT-0236"],"entityRefs":["host:FILE-SRV-02","user:jdavis","process:FILE-SRV-02:4044","process:FILE-SRV-02:5521"],"rule":{"id":"process-lineage","version":"1"},"score":90,"maxScore":100,"explanation":{"matchedFactors":[{"factor":"sameHost","description":"Both observations occur on the same host","weight":30,"matched":true,"value":"host:FILE-SRV-02"},{"factor":"sameUser","description":"Both observations share the same user","weight":20,"matched":true,"value":"user:jdavis"},{"factor":"directLineage","description":"child.parent_process equals parent.process_name","weight":30,"matched":true,"value":"cmd.exe -> 7z.exe"},{"factor":"monotonicTime","description":"child starts at or after parent","weight":10,"matched":true}],"unmatchedFactors":[{"factor":"withinWindow","description":"Observations fall inside the configured time window","weight":10,"matched":false,"value":8777000}]},"startTime":"2026-06-10T14:07:55Z","endTime":"2026-06-10T16:34:12Z"},{"relationshipId":"rel_2c1e45554bd3da5a","relationshipType":"actor_host_activity","observationRefs":["EVT-0236","EVT-0237"],"entityRefs":["host:FILE-SRV-02","user:jdavis","process:FILE-SRV-02:5521","file:C:\\Temp\\backup_archive.zip"],"rule":{"id":"actor-host-activity","version":"1"},"score":100,"maxScore":100,"explanation":{"matchedFactors":[{"factor":"sameHost","description":"Both actions occur on the same host","weight":30,"matched":true,"value":"host:FILE-SRV-02"},{"factor":"sameUser","description":"Both actions are attributed to the same user","weight":30,"matched":true,"value":"user:jdavis"},{"factor":"consecutive","description":"The two actions are temporally adjacent for that user on that host","weight":25,"matched":true},{"factor":"withinWindow","description":"Second action falls within the activity window","weight":15,"matched":true,"value":1011000}],"unmatchedFactors":[]},"startTime":"2026-06-10T16:34:12Z","endTime":"2026-06-10T16:51:03Z"},{"relationshipId":"rel_e956c4e26edf014c","relationshipType":"data_staging","observationRefs":["EVT-0236","EVT-0237"],"entityRefs":["host:FILE-SRV-02","user:jdavis","process:FILE-SRV-02:5521","file:C:\\Temp\\backup_archive.zip"],"rule":{"id":"data-staging","version":"1"},"score":100,"maxScore":100,"explanation":{"matchedFactors":[{"factor":"archiveTool","description":"A known archiving tool (7z/rar/zip/tar) is executed","weight":35,"matched":true,"value":"7z.exe"},{"factor":"archiveArtifact","description":"An archive file is created on the same host after the tool runs","weight":35,"matched":true,"value":"C:\\Temp\\backup_archive.zip"},{"factor":"outputPathMatch","description":"The created archive matches the tool's output path/name","weight":20,"matched":true,"value":"backup_archive.zip"},{"factor":"largeArtifact","description":"The archive is large (bulk collection)","weight":10,"matched":true,"value":2473829122}],"unmatchedFactors":[]},"startTime":"2026-06-10T16:34:12Z","endTime":"2026-06-10T16:51:03Z"},{"relationshipId":"rel_9b04eaf1d95b73db","relationshipType":"cloud_exfiltration","observationRefs":["EVT-0237","EVT-0238"],"entityRefs":["host:FILE-SRV-02","user:jdavis","file:C:\\Temp\\backup_archive.zip","ipv4:10.0.1.22","bucket:ext-drop-xf9q2","cloud_object:ext-drop-xf9q2/backup_archive.zip"],"rule":{"id":"cloud-exfiltration","version":"1"},"score":100,"maxScore":100,"explanation":{"matchedFactors":[{"factor":"externalBucket","description":"Upload destination bucket is owned by an external party","weight":35,"matched":true,"value":"ext-drop-xf9q2"},{"factor":"uploadAction","description":"Cloud action is an upload/share","weight":20,"matched":true,"value":"file_upload"},{"factor":"matchesStagedArchive","description":"Uploaded file matches a previously staged archive by name and size","weight":30,"matched":true,"value":"backup_archive.zip @ 