{
  "id": "investigation-summary:a0b8e16c-23db-409b-9382-043a4e1c3fde",
  "type": "pcap-investigation-summary",
  "label": "PCAP investigation summary",
  "model": "gpt-4.1-2025-04-14",
  "stale": false,
  "status": "analyst-review-required",
  "content": "# PCAP investigation summary\n\n## What happened\n\nThe host at 10.3.11.194 downloaded three files with PE \\(Windows executable\\) content from http://64.44.133.131/images/cursor.png and http://64.44.133.131/images/imgpaper.png during the capture window; these files were served with non-executable URL extensions, which is suspicious but does not prove execution or compromise.\n\n## Who was involved\n\n- The device 10.3.11.194 is observed as an active host in these transfers.\n\n## Key indicators\n\n- The file with SHA-256 68798ccf8e2a5f9682a4e011bec288ad9b3f900244f82c6ae5e8ca538725f92e was downloaded by 10.3.11.194 from 64.44.133.131, matching a PE file signature.\n- The file with SHA-256 8aa9c596dd3eb7560bc7416ba181e858f1174fcbcb5432050f3f9a663ed1ffa2 was downloaded by 10.3.11.194 from 64.44.133.131, matching a PE file signature.\n- The file with SHA-256 fef9b646dba5c7372fe92b6a9d227833c1d15d8cc3a73fd22be9d1869b21cd67 was downloaded by 10.3.11.194 from 64.44.133.131, matching a PE file signature.\n\n## What remains uncertain\n\n- It is not established whether any of the suspicious PE files downloaded by 10.3.11.194 were executed or led to compromise.\n\n## Next check\n\n- Review endpoint logs or behavioral telemetry for 10.3.11.194 to determine if any of the downloaded executables were run.\n\nAnalyst-review draft. Exact evidence references and provider provenance are retained in the structured record.",
  "summary": "The host at 10.3.11.194 downloaded three files with PE (Windows executable) content from http://64.44.133.131/images/cursor.png and http://64.44.133.131/images/imgpaper.png during the capture window; these files were served with non-executable URL extensions, which is suspicious but does not prove execution or compromise.",
  "coverage": {
    "warnings": [
      "Conflicting TCP overlap: fallback extraction rejected this direction"
    ],
    "projection": "pcap-brief-evidence-v1",
    "source_digest": "205701a0e6aebd9492fa2877a3bf42135b1ae3bbda7370a93eeabc0345e40639",
    "candidate_total": 3,
    "omitted_records": {
      "findings": 20,
      "artifacts": 57,
      "candidates": 0,
      "identities": 3,
      "techniques": 0,
      "selected_network_events": 0
    },
    "included_records": {
      "limits": 1,
      "capture": 1,
      "findings": 10,
      "transfers": 6,
      "candidates": 3,
      "identities": 10,
      "techniques": 1,
      "reputation_coverage": 1
    },
    "supplement_scope": "Bounded selected packet metadata, direct reputation, identities and transfer relationships; no payload bodies, prior-case content or exhaustive inventory. Full data remains in source analysis.",
    "source_characters": 13468,
    "enrichment_retained_targets": 75
  },
  "filename": "2020-03-14-traffic-analysis-exercise.pcap",
  "provider": "openai",
  "report_id": "pcap:246dbce6-c561-4434-bedb-dd496ba758d2",
  "created_at": "2026-09-22T18:57:11.802277+00:00",
  "structured": {
    "iocs": [
      {
        "kind": "sha256",
        "text": "The file with SHA-256 68798ccf8e2a5f9682a4e011bec288ad9b3f900244f82c6ae5e8ca538725f92e was downloaded by 10.3.11.194 from 64.44.133.131, matching a PE file signature.",
        "basis": "observed",
