{
  "id": "investigation-summary:0808d9fa-3047-47fe-89f5-25072e6b0b60",
  "type": "pcap-investigation-summary",
  "label": "PCAP investigation summary",
  "model": "gpt-4.1-2025-04-14",
  "stale": false,
  "status": "analyst-review-required",
  "content": "# PCAP investigation summary\n\n## What happened\n\nThe workstation Breaux-Win7-PC \\(10.0.0.227\\) participated in standard directory service protocol communication with 10.0.0.10, consistent with normal Windows logon activity and not by itself indicative of compromise.\n\nBreaux-Win7-PC \\(10.0.0.227\\) established sustained external TCP connections on port 21 to several public IPs, including 145.14.144.10, using protocols that could not be fully decoded; this is an investigation lead but does not alone establish malicious activity or compromise.\n\n## Who was involved\n\n- Breaux-Win7-PC was the primary host participating in the observed external and directory service network activity, bound to IP 10.0.0.227.\n- Account adriana.breaux was active on 10.0.0.227 during the capture window.\n- IP address 10.0.0.227 is the source of the relevant connections and protocol activity.\n\n## What remains uncertain\n\n- It remains unknown whether any malicious payload was downloaded or executed, as no file transfers or application-layer protocol payloads were observed or recoverable in the decrypted stream coverage.\n\n## Next check\n\n- Review the unidentified external TCP conversations to determine whether they correspond to legitimate FTP usage or potentially malicious activity by inspecting deeper payloads if available.\n\nAnalyst-review draft. Exact evidence references and provider provenance are retained in the structured record.",
  "summary": "The workstation Breaux-Win7-PC (10.0.0.227) participated in standard directory service protocol communication with 10.0.0.10, consistent with normal Windows logon activity and not by itself indicative of compromise. Breaux-Win7-PC (10.0.0.227) established sustained external TCP connections on port 21 to several public IPs, including 145.14.144.10, using protocols that could not be fully decoded; this is an investigation lead but does not alone establish malicious activity or compromise.",
  "coverage": {
    "warnings": [],
    "projection": "pcap-brief-evidence-v1",
    "source_digest": "30110b47eb7722b407caa6084fdbb6cbde0f12e5f8e17009e0f0244d32719fb9",
    "candidate_total": 0,
    "omitted_records": {
      "findings": 0,
      "artifacts": 2,
      "candidates": 0,
      "identities": 0,
      "techniques": 0,
      "selected_network_events": 0
    },
    "included_records": {
      "limits": 1,
      "capture": 1,
      "findings": 7,
      "identities": 3,
      "reputation_coverage": 1
    },
    "supplement_scope": "Bounded selected packet metadata, direct reputation, identities and transfer relationships; no payload bodies, prior-case content or exhaustive inventory. Full data remains in source analysis.",
    "source_characters": 5219,
    "enrichment_retained_targets": 7
  },
  "filename": "2019-05-02-traffic-analysis-exercise.pcap",
  "provider": "openai",
  "report_id": "pcap:d4027bcf-0ef6-4e3c-a68a-68dfe35adb33",
  "created_at": "2026-09-22T19:04:59.753272+00:00",
  "structured": {
    "iocs": [],
    "ttps": [],
    "identities": [
      {
        "kind": "host",
        "text": "Breaux-Win7-PC was the primary host participating in the observed external and directory service network activity, bound to IP 10.0.0.227.",
        "basis": "observed",
        "value": "Breaux-Win7-PC",
        "evidence": [
          {
            "end": 351,
            "quote": "{\"bindings\":[{\"account\":\"\",\"frame_number\":227,\"owner_ip\":\"0.0.0.0\",\"relationship\":\"dhcp-client-assertion\"},{\"account\":\"\",\"frame_number\":1,\"owner_ip\":\"10.0.0.227\",\"relationship\":\"netbios-registration\"}],\"ip_addresses\":[\"10.0.0.227\"],\"mac_addresses\":[\"84:8f:69:09:86:c0\",\"84:8f:69:09:86:c0,84:8f:69:09:86:c0\"],\"type\":\"hostname\",\"value\":\"Breaux-Win7-PC\"}",
            "start": 0,
