{"metadata":{"customerIDString":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","offset":1234567890,"eventType":"AutomatedLeadSummaryEvent","eventCreationTime":1778476402000,"version":"1.0"},"event":{"LeadId":"cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc","Name":"host-1.example.local at 2026-05-11T05:11:47Z","SignalStartTimestamp":1778476307,"SignalEndTimestamp":1778476400,"SignalUpdatedTimestamp":1778476400,"Score":21,"ThreatgraphIndicators":[{"IndicatorId":"ind:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb:1778476306425098436-6004-19626768","SignalAssociationTimestamp":1778476307,"PatternId":6004,"PatternDisposition":0,"ProcessId":"1778476306425098436","HostId":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb","Hostname":"host-1.example.local","TemplateInstanceId":0,"Description":"A command intended to perform reconnaissance has executed under a web service.","DisplayName":"ReconUnderWebService"}],"MitreAttack":[{"PatternID":6004},{"Tactic":"Execution","TacticID":"TA0002","Technique":"Exploitation for Client Execution","TechniqueID":"T1203","PatternID":6017}],"LeadType":"simple","CompositeId":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:automated-lead:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc","FalconHostLink":"https://falcon.us-2.crowdstrike.com/automated-leads/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:automated-lead:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc?_cid=g04000aaaaaaaaaaaaaaaaaaaaaaaab"}}