        "value": "68798ccf8e2a5f9682a4e011bec288ad9b3f900244f82c6ae5e8ca538725f92e",
        "evidence": [
          {
            "end": 377,
            "quote": "{\"client_ip\":\"10.3.11.194\",\"completeness\":\"matches-declared-content-length\",\"content_kind\":\"pe\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":19014,\"response_frame\":19533,\"server_ip\":\"64.44.133.131\",\"sha256\":\"68798ccf8e2a5f9682a4e011bec288ad9b3f900244f82c6ae5e8ca538725f92e\",\"url_without_query_or_fragment\":\"http://64.44.133.131/images/cursor.png\"}",
            "start": 0,
            "reference": "/api/pcap/analyses/246dbce6-c561-4434-bedb-dd496ba758d2#artifact/artifact-f2042332405293c1a06baa7f",
            "source_id": "S0007",
            "source_sha256": "d8652323f008c5bc89d9ab9f75cc1dc90a2b827e8481d9018381d63e7d568e27"
          }
        ]
      },
      {
        "kind": "sha256",
        "text": "The file with SHA-256 8aa9c596dd3eb7560bc7416ba181e858f1174fcbcb5432050f3f9a663ed1ffa2 was downloaded by 10.3.11.194 from 64.44.133.131, matching a PE file signature.",
        "basis": "observed",
        "value": "8aa9c596dd3eb7560bc7416ba181e858f1174fcbcb5432050f3f9a663ed1ffa2",
        "evidence": [
          {
            "end": 379,
            "quote": "{\"client_ip\":\"10.3.11.194\",\"completeness\":\"matches-declared-content-length\",\"content_kind\":\"pe\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":18431,\"response_frame\":18931,\"server_ip\":\"64.44.133.131\",\"sha256\":\"8aa9c596dd3eb7560bc7416ba181e858f1174fcbcb5432050f3f9a663ed1ffa2\",\"url_without_query_or_fragment\":\"http://64.44.133.131/images/imgpaper.png\"}",
            "start": 0,
            "reference": "/api/pcap/analyses/246dbce6-c561-4434-bedb-dd496ba758d2#artifact/artifact-533bfd4c90957b3cbb58a9e1",
            "source_id": "S0008",
            "source_sha256": "e828d7b8998f7c79e5cd29b90fd2dd3f43e7fe63d6c1bf6c146322b17300ab1f"
          }
        ]
      },
      {
        "kind": "sha256",
        "text": "The file with SHA-256 fef9b646dba5c7372fe92b6a9d227833c1d15d8cc3a73fd22be9d1869b21cd67 was downloaded by 10.3.11.194 from 64.44.133.131, matching a PE file signature.",
        "basis": "observed",
        "value": "fef9b646dba5c7372fe92b6a9d227833c1d15d8cc3a73fd22be9d1869b21cd67",
        "evidence": [
          {
            "end": 377,
            "quote": "{\"client_ip\":\"10.3.11.194\",\"completeness\":\"matches-declared-content-length\",\"content_kind\":\"pe\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":19562,\"response_frame\":20107,\"server_ip\":\"64.44.133.131\",\"sha256\":\"fef9b646dba5c7372fe92b6a9d227833c1d15d8cc3a73fd22be9d1869b21cd67\",\"url_without_query_or_fragment\":\"http://64.44.133.131/images/cursor.png\"}",
            "start": 0,
            "reference": "/api/pcap/analyses/246dbce6-c561-4434-bedb-dd496ba758d2#artifact/artifact-bdbd58f24a3993f922d9b197",
            "source_id": "S0009",
            "source_sha256": "634b91a7dd634fa5b822a5a7187fc8269263c6ae0d0b7f7433814c9bc8cbdd28"
          }
        ]
      }
    ],
    "ttps": [],
    "identities": [
      {
        "kind": "ip",
        "text": "The device 10.3.11.194 is observed as an active host in these transfers.",
        "basis": "observed",
        "value": "10.3.11.194",
        "evidence": [
          {
            "end": 377,
