{
  "id": "investigation-summary:241f2780-d4c1-4048-8bdd-09d4fb6c15f8",
  "type": "pcap-investigation-summary",
  "label": "PCAP investigation summary",
  "model": "gpt-4.1-2025-04-14",
  "stale": false,
  "status": "analyst-review-required",
  "content": "# PCAP investigation summary\n\n## What happened\n\nThe host 10.11.11.203 \\(TUCKER-WIN7-PC, candice.tucker\\) downloaded a file identified as a Windows executable \\(PE\\) from http://acjabogados.com/40group.tiff with SHA-256 8d5d36c8ffb0a9c81b145aa40c1ff3475702fb0b5f9e08e0577bdc405087e635.\n\nMultiple hosts in the environment, including TUCKER-WIN7-PC and others, retrieved various JavaScript files from reputable domains with no evidence in this data set of those scripts being malicious or executed beyond receiving them over HTTP.\n\n## Who was involved\n\n- 10.11.11.203 is identified as TUCKER-WIN7-PC and user candice.tucker.\n- User candice.tucker is associated with 10.11.11.203 \\(TUCKER-WIN7-PC\\).\n- TUCKER-WIN7-PC assigned to 10.11.11.203.\n\n## What remains uncertain\n\n- It is not confirmed whether the downloaded PE file on TUCKER-WIN7-PC was executed or resulted in compromise, as the capture contains only the transfer and no endpoint activity.\n- Reputation and threat context for the downloaded executable are not fully established due to rate limiting or lack of matches in enrichment sources at the time of analysis.\n\n## Next check\n\n- Further investigate the executable 8d5d36c8ffb0a9c81b145aa40c1ff3475702fb0b5f9e08e0577bdc405087e635 on TUCKER-WIN7-PC for signs of execution or persistent compromise.\n\nAnalyst-review draft. Exact evidence references and provider provenance are retained in the structured record.",
  "summary": "The host 10.11.11.203 (TUCKER-WIN7-PC, candice.tucker) downloaded a file identified as a Windows executable (PE) from http://acjabogados.com/40group.tiff with SHA-256 8d5d36c8ffb0a9c81b145aa40c1ff3475702fb0b5f9e08e0577bdc405087e635. Multiple hosts in the environment, including TUCKER-WIN7-PC and others, retrieved various JavaScript files from reputable domains with no evidence in this data set of those scripts being malicious or executed beyond receiving them over HTTP.",
  "coverage": {
    "warnings": [],
    "projection": "pcap-brief-evidence-v1",
    "source_digest": "77408943904e86f99cc74b1bc76f421d751b6e5a3c28f6ffc0f8e821c0a0665d",
    "candidate_total": 0,
    "omitted_records": {
      "findings": 58,
      "artifacts": 180,
      "candidates": 0,
      "identities": 0,
      "techniques": 0,
      "selected_network_events": 0
    },
    "included_records": {
      "limits": 1,
      "capture": 1,
      "findings": 10,
      "transfers": 11,
      "identities": 10,
      "techniques": 1,
      "reputation_coverage": 1
    },
    "supplement_scope": "Bounded selected packet metadata, direct reputation, identities and transfer relationships; no payload bodies, prior-case content or exhaustive inventory. Full data remains in source analysis.",
    "source_characters": 13941,
    "enrichment_retained_targets": 98
  },
  "filename": "2019-11-12-traffic-analysis-exercise.pcap",
  "provider": "openai",
  "report_id": "pcap:76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
  "created_at": "2026-09-22T18:59:56.895780+00:00",
  "structured": {
    "iocs": [],
    "ttps": [],
    "identities": [
      {
        "kind": "ip",
        "text": "10.11.11.203 is identified as TUCKER-WIN7-PC and user candice.tucker.",
        "basis": "observed",
        "value": "10.11.11.203",
        "evidence": [
          {
            "end": 334,
            "quote": "{\"bindings\":[{\"account\":\"\",\"frame_number\":3361,\"owner_ip\":\"10.11.11.203\",\"relationship\":\"kerberos-client-principal\"},{\"account\":\"\",\"frame_number\":3369,\"owner_ip\":\"10.11.11.203\",\"relationship\":\"kerberos-client-principal\"}],\"ip_addresses\":[\"10.11.11.203\"],\"mac_addresses\":[\"a4:ba:db:3a:45:72\"],\"type\":\"account\",\"value\":\"candice.tucker\"}",
            "start": 0,
            "reference": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8#identity/identity-9da27d34e33fd292dddb7e99",
            "source_id": "S0015",