2473829122B"},{"factor":"largeTransfer","description":"Transferred volume is large","weight":15,"matched":true,"value":2473829122}],"unmatchedFactors":[]},"startTime":"2026-06-10T16:51:03Z","endTime":"2026-06-10T18:18:44Z"},{"relationshipId":"rel_64733faa5a66e953","relationshipType":"indicator_removal","observationRefs":["EVT-0237","EVT-0239"],"entityRefs":["host:FILE-SRV-02","user:jdavis","file:C:\\Temp\\backup_archive.zip"],"rule":{"id":"indicator-removal","version":"1"},"score":100,"maxScore":100,"explanation":{"matchedFactors":[{"factor":"removesPriorArtifact","description":"Deletion targets a file or service that was created earlier on the same host","weight":55,"matched":true,"value":"backup_archive.zip"},{"factor":"sameHost","description":"Creation and removal occur on the same host","weight":25,"matched":true,"value":"host:FILE-SRV-02"},{"factor":"afterCreate","description":"Removal happens after the creation","weight":20,"matched":true}],"unmatchedFactors":[]},"startTime":"2026-06-10T16:51:03Z","endTime":"2026-06-10T20:03:17Z"},{"relationshipId":"rel_543cb6b7e8e4ff63","relationshipType":"process_lineage","observationRefs":["EVT-0159","EVT-0155"],"entityRefs":["host:WKSTN-01","user:jclark","process:WKSTN-01:1052","user:cjohnson","process:WKSTN-01:9612"],"rule":{"id":"process-lineage","version":"1"},"score":70,"maxScore":100,"explanation":{"matchedFactors":[{"factor":"sameHost","description":"Both observations occur on the same host","weight":30,"matched":true,"value":"host:WKSTN-01"},{"factor":"directLineage","description":"child.parent_process equals parent.process_name","weight":30,"matched":true,"value":"teams.exe -> excel.exe"},{"factor":"monotonicTime","description":"child starts at or after parent","weight":10,"matched":true}],"unmatchedFactors":[{"factor":"sameUser","description":"Both observations share the same user","weight":20,"matched":false,"value":"user:cjohnson"},{"factor":"withinWindow","description":"Observations fall inside the configured time window","weight":10,"matched":false,"value":188405885}]},"startTime":"2026-06-10T18:19:08.876335Z","endTime":"2026-06-12T22:39:14.761511Z"},{"relationshipId":"rel_0cd7fc4a1756e7b8","relationshipType":"process_lineage","observationRefs":["EVT-0183","EVT-0176"],"entityRefs":["host:WKSTN-03","user:dtaylor","process:WKSTN-03:8921","user:hwalker","process:WKSTN-03:8230"],"rule":{"id":"process-lineage","version":"1"},"score":70,"maxScore":100,"explanation":{"matchedFactors":[{"factor":"sameHost","description":"Both observations occur on the same host","weight":30,"matched":true,"value":"host:WKSTN-03"},{"factor":"directLineage","description":"child.parent_process equals parent.process_name","weight":30,"matched":true,"value":"outlook.exe -> notepad.exe"},{"factor":"monotonicTime","description":"child starts at or after parent","weight":10,"matched":true}],"unmatchedFactors":[{"factor":"sameUser","description":"Both observations share the same user","weight":20,"matched":false,"value":"user:hwalker"},{"factor":"withinWindow","description":"Observations fall inside the configured time window","weight":10,"matched":false,"value":116621318}]},"startTime":"2026-06-10T18:51:47.084315Z","endTime":"2026-06-12T03:15:28.402358Z"},{"relationshipId":"rel_cd2f163cc2522e63","relationshipType":"actor_host_activity","observationRefs":["EVT-0239","EVT-0240"],"entityRefs":["host:FILE-SRV-02","user:jdavis","file:C:\\Temp\\backup_archive.zip","file:C:\\Temp\\7z.exe"],"rule":{"id":"actor-host-activity","version":"1"},"score":100,"maxScore":100,"explanation":{"matchedFactors":[{"factor":"sameHost","description":"Both actions occur on the same host","weight":30,"matched":true,"value":"host:FILE-SRV-02"},{"factor":"sameUser","description":"Both actions are attributed to the same