            "quote": "{\"client_ip\":\"10.3.11.194\",\"completeness\":\"matches-declared-content-length\",\"content_kind\":\"pe\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":19014,\"response_frame\":19533,\"server_ip\":\"64.44.133.131\",\"sha256\":\"68798ccf8e2a5f9682a4e011bec288ad9b3f900244f82c6ae5e8ca538725f92e\",\"url_without_query_or_fragment\":\"http://64.44.133.131/images/cursor.png\"}",
            "start": 0,
            "reference": "/api/pcap/analyses/246dbce6-c561-4434-bedb-dd496ba758d2#artifact/artifact-f2042332405293c1a06baa7f",
            "source_id": "S0007",
            "source_sha256": "d8652323f008c5bc89d9ab9f75cc1dc90a2b827e8481d9018381d63e7d568e27"
          },
          {
            "end": 379,
            "quote": "{\"client_ip\":\"10.3.11.194\",\"completeness\":\"matches-declared-content-length\",\"content_kind\":\"pe\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":18431,\"response_frame\":18931,\"server_ip\":\"64.44.133.131\",\"sha256\":\"8aa9c596dd3eb7560bc7416ba181e858f1174fcbcb5432050f3f9a663ed1ffa2\",\"url_without_query_or_fragment\":\"http://64.44.133.131/images/imgpaper.png\"}",
            "start": 0,
            "reference": "/api/pcap/analyses/246dbce6-c561-4434-bedb-dd496ba758d2#artifact/artifact-533bfd4c90957b3cbb58a9e1",
            "source_id": "S0008",
            "source_sha256": "e828d7b8998f7c79e5cd29b90fd2dd3f43e7fe63d6c1bf6c146322b17300ab1f"
          },
          {
            "end": 377,
            "quote": "{\"client_ip\":\"10.3.11.194\",\"completeness\":\"matches-declared-content-length\",\"content_kind\":\"pe\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":19562,\"response_frame\":20107,\"server_ip\":\"64.44.133.131\",\"sha256\":\"fef9b646dba5c7372fe92b6a9d227833c1d15d8cc3a73fd22be9d1869b21cd67\",\"url_without_query_or_fragment\":\"http://64.44.133.131/images/cursor.png\"}",
            "start": 0,
            "reference": "/api/pcap/analyses/246dbce6-c561-4434-bedb-dd496ba758d2#artifact/artifact-bdbd58f24a3993f922d9b197",
            "source_id": "S0009",
            "source_sha256": "634b91a7dd634fa5b822a5a7187fc8269263c6ae0d0b7f7433814c9bc8cbdd28"
          }
        ]
      }
    ],
    "next_steps": [
      {
        "text": "Review endpoint logs or behavioral telemetry for 10.3.11.194 to determine if any of the downloaded executables were run.",
        "basis": "assessment",
        "evidence": [
          {
            "end": 377,
            "quote": "{\"client_ip\":\"10.3.11.194\",\"completeness\":\"matches-declared-content-length\",\"content_kind\":\"pe\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":19014,\"response_frame\":19533,\"server_ip\":\"64.44.133.131\",\"sha256\":\"68798ccf8e2a5f9682a4e011bec288ad9b3f900244f82c6ae5e8ca538725f92e\",\"url_without_query_or_fragment\":\"http://64.44.133.131/images/cursor.png\"}",
            "start": 0,
            "reference": "/api/pcap/analyses/246dbce6-c561-4434-bedb-dd496ba758d2#artifact/artifact-f2042332405293c1a06baa7f",
            "source_id": "S0007",
            "source_sha256": "d8652323f008c5bc89d9ab9f75cc1dc90a2b827e8481d9018381d63e7d568e27"
          },
          {
            "end": 379,
            "quote": "{\"client_ip\":\"10.3.11.194\",\"completeness\":\"matches-declared-content-length\",\"content_kind\":\"pe\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":18431,\"response_frame\":18931,\"server_ip\":\"64.44.133.131\",\"sha256\":\"8aa9c596dd3eb7560bc7416ba181e858f1174fcbcb5432050f3f9a663ed1ffa2\",\"url_without_query_or_fragment\":\"http://64.44.133.131/images/imgpaper.png\"}",
            "start": 0,
            "reference": "/api/pcap/analyses/246dbce6-c561-4434-bedb-dd496ba758d2#artifact/artifact-533bfd4c90957b3cbb58a9e1",