            "reference": "/api/pcap/analyses/d4027bcf-0ef6-4e3c-a68a-68dfe35adb33#identity/identity-833cb5cc20f7fa5d2dd1e97b",
            "source_id": "S0006",
            "source_sha256": "61c5e0d8e01b86e92561a3d589fd2d1eba5c9f22939e3ca4e1fb9d426f9a4c85"
          }
        ]
      },
      {
        "kind": "account",
        "text": "Account adriana.breaux was active on 10.0.0.227 during the capture window.",
        "basis": "observed",
        "value": "adriana.breaux",
        "evidence": [
          {
            "end": 326,
            "quote": "{\"bindings\":[{\"account\":\"\",\"frame_number\":517,\"owner_ip\":\"10.0.0.227\",\"relationship\":\"kerberos-client-principal\"},{\"account\":\"\",\"frame_number\":525,\"owner_ip\":\"10.0.0.227\",\"relationship\":\"kerberos-client-principal\"}],\"ip_addresses\":[\"10.0.0.227\"],\"mac_addresses\":[\"84:8f:69:09:86:c0\"],\"type\":\"account\",\"value\":\"adriana.breaux\"}",
            "start": 0,
            "reference": "/api/pcap/analyses/d4027bcf-0ef6-4e3c-a68a-68dfe35adb33#identity/identity-e03f3a688297d3c17011a15d",
            "source_id": "S0004",
            "source_sha256": "b86ac5401c355905c4677c1868597c871612920fb5fe3ca5e3bb790ccfea2a9b"
          }
        ]
      },
      {
        "kind": "ip",
        "text": "IP address 10.0.0.227 is the source of the relevant connections and protocol activity.",
        "basis": "observed",
        "value": "10.0.0.227",
        "evidence": [
          {
            "end": 326,
            "quote": "{\"bindings\":[{\"account\":\"\",\"frame_number\":517,\"owner_ip\":\"10.0.0.227\",\"relationship\":\"kerberos-client-principal\"},{\"account\":\"\",\"frame_number\":525,\"owner_ip\":\"10.0.0.227\",\"relationship\":\"kerberos-client-principal\"}],\"ip_addresses\":[\"10.0.0.227\"],\"mac_addresses\":[\"84:8f:69:09:86:c0\"],\"type\":\"account\",\"value\":\"adriana.breaux\"}",
            "start": 0,
            "reference": "/api/pcap/analyses/d4027bcf-0ef6-4e3c-a68a-68dfe35adb33#identity/identity-e03f3a688297d3c17011a15d",
            "source_id": "S0004",
            "source_sha256": "b86ac5401c355905c4677c1868597c871612920fb5fe3ca5e3bb790ccfea2a9b"
          }
        ]
      }
    ],
    "next_steps": [
      {
        "text": "Review the unidentified external TCP conversations to determine whether they correspond to legitimate FTP usage or potentially malicious activity by inspecting deeper payloads if available.",
        "basis": "assessment",
        "evidence": [
          {
            "end": 473,
            "quote": "{\"explanation\":\"The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\",\"frames\":[836],\"metrics\":{\"destination\":\"145.14.144.10\",\"destination_port\":21,\"duration_seconds\":56.919,\"packets\":46,\"source\":\"10.0.0.227\",\"wire_bytes\":3452},\"rule_id\":\"unclassified-external-tcp\",\"title\":\"Sustained external TCP",
            "start": 0,
            "reference": "/api/pcap/analyses/d4027bcf-0ef6-4e3c-a68a-68dfe35adb33#finding/finding-ddcd0d75111cb2668d564863",
            "source_id": "S0009",
            "source_sha256": "1761b674bdfb795cef0bce6c658502cc5890e4750db06421e2197c5b4056a3cb"
          }
        ]
      }
    ],
    "uncertainties": [
      {
        "text": "It remains unknown whether any malicious payload was downloaded or executed, as no file transfers or application-layer protocol payloads were observed or recoverable in the decrypted stream coverage.",
        "basis": "assessment",
        "evidence": [
          {
            "end": 397,
            "quote": "{\"internal_lookup\":{\"matched_observables\":0,\"no_exact_match\":33,\"observable_limit\":5000,\"observables_checked\":33,\"observables_total\":33,\"prior_case_limit_reached\":true,\"prior_cases_checked\":50,\"truncated\":false},\"visibility\":\"Encrypted application payloads are not decrypted. No endpoint execution, persistence or actor attribution is established by a download or connection alone.\",\"warnings\":[]}",
            "start": 0,
            "reference": "/api/pcap/analyses/d4027bcf-0ef6-4e3c-a68a-68dfe35adb33#coverage",
            "source_id": "S0002",