user","weight":30,"matched":true,"value":"user:jdavis"},{"factor":"consecutive","description":"The two actions are temporally adjacent for that user on that host","weight":25,"matched":true},{"factor":"withinWindow","description":"Second action falls within the activity window","weight":15,"matched":true,"value":45000}],"unmatchedFactors":[]},"startTime":"2026-06-10T20:03:17Z","endTime":"2026-06-10T20:04:02Z"},{"relationshipId":"rel_2a48ee292b08f3ec","relationshipType":"actor_host_activity","observationRefs":["EVT-0240","EVT-0241"],"entityRefs":["host:FILE-SRV-02","user:jdavis","file:C:\\Temp\\7z.exe","service:FILE-SRV-02:PSEXESVC"],"rule":{"id":"actor-host-activity","version":"1"},"score":100,"maxScore":100,"explanation":{"matchedFactors":[{"factor":"sameHost","description":"Both actions occur on the same host","weight":30,"matched":true,"value":"host:FILE-SRV-02"},{"factor":"sameUser","description":"Both actions are attributed to the same user","weight":30,"matched":true,"value":"user:jdavis"},{"factor":"consecutive","description":"The two actions are temporally adjacent for that user on that host","weight":25,"matched":true},{"factor":"withinWindow","description":"Second action falls within the activity window","weight":15,"matched":true,"value":96000}],"unmatchedFactors":[]},"startTime":"2026-06-10T20:04:02Z","endTime":"2026-06-10T20:05:38Z"},{"relationshipId":"rel_ee58b4b2d5f16fcf","relationshipType":"authenticated_session","observationRefs":["EVT-0020","EVT-0060"],"entityRefs":["user:fmartinez","host:WKSTN-02","host:AUTH-SRV-01","ipv4:10.0.2.249","ipv4:10.0.1.219"],"rule":{"id":"authenticated-session","version":"1"},"score":85,"maxScore":100,"explanation":{"matchedFactors":[{"factor":"sameUser","description":"Logon and logoff share the same user","weight":30,"matched":true,"value":"user:fmartinez"},{"factor":"sameHostPair","description":"Logon and logoff share the same source/dest host pair","weight":30,"matched":true,"value":"user:fmartinez|host:WKSTN-02|host:AUTH-SRV-01"},{"factor":"logonBeforeLogoff","description":"A successful user_logon precedes a user_logoff","weight":25,"matched":true}],"unmatchedFactors":[{"factor":"withinWindow","description":"Logoff occurs within the session window","weight":15,"matched":false,"value":162307682}]},"startTime":"2026-06-10T23:30:40.097804Z","endTime":"2026-06-12T20:35:47.779696Z"},{"relationshipId":"rel_6fc19bdab346f9ed","relationshipType":"process_lineage","observationRefs":["EVT-0170","EVT-0147"],"entityRefs":["host:WKSTN-09","user:bwilliams","process:WKSTN-09:8067","user:fmartinez","process:WKSTN-09:6515"],"rule":{"id":"process-lineage","version":"1"},"score":70,"maxScore":100,"explanation":{"matchedFactors":[{"factor":"sameHost","description":"Both observations occur on the same host","weight":30,"matched":true,"value":"host:WKSTN-09"},{"factor":"directLineage","description":"child.parent_process equals parent.process_name","weight":30,"matched":true,"value":"outlook.exe -> slack.exe"},{"factor":"monotonicTime","description":"child starts at or after parent","weight":10,"matched":true}],"unmatchedFactors":[{"factor":"sameUser","description":"Both observations share the same user","weight":20,"matched":false,"value":"user:fmartinez"},{"factor":"withinWindow","description":"Observations fall inside the configured time window","weight":10,"matched":false,"value":41365288}]},"startTime":"2026-06-11T05:09:06.671408Z","endTime":"2026-06-11T16:38:31.959259Z"},{"relationshipId":"rel_ccd5f46e69ac2c8e","relationshipType":"egress_flow","observationRefs":["EVT-0126"],"entityRefs":["ipv4:10.0.4.20","ipv4:8.8.8.8","endpoint:8.8.8.8:443"],"rule":{"id":"host-network-flow","version":"1"},"score":75,"maxScore":100,"explanation":{"matchedFactors":[{"factor":"outboundExternal","description":"Connection egresses from an internal host to an external