            "source_sha256": "6b57f042458d53a6480951a51a73a69407f7523c665b3097936217466192720d"
          },
          {
            "end": 325,
            "quote": "{\"bindings\":[{\"account\":\"\",\"frame_number\":1273,\"owner_ip\":\"10.11.11.203\",\"relationship\":\"netbios-registration\"},{\"account\":\"\",\"frame_number\":1278,\"owner_ip\":\"10.11.11.203\",\"relationship\":\"netbios-registration\"}],\"ip_addresses\":[\"10.11.11.203\"],\"mac_addresses\":[\"a4:ba:db:3a:45:72\"],\"type\":\"hostname\",\"value\":\"TUCKER-WIN7-PC\"}",
            "start": 0,
            "reference": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8#identity/identity-e7a05d96e7ed7e5f4a557fe9",
            "source_id": "S0018",
            "source_sha256": "097e47136d4bd17714f814682db8f0f343b8112ec64ce3f2c7ef09e2c67aad00"
          }
        ]
      },
      {
        "kind": "account",
        "text": "User candice.tucker is associated with 10.11.11.203 (TUCKER-WIN7-PC).",
        "basis": "observed",
        "value": "candice.tucker",
        "evidence": [
          {
            "end": 334,
            "quote": "{\"bindings\":[{\"account\":\"\",\"frame_number\":3361,\"owner_ip\":\"10.11.11.203\",\"relationship\":\"kerberos-client-principal\"},{\"account\":\"\",\"frame_number\":3369,\"owner_ip\":\"10.11.11.203\",\"relationship\":\"kerberos-client-principal\"}],\"ip_addresses\":[\"10.11.11.203\"],\"mac_addresses\":[\"a4:ba:db:3a:45:72\"],\"type\":\"account\",\"value\":\"candice.tucker\"}",
            "start": 0,
            "reference": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8#identity/identity-9da27d34e33fd292dddb7e99",
            "source_id": "S0015",
            "source_sha256": "6b57f042458d53a6480951a51a73a69407f7523c665b3097936217466192720d"
          }
        ]
      },
      {
        "kind": "host",
        "text": "TUCKER-WIN7-PC assigned to 10.11.11.203.",
        "basis": "observed",
        "value": "TUCKER-WIN7-PC",
        "evidence": [
          {
            "end": 325,
            "quote": "{\"bindings\":[{\"account\":\"\",\"frame_number\":1273,\"owner_ip\":\"10.11.11.203\",\"relationship\":\"netbios-registration\"},{\"account\":\"\",\"frame_number\":1278,\"owner_ip\":\"10.11.11.203\",\"relationship\":\"netbios-registration\"}],\"ip_addresses\":[\"10.11.11.203\"],\"mac_addresses\":[\"a4:ba:db:3a:45:72\"],\"type\":\"hostname\",\"value\":\"TUCKER-WIN7-PC\"}",
            "start": 0,
            "reference": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8#identity/identity-e7a05d96e7ed7e5f4a557fe9",
            "source_id": "S0018",
            "source_sha256": "097e47136d4bd17714f814682db8f0f343b8112ec64ce3f2c7ef09e2c67aad00"
          }
        ]
      }
    ],
    "next_steps": [
      {
        "text": "Further investigate the executable 8d5d36c8ffb0a9c81b145aa40c1ff3475702fb0b5f9e08e0577bdc405087e635 on TUCKER-WIN7-PC for signs of execution or persistent compromise.",
        "basis": "assessment",
        "evidence": [
          {
            "end": 375,
            "quote": "{\"client_ip\":\"10.11.11.203\",\"completeness\":\"matches-declared-content-length\",\"content_kind\":\"pe\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":11415,\"response_frame\":11979,\"server_ip\":\"188.95.248.71\",\"sha256\":\"8d5d36c8ffb0a9c81b145aa40c1ff3475702fb0b5f9e08e0577bdc405087e635\",\"url_without_query_or_fragment\":\"http://acjabogados.com/40group.tiff\"}",
            "start": 0,
            "reference": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8#artifact/artifact-86b99b01439d20dbcedf6528",
            "source_id": "S0004",
            "source_sha256": "1478293d92110ad5878b89738dcc6e37dc52f35400c5ccf5a261708b61b7fef3"
          }
        ]
      }
    ],
    "uncertainties": [
      {
        "text": "It is not confirmed whether the downloaded PE file on TUCKER-WIN7-PC was executed or resulted in compromise, as the capture contains only the transfer and no endpoint activity.",
        "basis": "observed",
        "evidence": [
          {
            "end": 375,