            "source_id": "S0008",
            "source_sha256": "e828d7b8998f7c79e5cd29b90fd2dd3f43e7fe63d6c1bf6c146322b17300ab1f"
          },
          {
            "end": 377,
            "quote": "{\"client_ip\":\"10.3.11.194\",\"completeness\":\"matches-declared-content-length\",\"content_kind\":\"pe\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":19562,\"response_frame\":20107,\"server_ip\":\"64.44.133.131\",\"sha256\":\"fef9b646dba5c7372fe92b6a9d227833c1d15d8cc3a73fd22be9d1869b21cd67\",\"url_without_query_or_fragment\":\"http://64.44.133.131/images/cursor.png\"}",
            "start": 0,
            "reference": "/api/pcap/analyses/246dbce6-c561-4434-bedb-dd496ba758d2#artifact/artifact-bdbd58f24a3993f922d9b197",
            "source_id": "S0009",
            "source_sha256": "634b91a7dd634fa5b822a5a7187fc8269263c6ae0d0b7f7433814c9bc8cbdd28"
          }
        ]
      }
    ],
    "uncertainties": [
      {
        "text": "It is not established whether any of the suspicious PE files downloaded by 10.3.11.194 were executed or led to compromise.",
        "basis": "assessment",
        "evidence": [
          {
            "end": 377,
            "quote": "{\"client_ip\":\"10.3.11.194\",\"completeness\":\"matches-declared-content-length\",\"content_kind\":\"pe\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":19014,\"response_frame\":19533,\"server_ip\":\"64.44.133.131\",\"sha256\":\"68798ccf8e2a5f9682a4e011bec288ad9b3f900244f82c6ae5e8ca538725f92e\",\"url_without_query_or_fragment\":\"http://64.44.133.131/images/cursor.png\"}",
            "start": 0,
            "reference": "/api/pcap/analyses/246dbce6-c561-4434-bedb-dd496ba758d2#artifact/artifact-f2042332405293c1a06baa7f",
            "source_id": "S0007",
            "source_sha256": "d8652323f008c5bc89d9ab9f75cc1dc90a2b827e8481d9018381d63e7d568e27"
          },
          {
            "end": 379,
            "quote": "{\"client_ip\":\"10.3.11.194\",\"completeness\":\"matches-declared-content-length\",\"content_kind\":\"pe\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":18431,\"response_frame\":18931,\"server_ip\":\"64.44.133.131\",\"sha256\":\"8aa9c596dd3eb7560bc7416ba181e858f1174fcbcb5432050f3f9a663ed1ffa2\",\"url_without_query_or_fragment\":\"http://64.44.133.131/images/imgpaper.png\"}",
            "start": 0,
            "reference": "/api/pcap/analyses/246dbce6-c561-4434-bedb-dd496ba758d2#artifact/artifact-533bfd4c90957b3cbb58a9e1",
            "source_id": "S0008",
            "source_sha256": "e828d7b8998f7c79e5cd29b90fd2dd3f43e7fe63d6c1bf6c146322b17300ab1f"
          },
          {
            "end": 377,
            "quote": "{\"client_ip\":\"10.3.11.194\",\"completeness\":\"matches-declared-content-length\",\"content_kind\":\"pe\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":19562,\"response_frame\":20107,\"server_ip\":\"64.44.133.131\",\"sha256\":\"fef9b646dba5c7372fe92b6a9d227833c1d15d8cc3a73fd22be9d1869b21cd67\",\"url_without_query_or_fragment\":\"http://64.44.133.131/images/cursor.png\"}",
            "start": 0,
            "reference": "/api/pcap/analyses/246dbce6-c561-4434-bedb-dd496ba758d2#artifact/artifact-bdbd58f24a3993f922d9b197",
            "source_id": "S0009",
            "source_sha256": "634b91a7dd634fa5b822a5a7187fc8269263c6ae0d0b7f7433814c9bc8cbdd28"
          }
        ]
      }
    ],
    "what_happened": [
      {