destination","weight":40,"matched":true,"value":"10.0.4.20 -> 8.8.8.8"},{"factor":"allowed","description":"Firewall action allowed the connection","weight":15,"matched":true,"value":"allowed"},{"factor":"significantVolume","description":"Bytes transferred exceed a nominal beacon threshold","weight":20,"matched":true,"value":36670}],"unmatchedFactors":[{"factor":"namedSourceHost","description":"Source IP resolves to a named host","weight":25,"matched":false}]},"startTime":"2026-06-11T11:16:40.019911Z","endTime":"2026-06-11T11:16:40.019911Z"},{"relationshipId":"rel_2716286741966063","relationshipType":"process_lineage","observationRefs":["EVT-0179","EVT-0177"],"entityRefs":["host:WKSTN-06","user:glee","process:WKSTN-06:6493","user:iharris","process:WKSTN-06:4780"],"rule":{"id":"process-lineage","version":"1"},"score":70,"maxScore":100,"explanation":{"matchedFactors":[{"factor":"sameHost","description":"Both observations occur on the same host","weight":30,"matched":true,"value":"host:WKSTN-06"},{"factor":"directLineage","description":"child.parent_process equals parent.process_name","weight":30,"matched":true,"value":"teams.exe -> word.exe"},{"factor":"monotonicTime","description":"child starts at or after parent","weight":10,"matched":true}],"unmatchedFactors":[{"factor":"sameUser","description":"Both observations share the same user","weight":20,"matched":false,"value":"user:iharris"},{"factor":"withinWindow","description":"Observations fall inside the configured time window","weight":10,"matched":false,"value":28158773}]},"startTime":"2026-06-11T11:44:31.430862Z","endTime":"2026-06-11T19:33:50.203756Z"},{"relationshipId":"rel_b2da9c57949d2750","relationshipType":"process_lineage","observationRefs":["EVT-0179","EVT-0157"],"entityRefs":["host:WKSTN-06","user:glee","process:WKSTN-06:6493","user:dtaylor","process:WKSTN-06:5459"],"rule":{"id":"process-lineage","version":"1"},"score":70,"maxScore":100,"explanation":{"matchedFactors":[{"factor":"sameHost","description":"Both observations occur on the same host","weight":30,"matched":true,"value":"host:WKSTN-06"},{"factor":"directLineage","description":"child.parent_process equals parent.process_name","weight":30,"matched":true,"value":"teams.exe -> notepad.exe"},{"factor":"monotonicTime","description":"child starts at or after parent","weight":10,"matched":true}],"unmatchedFactors":[{"factor":"sameUser","description":"Both observations share the same user","weight":20,"matched":false,"value":"user:dtaylor"},{"factor":"withinWindow","description":"Observations fall inside the configured time window","weight":10,"matched":false,"value":23148474}]},"startTime":"2026-06-11T11:44:31.430862Z","endTime":"2026-06-11T18:10:19.904909Z"},{"relationshipId":"rel_ffd214d59f8f33e7","relationshipType":"process_lineage","observationRefs":["EVT-0158","EVT-0161"],"entityRefs":["host:WKSTN-04","user:iharris","process:WKSTN-04:9163","user:ewhite","process:WKSTN-04:5409"],"rule":{"id":"process-lineage","version":"1"},"score":70,"maxScore":100,"explanation":{"matchedFactors":[{"factor":"sameHost","description":"Both observations occur on the same host","weight":30,"matched":true,"value":"host:WKSTN-04"},{"factor":"directLineage","description":"child.parent_process equals parent.process_name","weight":30,"matched":true,"value":"outlook.exe -> explorer.exe"},{"factor":"monotonicTime","description":"child starts at or after parent","weight":10,"matched":true}],"unmatchedFactors":[{"factor":"sameUser","description":"Both observations share the same user","weight":20,"matched":false,"value":"user:ewhite"},{"factor":"withinWindow","description":"Observations fall inside the configured time