            "quote": "{\"client_ip\":\"10.11.11.203\",\"completeness\":\"matches-declared-content-length\",\"content_kind\":\"pe\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":11415,\"response_frame\":11979,\"server_ip\":\"188.95.248.71\",\"sha256\":\"8d5d36c8ffb0a9c81b145aa40c1ff3475702fb0b5f9e08e0577bdc405087e635\",\"url_without_query_or_fragment\":\"http://acjabogados.com/40group.tiff\"}",
            "start": 0,
            "reference": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8#artifact/artifact-86b99b01439d20dbcedf6528",
            "source_id": "S0004",
            "source_sha256": "1478293d92110ad5878b89738dcc6e37dc52f35400c5ccf5a261708b61b7fef3"
          }
        ]
      },
      {
        "text": "Reputation and threat context for the downloaded executable are not fully established due to rate limiting or lack of matches in enrichment sources at the time of analysis.",
        "basis": "reported",
        "evidence": [
          {
            "end": 449,
            "quote": "{\"provider_status_counts\":[{\"provider\":\"malwarebazaar\",\"status\":\"not-applicable\",\"targets\":9},{\"provider\":\"malwarebazaar\",\"status\":\"not_found\",\"targets\":11},{\"provider\":\"threatfox\",\"status\":\"not_found\",\"targets\":97},{\"provider\":\"threatfox\",\"status\":\"ok\",\"targets\":1},{\"provider\":\"virustotal\",\"status\":\"deferred-rate-limit\",\"targets\":98}],\"scope\":\"Current enrichment coverage only. Rate limited, unavailable and not-found results do not mean clean.\"}",
            "start": 0,
            "reference": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8#enrichment-coverage",
            "source_id": "S0003",
            "source_sha256": "b19d9d290098a3e0432d70ee15f91f8e99a844f06b1b711849fa3b5762bfd863"
          }
        ]
      }
    ],
    "what_happened": [
      {
        "text": "The host 10.11.11.203 (TUCKER-WIN7-PC, candice.tucker) downloaded a file identified as a Windows executable (PE) from http://acjabogados.com/40group.tiff with SHA-256 8d5d36c8ffb0a9c81b145aa40c1ff3475702fb0b5f9e08e0577bdc405087e635.",
        "basis": "observed",
        "evidence": [
          {
            "end": 375,
            "quote": "{\"client_ip\":\"10.11.11.203\",\"completeness\":\"matches-declared-content-length\",\"content_kind\":\"pe\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":11415,\"response_frame\":11979,\"server_ip\":\"188.95.248.71\",\"sha256\":\"8d5d36c8ffb0a9c81b145aa40c1ff3475702fb0b5f9e08e0577bdc405087e635\",\"url_without_query_or_fragment\":\"http://acjabogados.com/40group.tiff\"}",
            "start": 0,
            "reference": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8#artifact/artifact-86b99b01439d20dbcedf6528",
            "source_id": "S0004",
            "source_sha256": "1478293d92110ad5878b89738dcc6e37dc52f35400c5ccf5a261708b61b7fef3"
          }
        ]
      },
      {
        "text": "Multiple hosts in the environment, including TUCKER-WIN7-PC and others, retrieved various JavaScript files from reputable domains with no evidence in this data set of those scripts being malicious or executed beyond receiving them over HTTP.",
        "basis": "observed",
        "evidence": [
          {
            "end": 392,
            "quote": "{\"client_ip\":\"10.11.11.217\",\"completeness\":\"unknown\",\"content_kind\":\"script-like-text\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":17669,\"response_frame\":17690,\"server_ip\":\"23.204.246.46\",\"sha256\":\"02421b3b99f39a2e6c412a2a709b1e2685b8801e652ac5d01d7ab24a610375ef\",\"url_without_query_or_fragment\":\"http://a.tribalfusion.com/real/tags/iPhoneHackscom/ROS/tags.js\"}",
            "start": 0,
            "reference": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8#artifact/artifact-aada23129476ece95a7a9bcd",
            "source_id": "S0005",
            "source_sha256": "01c671a125785ac230e0b7d1c299735401c23908417bb06bf6444c1f0792f544"
          },
          {
            "end": 387,
            "quote": "{\"client_ip\":\"10.11.11.217\",\"completeness\":\"unknown\",\"content_kind\":\"script-like-text\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":11563,\"response_frame\":11592,\"server_ip\":\"143.204.26.216\",\"sha256\":\"06b99248a163333e36980a6cfb756f1a7de60fa49517162b87b1a44d5d48f844\",\"url_without_query_or_fragment\":\"http://c.amazon-adsystem.com/bao-csm/aps-comm/aps_csm.js\"}",