        "text": "The host at 10.3.11.194 downloaded three files with PE (Windows executable) content from http://64.44.133.131/images/cursor.png and http://64.44.133.131/images/imgpaper.png during the capture window; these files were served with non-executable URL extensions, which is suspicious but does not prove execution or compromise.",
        "basis": "observed",
        "evidence": [
          {
            "end": 377,
            "quote": "{\"client_ip\":\"10.3.11.194\",\"completeness\":\"matches-declared-content-length\",\"content_kind\":\"pe\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":19014,\"response_frame\":19533,\"server_ip\":\"64.44.133.131\",\"sha256\":\"68798ccf8e2a5f9682a4e011bec288ad9b3f900244f82c6ae5e8ca538725f92e\",\"url_without_query_or_fragment\":\"http://64.44.133.131/images/cursor.png\"}",
            "start": 0,
            "reference": "/api/pcap/analyses/246dbce6-c561-4434-bedb-dd496ba758d2#artifact/artifact-f2042332405293c1a06baa7f",
            "source_id": "S0007",
            "source_sha256": "d8652323f008c5bc89d9ab9f75cc1dc90a2b827e8481d9018381d63e7d568e27"
          },
          {
            "end": 379,
            "quote": "{\"client_ip\":\"10.3.11.194\",\"completeness\":\"matches-declared-content-length\",\"content_kind\":\"pe\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":18431,\"response_frame\":18931,\"server_ip\":\"64.44.133.131\",\"sha256\":\"8aa9c596dd3eb7560bc7416ba181e858f1174fcbcb5432050f3f9a663ed1ffa2\",\"url_without_query_or_fragment\":\"http://64.44.133.131/images/imgpaper.png\"}",
            "start": 0,
            "reference": "/api/pcap/analyses/246dbce6-c561-4434-bedb-dd496ba758d2#artifact/artifact-533bfd4c90957b3cbb58a9e1",
            "source_id": "S0008",
            "source_sha256": "e828d7b8998f7c79e5cd29b90fd2dd3f43e7fe63d6c1bf6c146322b17300ab1f"
          },
          {
            "end": 377,
            "quote": "{\"client_ip\":\"10.3.11.194\",\"completeness\":\"matches-declared-content-length\",\"content_kind\":\"pe\",\"match_basis\":\"exact-sha256-of-decoded-http-response-body\",\"request_frame\":19562,\"response_frame\":20107,\"server_ip\":\"64.44.133.131\",\"sha256\":\"fef9b646dba5c7372fe92b6a9d227833c1d15d8cc3a73fd22be9d1869b21cd67\",\"url_without_query_or_fragment\":\"http://64.44.133.131/images/cursor.png\"}",
            "start": 0,
            "reference": "/api/pcap/analyses/246dbce6-c561-4434-bedb-dd496ba758d2#artifact/artifact-bdbd58f24a3993f922d9b197",
            "source_id": "S0009",
            "source_sha256": "634b91a7dd634fa5b822a5a7187fc8269263c6ae0d0b7f7433814c9bc8cbdd28"
          }
        ]
      }
    ]
  },
  "validation": "schema-and-exact-quote-binding; not semantic proof",
  "word_count": 136,
  "analysis_id": "246dbce6-c561-4434-bedb-dd496ba758d2",
  "token_usage": {
    "total_tokens": 21433,
    "prompt_tokens": 19566,
    "completion_tokens": 1867
  },
  "authoritative": false,
  "effective_tlp": "TLP:CLEAR",
  "source_sha256": "5ae1200063689ec1118bd894b8fb566b12f308aac2184ec0e0c89322f15144e7",
  "capture_sha256": "8df815a53e873e01803010c33752080414b0975709c1c02327e12661eec883a4",
  "prompt_version": "pcap-investigation-summary-v5",
  "requested_model": "gpt-4.1",
  "source_manifest": [
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "24a22e1a07e5ad77bf5539b1817d873307fdc64bdfa72969242c046d48aa268e",
      "reference": "/api/pcap/analyses/246dbce6-c561-4434-bedb-dd496ba758d2#capture",
      "source_id": "S0001"
    },
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "779c764fb3c8fcead4bf43c577af39f3a59d65ebf8526d1f4982b115a870cad2",