window","weight":10,"matched":false,"value":80599599}]},"startTime":"2026-06-11T17:07:26.334963Z","endTime":"2026-06-12T15:30:45.933847Z"},{"relationshipId":"rel_c10dfc02b204c4b2","relationshipType":"egress_flow","observationRefs":["EVT-0075"],"entityRefs":["ipv4:10.0.1.23","ipv4:151.101.65.140","endpoint:151.101.65.140:443"],"rule":{"id":"host-network-flow","version":"1"},"score":75,"maxScore":100,"explanation":{"matchedFactors":[{"factor":"outboundExternal","description":"Connection egresses from an internal host to an external destination","weight":40,"matched":true,"value":"10.0.1.23 -> 151.101.65.140"},{"factor":"allowed","description":"Firewall action allowed the connection","weight":15,"matched":true,"value":"allowed"},{"factor":"significantVolume","description":"Bytes transferred exceed a nominal beacon threshold","weight":20,"matched":true,"value":177164}],"unmatchedFactors":[{"factor":"namedSourceHost","description":"Source IP resolves to a named host","weight":25,"matched":false}]},"startTime":"2026-06-11T23:15:10.853857Z","endTime":"2026-06-11T23:15:10.853857Z"},{"relationshipId":"rel_a9f3d3582d652e24","relationshipType":"process_lineage","observationRefs":["EVT-0169","EVT-0145"],"entityRefs":["host:WKSTN-10","user:dtaylor","process:WKSTN-10:7640","user:bwilliams","process:WKSTN-10:6661"],"rule":{"id":"process-lineage","version":"1"},"score":70,"maxScore":100,"explanation":{"matchedFactors":[{"factor":"sameHost","description":"Both observations occur on the same host","weight":30,"matched":true,"value":"host:WKSTN-10"},{"factor":"directLineage","description":"child.parent_process equals parent.process_name","weight":30,"matched":true,"value":"outlook.exe -> word.exe"},{"factor":"monotonicTime","description":"child starts at or after parent","weight":10,"matched":true}],"unmatchedFactors":[{"factor":"sameUser","description":"Both observations share the same user","weight":20,"matched":false,"value":"user:bwilliams"},{"factor":"withinWindow","description":"Observations fall inside the configured time window","weight":10,"matched":false,"value":2889184}]},"startTime":"2026-06-11T23:56:24.035700Z","endTime":"2026-06-12T00:44:33.219009Z"},{"relationshipId":"rel_c0f9a0d0bb267d21","relationshipType":"process_lineage","observationRefs":["EVT-0169","EVT-0188"],"entityRefs":["host:WKSTN-10","user:dtaylor","process:WKSTN-10:7640","user:ewhite","process:WKSTN-10:4845"],"rule":{"id":"process-lineage","version":"1"},"score":70,"maxScore":100,"explanation":{"matchedFactors":[{"factor":"sameHost","description":"Both observations occur on the same host","weight":30,"matched":true,"value":"host:WKSTN-10"},{"factor":"directLineage","description":"child.parent_process equals parent.process_name","weight":30,"matched":true,"value":"outlook.exe -> slack.exe"},{"factor":"monotonicTime","description":"child starts at or after parent","weight":10,"matched":true}],"unmatchedFactors":[{"factor":"sameUser","description":"Both observations share the same user","weight":20,"matched":false,"value":"user:ewhite"},{"factor":"withinWindow","description":"Observations fall inside the configured time window","weight":10,"matched":false,"value":62046139}]},"startTime":"2026-06-11T23:56:24.035700Z","endTime":"2026-06-12T17:10:30.174600Z"},{"relationshipId":"rel_f968a43f0cba0f77","relationshipType":"egress_flow","observationRefs":["EVT-0105"],"entityRefs":["ipv4:10.0.5.21","ipv4:13.107.42.14","endpoint:13.107.42.14:25"],"rule":{"id":"host-network-flow","version":"1"},"score":75,"maxScore":100,"explanation":{"matchedFactors":[{"factor":"outboundExternal","description":"Connection egresses from an internal host to an external destination","weight":40,"matched":true,"value":"10.0.5.21 -> 13.107.42.14"},{"factor":"allowed","description":"Firewall action allowed the connection","weight":15,"matched":true,"value":"allowed"},{"factor":"significantVolume","description":"Bytes transferred exceed a nominal