            "start": 0,
            "reference": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8#artifact/artifact-1230ac6447460ddc27de8850",
            "source_id": "S0006",
            "source_sha256": "0891452303d7894f13884861ef6adb7068f8f93be825d1aef6d9c51058653a70"
          },
          {
            "end": 374,
            "quote": "{\"client_ip\":\"10.11.11.217\",\"completeness\":\"unknown\",\"content_kind\":\"script-like-text\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":11469,\"response_frame\":11537,\"server_ip\":\"143.204.26.216\",\"sha256\":\"29d14c1ad2f8f1be84efd4d678ff3de9d6c3f94eb3b77894504c4824ff1a8ad4\",\"url_without_query_or_fragment\":\"http://c.amazon-adsystem.com/aax2/apstag.js\"}",
            "start": 0,
            "reference": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8#artifact/artifact-6f71bc83b24223752c2585cc",
            "source_id": "S0007",
            "source_sha256": "82cd2f58fa034beb39f72080ee21d2a830c75cd283e026606e189dd9f3bd192c"
          }
        ]
      }
    ]
  },
  "validation": "schema-and-exact-quote-binding; not semantic proof",
  "word_count": 143,
  "analysis_id": "76f521c2-4e4a-41d5-95ad-a44fd9887dd8",
  "token_usage": {
    "total_tokens": 10662,
    "prompt_tokens": 9989,
    "completion_tokens": 673
  },
  "authoritative": false,
  "effective_tlp": "TLP:CLEAR",
  "source_sha256": "11669be41dc356c75dfa8698a61cc334e24de51a01800d2a88f52d17bba0e9c3",
  "capture_sha256": "1c607e6b1245a2ee781551fb8a9c629763f848410c3756f28d80615c55fc22d1",
  "prompt_version": "pcap-investigation-summary-v5",
  "requested_model": "gpt-4.1",
  "source_manifest": [
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "e4350263343815439fd251ed60eec9541f0bc951ef5cb19694f112b42c225b3f",
      "reference": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8#capture",
      "source_id": "S0001"
    },
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "dbc652fa0ab38d85ec0580d8dab35d907aaef6a70146094fd1b890cdf86a0e98",
      "reference": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8#coverage",
      "source_id": "S0002"
    },
    {
      "kind": "intelligence_lead",
      "offset": 0,
      "sha256": "b19d9d290098a3e0432d70ee15f91f8e99a844f06b1b711849fa3b5762bfd863",
      "reference": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8#enrichment-coverage",
      "source_id": "S0003"
    },
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "1478293d92110ad5878b89738dcc6e37dc52f35400c5ccf5a261708b61b7fef3",
      "reference": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8#artifact/artifact-86b99b01439d20dbcedf6528",
      "source_id": "S0004"
    },
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "01c671a125785ac230e0b7d1c299735401c23908417bb06bf6444c1f0792f544",
      "reference": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8#artifact/artifact-aada23129476ece95a7a9bcd",
      "source_id": "S0005"
    },
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "0891452303d7894f13884861ef6adb7068f8f93be825d1aef6d9c51058653a70",
      "reference": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8#artifact/artifact-1230ac6447460ddc27de8850",
      "source_id": "S0006"
    },
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "82cd2f58fa034beb39f72080ee21d2a830c75cd283e026606e189dd9f3bd192c",
      "reference": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8#artifact/artifact-6f71bc83b24223752c2585cc",
      "source_id": "S0007"
    },
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "da0c22fd0b0493962034fbb27df1cb442769752c36e513c314c6f43f1acdc078",
      "reference": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8#artifact/artifact-3693529b3e790b61972b5b54",
      "source_id": "S0008"
    },
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "fa010a7039dbbf98d97d7aa679492b4e5668788123777c2ebd267749f8bdb75c",
      "reference": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8#artifact/artifact-e3d17eb3b3f32cfc1d6f3aa8",