      "reference": "/api/pcap/analyses/246dbce6-c561-4434-bedb-dd496ba758d2#coverage",
      "source_id": "S0002"
    },
    {
      "kind": "intelligence_lead",
      "offset": 0,
      "sha256": "d29ace1d6c134158bf1e20fda7cee4f3b67e20f8968109e936b2f32d8a4a37b1",
      "reference": "/api/pcap/analyses/246dbce6-c561-4434-bedb-dd496ba758d2#enrichment-coverage",
      "source_id": "S0003"
    },
    {
      "kind": "rule_candidate",
      "offset": 0,
      "sha256": "f7225afea22eda2a1d62c642f93d7e3c86d4edcdbdc009b5f15eda5f7ad3d1b5",
      "reference": "/api/pcap/analyses/246dbce6-c561-4434-bedb-dd496ba758d2#assessment/observable-7eda0f2160c7166adbe45a69",
      "source_id": "S0004"
    },
    {
      "kind": "rule_candidate",
      "offset": 0,
      "sha256": "2d428fe5f05418f15412dcf5eaa7fd66103c181f6e573c3ec7548395f8fc2e37",
      "reference": "/api/pcap/analyses/246dbce6-c561-4434-bedb-dd496ba758d2#assessment/observable-2efb80932910ed9446f560a4",
      "source_id": "S0005"
    },
    {
      "kind": "rule_candidate",
      "offset": 0,
      "sha256": "b3a365bbf9388045c99fd5ff3e1b1301d29cae54b2e949edaf9d2adf938cee87",
      "reference": "/api/pcap/analyses/246dbce6-c561-4434-bedb-dd496ba758d2#assessment/observable-d3c3ed12a0a52664cd402487",
      "source_id": "S0006"
    },
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "d8652323f008c5bc89d9ab9f75cc1dc90a2b827e8481d9018381d63e7d568e27",
      "reference": "/api/pcap/analyses/246dbce6-c561-4434-bedb-dd496ba758d2#artifact/artifact-f2042332405293c1a06baa7f",
      "source_id": "S0007"
    },
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "e828d7b8998f7c79e5cd29b90fd2dd3f43e7fe63d6c1bf6c146322b17300ab1f",
      "reference": "/api/pcap/analyses/246dbce6-c561-4434-bedb-dd496ba758d2#artifact/artifact-533bfd4c90957b3cbb58a9e1",
      "source_id": "S0008"
    },
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "634b91a7dd634fa5b822a5a7187fc8269263c6ae0d0b7f7433814c9bc8cbdd28",
      "reference": "/api/pcap/analyses/246dbce6-c561-4434-bedb-dd496ba758d2#artifact/artifact-bdbd58f24a3993f922d9b197",
      "source_id": "S0009"
    },
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "2d853e9be7f6b45ce8e86afaad9c9b763cc50a6ed5ac306c2dfced2bdc2092a7",
      "reference": "/api/pcap/analyses/246dbce6-c561-4434-bedb-dd496ba758d2#artifact/artifact-81ea815cbb3693b810124184",
      "source_id": "S0010"
    },
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "8686173a4ea884ad76fc021debad511fadf9789d8ed2d5a1f49d72b10034271a",
      "reference": "/api/pcap/analyses/246dbce6-c561-4434-bedb-dd496ba758d2#artifact/artifact-eb62f6f700fb27f13e82e56d",
      "source_id": "S0011"
    },
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "c7388c6ef1a6d9805ae848a19bc2ada71030f014610f52c5d577e88bdb28d6f3",
      "reference": "/api/pcap/analyses/246dbce6-c561-4434-bedb-dd496ba758d2#artifact/artifact-d311ee99f2f4b33c0123ef22",
      "source_id": "S0012"
    },
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "17a0f058081dfc8c40a7a1ad4cf4d4a04e2d8a59444a29b9a27025b70aecacfb",
      "reference": "/api/pcap/analyses/246dbce6-c561-4434-bedb-dd496ba758d2#identity/identity-3b363a48dffc55c0c9ab1e63",
      "source_id": "S0013"
    },
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "fca389fe7c0e49d94451bbba368ca2bd1f44d7f2fb8a7f9e84e8dc934f883726",
      "reference": "/api/pcap/analyses/246dbce6-c561-4434-bedb-dd496ba758d2#identity/identity-5ee7b3c510b063752632194c",