beacon threshold","weight":20,"matched":true,"value":47019}],"unmatchedFactors":[{"factor":"namedSourceHost","description":"Source IP resolves to a named host","weight":25,"matched":false}]},"startTime":"2026-06-12T09:37:39.772267Z","endTime":"2026-06-12T09:37:39.772267Z"},{"relationshipId":"rel_97cde3b0610ea5fb","relationshipType":"process_lineage","observationRefs":["EVT-0151","EVT-0141"],"entityRefs":["host:WKSTN-08","user:jclark","process:WKSTN-08:2949","user:cjohnson","process:WKSTN-08:6181"],"rule":{"id":"process-lineage","version":"1"},"score":70,"maxScore":100,"explanation":{"matchedFactors":[{"factor":"sameHost","description":"Both observations occur on the same host","weight":30,"matched":true,"value":"host:WKSTN-08"},{"factor":"directLineage","description":"child.parent_process equals parent.process_name","weight":30,"matched":true,"value":"explorer.exe -> notepad.exe"},{"factor":"monotonicTime","description":"child starts at or after parent","weight":10,"matched":true}],"unmatchedFactors":[{"factor":"sameUser","description":"Both observations share the same user","weight":20,"matched":false,"value":"user:cjohnson"},{"factor":"withinWindow","description":"Observations fall inside the configured time window","weight":10,"matched":false,"value":36935654}]},"startTime":"2026-06-12T16:48:39.361865Z","endTime":"2026-06-13T03:04:15.015833Z"},{"relationshipId":"rel_14310194fa6a1f34","relationshipType":"egress_flow","observationRefs":["EVT-0078"],"entityRefs":["ipv4:10.0.5.27","ipv4:151.101.65.140","endpoint:151.101.65.140:22"],"rule":{"id":"host-network-flow","version":"1"},"score":75,"maxScore":100,"explanation":{"matchedFactors":[{"factor":"outboundExternal","description":"Connection egresses from an internal host to an external destination","weight":40,"matched":true,"value":"10.0.5.27 -> 151.101.65.140"},{"factor":"allowed","description":"Firewall action allowed the connection","weight":15,"matched":true,"value":"allowed"},{"factor":"significantVolume","description":"Bytes transferred exceed a nominal beacon threshold","weight":20,"matched":true,"value":214640}],"unmatchedFactors":[{"factor":"namedSourceHost","description":"Source IP resolves to a named host","weight":25,"matched":false}]},"startTime":"2026-06-13T07:41:34.251699Z","endTime":"2026-06-13T07:41:34.251699Z"}],"chains":[{"chainId":"chain_a4057248d6c98892","observationRefs":["EVT-0020","EVT-0060","EVT-0141","EVT-0144","EVT-0145","EVT-0147","EVT-0151","EVT-0155","EVT-0157","EVT-0158","EVT-0159","EVT-0161","EVT-0162","EVT-0169","EVT-0170","EVT-0171","EVT-0176","EVT-0177","EVT-0179","EVT-0180","EVT-0183","EVT-0188","EVT-0190"],"relationshipRefs":["rel_0cd7fc4a1756e7b8","rel_1d0a35a5c29aa141","rel_2716286741966063","rel_2909cdb826efd836","rel_543cb6b7e8e4ff63","rel_6fc19bdab346f9ed","rel_85245e6d2010f6b9","rel_97cde3b0610ea5fb","rel_a6afab38abbaa54a","rel_a9f3d3582d652e24","rel_b2da9c57949d2750","rel_c0f9a0d0bb267d21","rel_ee58b4b2d5f16fcf","rel_ffd214d59f8f33e7"],"entityRefs":["host:AUTH-SRV-01","host:WKSTN-01","host:WKSTN-02","host:WKSTN-03","host:WKSTN-04","host:WKSTN-06","host:WKSTN-08","host:WKSTN-09","host:WKSTN-10","ipv4:10.0.1.219","ipv4:10.0.2.249","process:WKSTN-01:1052","process:WKSTN-01:2577","process:WKSTN-01:3131","process:WKSTN-01:4253","process:WKSTN-01:9612","process:WKSTN-01:9691","process:WKSTN-01:9736","process:WKSTN-03:8230","process:WKSTN-03:8921","process:WKSTN-04:5409","process:WKSTN-04:9163","process:WKSTN-06:4780","process:WKSTN-06:5459","process:WKSTN-06:6493","process:WKSTN-08:2949","process:WKSTN-08:6181","process:WKSTN-09:6515","process:WKSTN-09:8067","process:WKSTN-10:4845","process:WKSTN-10:6661","process:WKSTN-10:7640","user:bwilliams","user:cjohnson","user:dtaylor","user:ewhite","user:fmartinez","user:glee","user:hwalker","user:iharris","user