            "source_sha256": "1663c3a81237ecb7dd442fb2334780d0b03c5ef85e3e04a53c5834a5f0a296e8"
          }
        ]
      }
    ],
    "what_happened": [
      {
        "text": "The workstation Breaux-Win7-PC (10.0.0.227) participated in standard directory service protocol communication with 10.0.0.10, consistent with normal Windows logon activity and not by itself indicative of compromise.",
        "basis": "assessment",
        "evidence": [
          {
            "end": 415,
            "quote": "{\"explanation\":\"Directory protocol operations were decoded. Normal Windows logon uses these protocols; activity alone does not establish discovery, credential theft, or DCSync.\",\"frames\":[37,72,75],\"metrics\":{\"destination\":\"10.0.0.10\",\"event_count\":41,\"operation_numbers\":[\"\",\"0\",\"2\",\"3\"],\"protocol\":\"ldap\",\"source\":\"10.0.0.227\"},\"rule_id\":\"directory-service-activity\",\"title\":\"Directory-service protocol activity\"}",
            "start": 0,
            "reference": "/api/pcap/analyses/d4027bcf-0ef6-4e3c-a68a-68dfe35adb33#finding/finding-36d7ca595484ef57966bb5c8",
            "source_id": "S0010",
            "source_sha256": "a7b49b3f3fa5dd11a5c85de6e47c35a328368c1ff07d8c42661850ed00bac128"
          }
        ]
      },
      {
        "text": "Breaux-Win7-PC (10.0.0.227) established sustained external TCP connections on port 21 to several public IPs, including 145.14.144.10, using protocols that could not be fully decoded; this is an investigation lead but does not alone establish malicious activity or compromise.",
        "basis": "assessment",
        "evidence": [
          {
            "end": 473,
            "quote": "{\"explanation\":\"The flow exchanges traffic with a public endpoint but has no HTTP/TLS/identity event in this profile. Inspect the stream for a custom protocol or a missing handshake. This is a coverage/investigation lead, not a malware verdict.\",\"frames\":[836],\"metrics\":{\"destination\":\"145.14.144.10\",\"destination_port\":21,\"duration_seconds\":56.919,\"packets\":46,\"source\":\"10.0.0.227\",\"wire_bytes\":3452},\"rule_id\":\"unclassified-external-tcp\",\"title\":\"Sustained external TCP",
            "start": 0,
            "reference": "/api/pcap/analyses/d4027bcf-0ef6-4e3c-a68a-68dfe35adb33#finding/finding-ddcd0d75111cb2668d564863",
            "source_id": "S0009",
            "source_sha256": "1761b674bdfb795cef0bce6c658502cc5890e4750db06421e2197c5b4056a3cb"
          }
        ]
      }
    ]
  },
  "validation": "schema-and-exact-quote-binding; not semantic proof",
  "word_count": 159,
  "analysis_id": "d4027bcf-0ef6-4e3c-a68a-68dfe35adb33",
  "token_usage": {
    "total_tokens": 11277,
    "prompt_tokens": 10231,
    "completion_tokens": 1046
  },
  "authoritative": false,
  "effective_tlp": "TLP:CLEAR",
  "source_sha256": "24024eaf0a98da3a67a66db76c8c861830cac16c9ad9ad06bce9bfee5576a64c",
  "capture_sha256": "41c9c4db17a58581eed3fc7f0bbebfe93c68034e2457afe131503c1a9eafac56",
  "prompt_version": "pcap-investigation-summary-v5",
  "requested_model": "gpt-4.1",
  "source_manifest": [
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "e34b93e3a00b7f6f83bae512a704751b491dcf59c37762fe16889aec33178531",
      "reference": "/api/pcap/analyses/d4027bcf-0ef6-4e3c-a68a-68dfe35adb33#capture",
      "source_id": "S0001"
    },
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "1663c3a81237ecb7dd442fb2334780d0b03c5ef85e3e04a53c5834a5f0a296e8",
      "reference": "/api/pcap/analyses/d4027bcf-0ef6-4e3c-a68a-68dfe35adb33#coverage",
      "source_id": "S0002"
    },
    {
      "kind": "intelligence_lead",
      "offset": 0,
      "sha256": "94af9c33179843cc7f21a1fa6914827b62c3af6c69bda6f207aeeb37eaae4bc3",
      "reference": "/api/pcap/analyses/d4027bcf-0ef6-4e3c-a68a-68dfe35adb33#enrichment-coverage",
      "source_id": "S0003"
    },
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "b86ac5401c355905c4677c1868597c871612920fb5fe3ca5e3bb790ccfea2a9b",
      "reference": "/api/pcap/analyses/d4027bcf-0ef6-4e3c-a68a-68dfe35adb33#identity/identity-e03f3a688297d3c17011a15d",