      "source_id": "S0014"
    },
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "f73e7b058206352387c49e16789f6f2f9a93c4be9efa9b7d08306a95a0363e86",
      "reference": "/api/pcap/analyses/246dbce6-c561-4434-bedb-dd496ba758d2#identity/identity-eb38330b518a7dcf66c4d6b9",
      "source_id": "S0015"
    },
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "2918188593903a0d44f5d45f7b88201df5f8c26b9e57f1b221d7f6f9403e254c",
      "reference": "/api/pcap/analyses/246dbce6-c561-4434-bedb-dd496ba758d2#identity/identity-ad508868c750fbc13afc22c0",
      "source_id": "S0016"
    },
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "3b2b9e00a97a2edef889c5d7e1dd2fa7f77604a83b8a9acaa1103ae947ad0b42",
      "reference": "/api/pcap/analyses/246dbce6-c561-4434-bedb-dd496ba758d2#identity/identity-6233ae9d7c6fa285da580b71",
      "source_id": "S0017"
    },
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "6dd4f865abbd60076e1d47709c089275b1ec3bcd131e654690456b246c84098c",
      "reference": "/api/pcap/analyses/246dbce6-c561-4434-bedb-dd496ba758d2#identity/identity-129af81cabbbc0ed2a747282",
      "source_id": "S0018"
    },
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "44039a8b9f7c269ed0f0b00d810881147476e62e813aab7d4d19ab11c86f96cc",
      "reference": "/api/pcap/analyses/246dbce6-c561-4434-bedb-dd496ba758d2#identity/identity-bea7509e5f279315c57f50dc",
      "source_id": "S0019"
    },
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "59b08f8ccf9c27908b6623e939269fad85c1d6cd0f17a4f8a0c0c90a6ea783c4",
      "reference": "/api/pcap/analyses/246dbce6-c561-4434-bedb-dd496ba758d2#identity/identity-558550fabc6917bee8adf160",
      "source_id": "S0020"
    },
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "cc0b53e83e9c72bb07a69ac455d3204c0f49f83aee3d2c5b640dc77700e91c7b",
      "reference": "/api/pcap/analyses/246dbce6-c561-4434-bedb-dd496ba758d2#identity/identity-2eb1dfb7f18f5a666cd37f4e",
      "source_id": "S0021"
    },
    {
      "kind": "packet_fact",
      "offset": 0,
      "sha256": "2a7dab9942ef82af47916fd95525a337d8125c96ff2dc39576d328f50a381d50",
      "reference": "/api/pcap/analyses/246dbce6-c561-4434-bedb-dd496ba758d2#identity/identity-6a0b891e51b985dd21e63acf",
      "source_id": "S0022"
    },
    {
      "kind": "rule_candidate",
      "offset": 0,
      "sha256": "0693a2084fd238414145629973da4076afeee8cde6cc994c57c75008b8bf31f7",
      "reference": "/api/pcap/analyses/246dbce6-c561-4434-bedb-dd496ba758d2#finding/finding-437ba6956b48c17adc1decf7",
      "source_id": "S0023"
    },
    {
      "kind": "rule_candidate",
      "offset": 0,
      "sha256": "eb8705b3907fbed23534e2e70031abcbd12a0a1e3a74894068c08bd222467bbd",
      "reference": "/api/pcap/analyses/246dbce6-c561-4434-bedb-dd496ba758d2#finding/finding-4584f53617f61e54e6c4de5b",
      "source_id": "S0024"
    },
    {
      "kind": "rule_candidate",
      "offset": 0,
      "sha256": "c55d7c107aa09b3bc4f94ab8d58cfd319b0600dd8046c9d4d15b5f21f1730cad",
      "reference": "/api/pcap/analyses/246dbce6-c561-4434-bedb-dd496ba758d2#finding/finding-00fe5f4c7aefd26b811e3ed4",
      "source_id": "S0025"
    },
    {
      "kind": "rule_candidate",
      "offset": 0,
      "sha256": "c5e47cf25356e49c8dffcaa615b7d806c9cacfb9bd3d6c83ac80b8fba8f2fa62",
      "reference": "/api/pcap/analyses/246dbce6-c561-4434-bedb-dd496ba758d2#finding/finding-0de22aef0587ad2549252439",
      "source_id": "S0026"
    },
    {
      "kind": "rule_candidate",
      "offset": 0,
