{
  "case": "2019-12-03",
  "captured_at": "2026-09-22T19:40:45.537Z",
  "url": "[local-instance]",
  "analysis_id": "fa0da8be-03fb-404d-a526-6c99c6b4f000",
  "summary_id": "investigation-summary:642e8b54-ddd2-4167-9588-4c9eeb609cf2",
  "model": "gpt-4.1-2025-04-14",
  "capture_sha256": "01da378585edbbc7d97e9cd91418a50cc506468d615ff0002b7f4bc34e0cbe0a",
  "native_summary_saved": true,
  "source_sha256": "a374f16e427e0a4be1a5f489d46f6e8e87588a412caa2ff11bd21db7d49ade72",
  "screenshot_sha256": "08dc5621c5ebeeb94ff2381b85a6fcf07c7d8b49875f332a8738f1407b3d3aa3",
  "all_claim_texts_present": true,
  "live_summary_matches_saved": true,
  "stale": false,
  "width": 1100,
  "height": 746,
  "overflow": [],
  "narrativeFont": "17px",
  "text": "ADVERSARYGRAPH · PCAP INVESTIGATION\nANALYST REVIEW REQUIRED\nWhat happened in this capture?\n\n2019-12-03-traffic-analysis-exercise.pcap\n\nThe host 10.18.20.97, identified as Juanita-Work-PC, engaged in normal directory service protocol activity using LDAP and DRSUAPI with another internal address (10.18.20.8); these operations are consistent with standard Windows logon processes and no evidence in the capture supports credential theft, discovery, or DCSync attacks.\n\nWho was involved\n10.18.20.97 is the primary observed host in domain directory protocol traffic, associated with accounts JUANITA-WORK-PC$ and momia.juanita, and hostname Juanita-Work-PC.\nJUANITA-WORK-PC$ is an account used by 10.18.20.97 as a Kerberos client principal.\nmomia.juanita is an account used by 10.18.20.97 as a Kerberos client principal.\nWhat remains uncertain\nNo exfiltration, malware delivery, or evidence of compromise was observed, but coverage is limited to network activity and encrypted payloads were not decrypted.\nNext check\nReview endpoints for execution, persistence, or suspicious process activity not visible in the capture to confirm absence of malicious behavior.\n\nModel: gpt-4.1-2025-04-14 · 131 claim-text words · 2026-09-22 · pcap-investigation-summary-v5\n\nCapture SHA-256: 01da378585edbbc7d97e9cd91418a50cc506468d615ff0002b7f4bc34e0cbe0a\n\nExact citations and reputation coverage are available separately. A downloaded file is not proof of execution.",
  "browser_errors": [],
  "overlapping_fixed_elements": [],
  "visual_review": {
    "status": "passed",
    "reviewer": "assistant visual image inspection",
    "reviewed_at": "2026-09-22T19:50:09.190296+00:00",
    "image_sha256": "08dc5621c5ebeeb94ff2381b85a6fcf07c7d8b49875f332a8738f1407b3d3aa3",
    "notes": "Viewed final 1100px native report: complete readable narrative, consistent case filename, visible model and capture hash, no clipped text or overlay. Semantic failures evaluated separately.",
    "scope": "Image presentation only: readable text, complete frame, consistent case identity, no overlap/clipping. Investigation correctness is evaluated separately against evidence and answers."
  }
}