      "source_id": "S0004"
    },
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "f4b21fac7566dee03b3015f5a9623f2d1e1be08f2fd3a19b3f0f14f033e76815",
      "reference": "/api/pcap/analyses/d4027bcf-0ef6-4e3c-a68a-68dfe35adb33#identity/identity-81dba411a963f20986a0f7b8",
      "source_id": "S0005"
    },
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "61c5e0d8e01b86e92561a3d589fd2d1eba5c9f22939e3ca4e1fb9d426f9a4c85",
      "reference": "/api/pcap/analyses/d4027bcf-0ef6-4e3c-a68a-68dfe35adb33#identity/identity-833cb5cc20f7fa5d2dd1e97b",
      "source_id": "S0006"
    },
    {
      "kind": "rule_candidate",
      "offset": 0,
      "sha256": "fd175b212f445105347bcf9bea2ce133d7f4d8536e8e7366921387f04096ac82",
      "reference": "/api/pcap/analyses/d4027bcf-0ef6-4e3c-a68a-68dfe35adb33#finding/finding-0e8d6e589f99764788129f0e",
      "source_id": "S0007"
    },
    {
      "kind": "rule_candidate",
      "offset": 0,
      "sha256": "c53f37b4fc9cf1e9c29af38d47efaea36692a5d0e62221c728e4c296d2bc02c4",
      "reference": "/api/pcap/analyses/d4027bcf-0ef6-4e3c-a68a-68dfe35adb33#finding/finding-a9a25e3ecbf8ef4db44f4901",
      "source_id": "S0008"
    },
    {
      "kind": "rule_candidate",
      "offset": 0,
      "sha256": "1761b674bdfb795cef0bce6c658502cc5890e4750db06421e2197c5b4056a3cb",
      "reference": "/api/pcap/analyses/d4027bcf-0ef6-4e3c-a68a-68dfe35adb33#finding/finding-ddcd0d75111cb2668d564863",
      "source_id": "S0009"
    },
    {
      "kind": "rule_candidate",
      "offset": 0,
      "sha256": "a7b49b3f3fa5dd11a5c85de6e47c35a328368c1ff07d8c42661850ed00bac128",
      "reference": "/api/pcap/analyses/d4027bcf-0ef6-4e3c-a68a-68dfe35adb33#finding/finding-36d7ca595484ef57966bb5c8",
      "source_id": "S0010"
    },
    {
      "kind": "rule_candidate",
      "offset": 0,
      "sha256": "f1671dc7de56ef0e58812e2e98f94df189c66dd57c1a760dab5d67db1e12a5c5",
      "reference": "/api/pcap/analyses/d4027bcf-0ef6-4e3c-a68a-68dfe35adb33#finding/finding-6aa20e5174d7a82feaebf676",
      "source_id": "S0011"
    },
    {
      "kind": "rule_candidate",
      "offset": 0,
      "sha256": "520862caecf431e073e75d1648ba9355b6299680cbbd8313e96a66acfc7fc305",
      "reference": "/api/pcap/analyses/d4027bcf-0ef6-4e3c-a68a-68dfe35adb33#finding/finding-6e2ef5d4c5a117d79d58aa1c",
      "source_id": "S0012"
    },
    {
      "kind": "rule_candidate",
      "offset": 0,
      "sha256": "a065d1887888c0aedfc43678f400261a3ee59cff48531fdd0b27167cd54856c2",
      "reference": "/api/pcap/analyses/d4027bcf-0ef6-4e3c-a68a-68dfe35adb33#finding/finding-e0ded38dcb2f853105c0e03a",
      "source_id": "S0013"
    }
  ],
  "token_usage_note": "Provider-reported counts when available; never estimated from character length.",
  "generation_seconds": 69.796,
  "generation_attempts": [
    {
      "attempt": 1,
      "validation": "uncited_identifier",
      "token_usage": {
        "total_tokens": 5578,
        "prompt_tokens": 4995,
        "completion_tokens": 583,
        "prompt_tokens_details": {
          "audio_tokens": 0,
          "cached_tokens": 0
        },
        "completion_tokens_details": {
          "audio_tokens": 0,
          "reasoning_tokens": 0,
          "accepted_prediction_tokens": 0,
          "rejected_prediction_tokens": 0
        }
      },
      "finish_reason": "stop",
      "provider_returned_model": "gpt-4.1-2025-04-14"
    },
    {
      "attempt": 2,
      "validation": "passed",
      "token_usage": {
        "total_tokens": 5699,
        "prompt_tokens": 5236,
        "completion_tokens": 463,
        "prompt_tokens_details": {
          "audio_tokens": 0,
          "cached_tokens": 1920
        },
        "completion_tokens_details": {
          "audio_tokens": 0,
          "reasoning_tokens": 0,
          "accepted_prediction_tokens": 0,
          "rejected_prediction_tokens": 0
        }
      },
      "finish_reason": "stop",
      "provider_returned_model": "gpt-4.1-2025-04-14"
    }
  ],
  "validation_adjustments": [],
  "provider_returned_model": "gpt-4.1-2025-04-14"
}