      "sha256": "d107407f8140742432561987ec0dde4142df59e5ba856fa16fbc343da9270faa",
      "reference": "/api/pcap/analyses/246dbce6-c561-4434-bedb-dd496ba758d2#finding/finding-0ec35865f25337e67988dc69",
      "source_id": "S0027"
    },
    {
      "kind": "rule_candidate",
      "offset": 0,
      "sha256": "81afa9be59d3ccdfea39f155ecf89992a260216f3638d9b13ef8e433e818fa55",
      "reference": "/api/pcap/analyses/246dbce6-c561-4434-bedb-dd496ba758d2#finding/finding-1b49952f56bd846c20797136",
      "source_id": "S0028"
    },
    {
      "kind": "rule_candidate",
      "offset": 0,
      "sha256": "aaa9287ad92eca1960eaf5b1b237e38af5d6deb32ec672a84b1f46932aa242b2",
      "reference": "/api/pcap/analyses/246dbce6-c561-4434-bedb-dd496ba758d2#finding/finding-1b856a7e84adb279afa011a2",
      "source_id": "S0029"
    },
    {
      "kind": "rule_candidate",
      "offset": 0,
      "sha256": "2f366477c0ec9293ed350e6fbefd0c33a9c79dd4bae205e06048384abd8c1ce7",
      "reference": "/api/pcap/analyses/246dbce6-c561-4434-bedb-dd496ba758d2#finding/finding-35f8dd8e0444afddbae1600d",
      "source_id": "S0030"
    },
    {
      "kind": "rule_candidate",
      "offset": 0,
      "sha256": "2246350618f9119178c5a06138aae1b7edf2916ea6ecba30a542a93646682690",
      "reference": "/api/pcap/analyses/246dbce6-c561-4434-bedb-dd496ba758d2#finding/finding-385abbe2a6750a299484f19e",
      "source_id": "S0031"
    },
    {
      "kind": "rule_candidate",
      "offset": 0,
      "sha256": "c1f50b9138b8bc21524f6e55f52a31acc451d26302ed54bc0e8d7f1a5faf6df7",
      "reference": "/api/pcap/analyses/246dbce6-c561-4434-bedb-dd496ba758d2#finding/finding-3fb24b663f9fc4e9ff88943a",
      "source_id": "S0032"
    },
    {
      "kind": "rule_candidate",
      "offset": 0,
      "sha256": "f9810c9c2847419b4e3b334a150a5762ab13089515b6aef1f3243640c16154a5",
      "reference": "/api/pcap/analyses/246dbce6-c561-4434-bedb-dd496ba758d2#technique/T1105",
      "source_id": "S0033"
    }
  ],
  "token_usage_note": "Provider-reported counts when available; never estimated from character length.",
  "generation_seconds": 71.549,
  "generation_attempts": [
    {
      "attempt": 1,
      "validation": "uncited_identifier",
      "token_usage": {
        "total_tokens": 10608,
        "prompt_tokens": 9600,
        "completion_tokens": 1008,
        "prompt_tokens_details": {
          "audio_tokens": 0,
          "cached_tokens": 0
        },
        "completion_tokens_details": {
          "audio_tokens": 0,
          "reasoning_tokens": 0,
          "accepted_prediction_tokens": 0,
          "rejected_prediction_tokens": 0
        }
      },
      "finish_reason": "stop",
      "provider_returned_model": "gpt-4.1-2025-04-14"
    },
    {
      "attempt": 2,
      "validation": "passed",
      "token_usage": {
        "total_tokens": 10825,
        "prompt_tokens": 9966,
        "completion_tokens": 859,
        "prompt_tokens_details": {
          "audio_tokens": 0,
          "cached_tokens": 1920
        },
        "completion_tokens_details": {
          "audio_tokens": 0,
          "reasoning_tokens": 0,
          "accepted_prediction_tokens": 0,
          "rejected_prediction_tokens": 0
        }
      },
      "finish_reason": "stop",
      "provider_returned_model": "gpt-4.1-2025-04-14"
    }
  ],
  "validation_adjustments": [
    {
      "index": 0,
      "action": "optional-claim-omitted",
      "reason": "identifier_binding",
      "section": "ttps"
    }
  ],
  "provider_returned_model": "gpt-4.1-2025-04-14"
}