      "source_id": "S0009"
    },
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "bb64eeb823306f190bfefdc98b66a15fcfacd090b5f1b2d6425f9dd1e4d28be2",
      "reference": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8#artifact/artifact-b1a85c7e7f76c13fb5b5b26d",
      "source_id": "S0010"
    },
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "c4db427ed3a55838cc8fa1f8c786ead5a8c326fc29956c3c6d0b47a252d6d845",
      "reference": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8#artifact/artifact-78c10a5ae582533f5faf0807",
      "source_id": "S0011"
    },
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "67d9a2cab6c508ac054cb8da80511379aa0e656a415b02d7032d750bcd8c98f4",
      "reference": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8#artifact/artifact-4e42e1cc78f734f93e20859f",
      "source_id": "S0012"
    },
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "74b4144a3849bc49164b7878646d46ed9081d315f4bc71cf364dd8d892967f08",
      "reference": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8#artifact/artifact-1cb0558497210d8850a72912",
      "source_id": "S0013"
    },
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "4d6edf266e68fbeb28788a65a1f9c8526c086796a7518b95a8caea006da03ad1",
      "reference": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8#artifact/artifact-fdde86f7adb2fba5d136456f",
      "source_id": "S0014"
    },
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "6b57f042458d53a6480951a51a73a69407f7523c665b3097936217466192720d",
      "reference": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8#identity/identity-9da27d34e33fd292dddb7e99",
      "source_id": "S0015"
    },
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "3a6d7cc4a87f100711af462e01bcd0d830a275cd92da579aa7f139d755e6c38b",
      "reference": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8#identity/identity-b261ab0e719fd2014972fec4",
      "source_id": "S0016"
    },
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "25888bfc01d78ecd2f8be4c957f9b49bfdd3149670e3c4ffb8b43afd92f3ba30",
      "reference": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8#identity/identity-90d805dca2df0d3700e31940",
      "source_id": "S0017"
    },
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "097e47136d4bd17714f814682db8f0f343b8112ec64ce3f2c7ef09e2c67aad00",
      "reference": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8#identity/identity-e7a05d96e7ed7e5f4a557fe9",
      "source_id": "S0018"
    },
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "4667cc0a9eb0eee0dec527db6a59446a72651d5a6cbbe7490af99320a18749dd",
      "reference": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8#identity/identity-6cfb7b383dce6ea9e971054d",
      "source_id": "S0019"
    },
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "f6e5a4e836620fe70a6d9f79c90d37a7c99a83f63004324f3354d04347ba6dbf",
      "reference": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8#identity/identity-5e30db390fb7f7764b27a059",
      "source_id": "S0020"
    },
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "b559da8462a20ccaf74ba493c1f2b66ff75b9a5e0aa7026bd2bc7d30f46e8465",
      "reference": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8#identity/identity-1557e040b9d72aa2fe50e605",
      "source_id": "S0021"
    },
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "6d8da64111b21cb5faaa201c7cb67c30aa7cbc54a26b1a3c8f362674ce03fed3",
      "reference": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8#identity/identity-cad02fad0f9cd802bac2a05e",
      "source_id": "S0022"
    },
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "0e6528ab5d2469ac0402498bf162d08e27ed3c20ec3a1ca2389e5ceb3762332d",
      "reference": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8#identity/identity-529e078d621d93023b35afe6",
      "source_id": "S0023"
    },
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "0584753daf2796d032c584b8ea32799bbb25b4f8691173bec07378e4f76c7440",
      "reference": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8#identity/identity-b0177ba21caafd8c9b5de271",
      "source_id": "S0024"