:jclark"],"startTime":"2026-06-10T12:06:58.828725Z","endTime":"2026-06-13T04:08:50.678413Z","score":1015},{"chainId":"chain_6de39385750f8aa1","observationRefs":["EVT-0221","EVT-0222","EVT-0223","EVT-0224","EVT-0225","EVT-0226","EVT-0227","EVT-0228","EVT-0229","EVT-0230","EVT-0231","EVT-0232","EVT-0233","EVT-0234","EVT-0235","EVT-0236","EVT-0237","EVT-0238","EVT-0239","EVT-0240","EVT-0241"],"relationshipRefs":["rel_0780f89e83cc23a9","rel_0939f1e464f16e02","rel_2a48ee292b08f3ec","rel_2c1e45554bd3da5a","rel_2fc1e2d819f1d0d1","rel_30e54ca7752ab77e","rel_377b5e159dfa11bb","rel_41e1d389af71e938","rel_64733faa5a66e953","rel_6b8664fc8ea94ca2","rel_7677da129f60f5ff","rel_7cff5a58b6dcf055","rel_80a7f1a9e48c203f","rel_84f2efde7f63e0df","rel_911fbdf121802983","rel_94a3dff146addda7","rel_9b04eaf1d95b73db","rel_bc30fe02ac81c27f","rel_bf63a511d673f1d5","rel_c3149da4d35bf861","rel_c3504efdff29d0bd","rel_cb1574c78f6d4056","rel_cd2f163cc2522e63","rel_e01f16b7077efdad","rel_e185f43459a19b77","rel_e19519e87f175b93","rel_e956c4e26edf014c"],"entityRefs":["bucket:ext-drop-xf9q2","cloud_object:ext-drop-xf9q2/backup_archive.zip","endpoint:10.0.1.22:445","endpoint:185.220.101.45:443","file:C:\\Temp\\7z.exe","file:C:\\Temp\\backup_archive.zip","file:C:\\Users\\jdavis\\AppData\\Local\\Temp\\~df4a12.tmp","host:AUTH-SRV-01","host:FILE-SRV-02","host:WKSTN-07","ipv4:10.0.1.10","ipv4:10.0.1.22","ipv4:10.0.2.47","ipv4:185.220.101.45","process:AUTH-SRV-01:2341","process:AUTH-SRV-01:2398","process:FILE-SRV-02:3871","process:FILE-SRV-02:4012","process:FILE-SRV-02:4044","process:FILE-SRV-02:5521","process:WKSTN-07:4872","process:WKSTN-07:5104","process:WKSTN-07:612","service:FILE-SRV-02:PSEXESVC","user:jdavis"],"startTime":"2026-06-10T08:12:33Z","endTime":"2026-06-10T20:05:38Z","score":2660}],"warnings":[],"receipt":{"operation":"correlate","receiptId":"rcpt_e5e69884bf697092","input":{"digest":"sha256:5aad744715ca2216b32957275fd56cafc4333ac0461579b6f516c7149b156d73","observationCount":242},"rules":{"name":"platphorm-default","version":"1.0.0","digest":"sha256:f2ae9c855d24ca5481615a0c16933278720bdcdf485ca3a80397485d1cad30aa"},"configuration":{"digest":"sha256:d9ffab57e5dc97cd1e58d34226f27b9e3fd5f023d40131b1e1ebceb6c43495a7","internalNetworks":["10.0.0.0/8"]},"results":{"entityCount":315,"relationshipCount":45,"chainCount":2,"resultHash":"sha256:7e1d8f0ac7b0f42fb625ef401548f7d6f1639e1a68284305bca500e639e8562b"},"diagnostics":{"candidateCount":61,"cacheKey":"run_8ec8bd09aa3b9028","stages":[{"stage":"index","durationMs":3.991},{"stage":"rules","durationMs":33.915},{"stage":"entities","durationMs":2.394},{"stage":"chains","durationMs":1.42}],"contractVersion":"1"},"trace":{"traceparent":"00-2cc2cb138945b988f426ce209325965a-5d506713cb5f6e46-01"},"durationMs":41.292,"warnings":[]},"cached":false,"demo":{"groundTruthAnnotations":22,"metadata":{"organisation":"Meridian Health Partners (SYNTHETIC — FOR INTERVIEW USE ONLY)","incident_ref":"INC-2026-0610-001","collection_window_start":"2026-06-10T08:00:00Z","collection_window_end":"2026-06-13T08:00:00Z","total_events":242,"source_types":{"endpoint":"Windows Sysmon / EDR telemetry (process create, file events, service events)","auth":"Active Directory / Windows Security Event Log (logon, logoff, failed auth)","network":"Perimeter firewall NetFlow (connection records)","cloud_storage":"Cloud storage audit log (file upload/download/view/share/delete)"},"known_internal_subnets":["10.0.0.0/8"],"note":"Events are shuffled. Attack-related events are annotated with a \"note\" field beginning with \"ATTACK:\" — this field is present to help you validate your system during development; you may choose to strip it before your demo. Candidates are expected to reconstruct the attack chain through log correlation, not by filtering on the note field."}}}