    },
    {
      "kind": "rule_candidate",
      "offset": 0,
      "sha256": "2e75e3bf86e195bcddd146b48ff18cad3d9cd51c9749213e3c5e61a06aa17c82",
      "reference": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8#finding/finding-9e3ce7614406ea2f9860106b",
      "source_id": "S0025"
    },
    {
      "kind": "rule_candidate",
      "offset": 0,
      "sha256": "a5e60ed1f6d048d55610282c019cd320fa428b96dd49ccc71107b7b6af092fdb",
      "reference": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8#finding/finding-ebab3524b6002d526f7e0e9f",
      "source_id": "S0026"
    },
    {
      "kind": "rule_candidate",
      "offset": 0,
      "sha256": "be4ba97e73b7c8952998ffd4f9a967fe763e1265ca04913fc36f2cd8c84b8b13",
      "reference": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8#finding/finding-002e225be391f268ae0235f6",
      "source_id": "S0027"
    },
    {
      "kind": "rule_candidate",
      "offset": 0,
      "sha256": "412f36322dbb84679cb987eb1730bd160cc60e677d4309d9e1246d849b455a21",
      "reference": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8#finding/finding-005d05b8f254e72eab9d87b8",
      "source_id": "S0028"
    },
    {
      "kind": "rule_candidate",
      "offset": 0,
      "sha256": "320fc77b4ec2e64bb5795b876c09357d24a090c4548890755fc6d59f4004bb01",
      "reference": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8#finding/finding-07ec4387ee5d14368a6181b6",
      "source_id": "S0029"
    },
    {
      "kind": "rule_candidate",
      "offset": 0,
      "sha256": "8fb4915d9489e26665101c37d6ef3761f5468ece32d3a8ff0fdbcc84d539903d",
      "reference": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8#finding/finding-0eb12d02fc912d1a7b6527cb",
      "source_id": "S0030"
    },
    {
      "kind": "rule_candidate",
      "offset": 0,
      "sha256": "1b18b7963875a65ef6950cb31f37bb5a2eab3f45ee1a6153108a511b1481a0ba",
      "reference": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8#finding/finding-109f67eef9a633811c65c6ef",
      "source_id": "S0031"
    },
    {
      "kind": "rule_candidate",
      "offset": 0,
      "sha256": "46025b1c3bbb4ba142791c881b5a84caf28d2b0ad40cfa4acdc3117eaa523da6",
      "reference": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8#finding/finding-121cf8282cdc958878f82b04",
      "source_id": "S0032"
    },
    {
      "kind": "rule_candidate",
      "offset": 0,
      "sha256": "2b14764407c7fd081517bd740cc42d2d2aeb196758c9568ede75daeff39f1188",
      "reference": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8#finding/finding-13e470071a3e7e7e6ff09fa4",
      "source_id": "S0033"
    },
    {
      "kind": "rule_candidate",
      "offset": 0,
      "sha256": "90662609557260eea26d81fdf94e36d2b46504238caac3d5a66c01920062b8dc",
      "reference": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8#finding/finding-14938d416d5ae1c43118ccd5",
      "source_id": "S0034"
    },
    {
      "kind": "rule_candidate",
      "offset": 0,
      "sha256": "be3d5d1fe65d96643bf7afdb51e36d281bbb156e143ffde0f4ba5fc280be508b",
      "reference": "/api/pcap/analyses/76f521c2-4e4a-41d5-95ad-a44fd9887dd8#technique/T1105",
      "source_id": "S0035"
    }
  ],
  "token_usage_note": "Provider-reported counts when available; never estimated from character length.",
  "generation_seconds": 6.572,
  "generation_attempts": [
    {
      "attempt": 1,
      "validation": "passed",
      "token_usage": {
        "total_tokens": 10662,
        "prompt_tokens": 9989,
        "completion_tokens": 673,
        "prompt_tokens_details": {
          "audio_tokens": 0,
          "cached_tokens": 0
        },
        "completion_tokens_details": {
          "audio_tokens": 0,
          "reasoning_tokens": 0,
          "accepted_prediction_tokens": 0,
          "rejected_prediction_tokens": 0
        }
      },
      "finish_reason": "stop",
      "provider_returned_model": "gpt-4.1-2025-04-14"
    }
  ],
  "validation_adjustments": [
    {
      "index": 0,
      "action": "optional-claim-omitted",
      "reason": "ttp_transfer_binding",
      "section": "ttps"
    }
  ],
  "provider_returned_model": "gpt-4.1-2025-04-14"
}