{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "promote-to-detection",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "Identity-led breaches avoid zero-days and exploits, making them invisible to traditional vulnerability management. This hunt validates that even if credentials are stolen, subsequent abuse is detected."
      },
      "name": "Identity-Led Cloud Abuse and Secret Discovery",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1133",
        "attack.t1190",
        "attack.t1555",
        "attack.t1486",
        "credential access",
        "impact",
        "initial access",
        "lateral movement",
        "hudsonrock"
      ],
      "series": {
        "slug": "introducing-sekoia-digital-risk-track-identity-led-breaches",
        "index": 2,
        "title": "Introducing Sekoia Digital Risk: Track Identity-Led Breaches",
        "total": 2
      },
      "related": [
        {
          "hunt": "infostealer-credential-harvesting",
          "reason": "This hunt focuses on the use of credentials, not the initial malware infection.",
          "relation": "out-of-scope-alternative"
        },
        {
          "hunt": "external-identity-exposure-credential-leaks",
          "relation": "follows"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        },
        "identity": {
          "name": "Identity / sign-in telemetry",
          "category": "identity",
          "telemetry": [
            "identity"
          ]
        },
        "hudsonrock": {
          "name": "hudsonrock",
          "category": "siem",
          "huntbase": {
            "product": "hudsonrock"
          }
        }
      },
      "analysis": "A rule fires on MFA failures. This hunt connects those failures to compliance state, underground exposure, and subsequent cloud discovery\u2014providing the context required to justify account suspension.",
      "coverage": [
        {
          "stage": "identity-led-initial-access",
          "steps": [
            "non-compliant-device-scoping",
            "mfa-fatigue-patterns",
            "hudson-rock-exposure"
          ],
          "status": "covered"
        },
        {
          "stage": "internal-credential-discovery",
          "steps": [
            "cloud-discovery-exfil",
            "internal-smb-discovery"
          ],
          "status": "covered"
        },
        {
          "stage": "unauthorised-cloud-resource-access",
          "steps": [
            "cloud-discovery-exfil",
            "intent-correlation-agent"
          ],
          "status": "covered"
        },
        {
          "stage": "data-exfiltration-and-extortion",
          "steps": [
            "cloud-discovery-exfil",
            "route-on-verdict"
          ],
          "status": "covered"
        },
        {
          "stage": "infostealer-credential-harvesting",
          "reason": "Belongs to another part of the 'Introducing Sekoia Digital Risk: Track Identity-Led Breaches' series.",
          "status": "out_of_scope"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Infostealer Harvesting from Personal Devices",
            "slug": "infostealer-credential-harvesting",
            "tactic": "initial-access",
            "techniques": [
              "T1555",
              "T1195"
            ],
            "observables": [
              "Lumma malware",
              "RedLine malware",
              "Vidar malware",
              "Raccoon malware",
              "personal devices",
              "contractor laptops",
              "browser saved credentials",
              "session cookies",
              "Telegram channels"
            ]
          },
          {
            "name": "Initial Access via Stolen Identity",
            "slug": "identity-led-initial-access",
            "tactic": "initial-access",
            "techniques": [
              "T1133",
              "T1190"
            ],
            "observables": [
              "Snowflake login",
              "Okta service account",
              "valid session cookie replay",
              "MFA push notifications",
              "push notification fatigue",
              "non-compliant device sign-in",
              "external contractor credentials"
            ]
          },
          {
            "name": "Internal Credential and Secret Discovery",
            "slug": "internal-credential-discovery",
            "tactic": "credential-access",
            "techniques": [
              "T1555"
            ],
            "observables": [
              "hard-coded admin credentials",
              "internal network shares",
              "support case files",
              "customer session tokens",
              "browser-synced credentials"
            ]
          },
          {
            "name": "Lateral Movement to Cloud Services",
            "slug": "unauthorised-cloud-resource-access",
            "tactic": "lateral-movement",
            "techniques": [
              "T1133"
            ],
            "observables": [
              "AWS console access",
              "Google Workspace",
              "Slack workspace connections",
              "bug bounty systems"
            ]
          },
          {
            "name": "Data Exfiltration and Ransom Extortion",
            "slug": "data-exfiltration-and-extortion",
            "tactic": "impact",
            "techniques": [
              "T1486"
            ],
            "observables": [
              "1.3 TB data theft",
              "Snowflake database records",
              "ShinyHunters extortion",
              "Ticketmaster listing",
              "hundreds of millions of records"
            ]
          }
        ],
        "summary": "Threat actors leverage infostealer malware (Lumma, RedLine, Vidar) to harvest credentials and session cookies from personal or contractor devices, which are later sold via access brokers and Telegram channels. These stolen identities are used to bypass MFA via session replay or fatigue attacks to gain access to corporate cloud platforms like Snowflake, AWS, and Slack for large-scale data exfiltration and extortion."
      },
      "severity": "high",
      "rationale": "Start with users reporting 'false' for compliance in hb_auth_signin. Focus on servers and administrative workstations first. Widen the domain check if high exposure is found in Hudson Rock.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An attacker has used stolen credentials harvested from unmanaged devices to bypass MFA via push fatigue, subsequently discovering cloud secrets and internal shares to exfiltrate data.",
      "parameters": {
        "scope_hosts": {
          "type": "list[host]",
          "default": [],
          "description": "Hostnames identified in the scoping step to focus internal discovery queries."
        },
        "lookback_days": {
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        },
        "target_domain": {
          "type": "string",
          "default": "example.com",
          "description": "Primary domain to check for existing exposure in stealer logs."
        },
        "secret_api_ops": {
          "from": {
            "ref": "Uber/Okta breach reports",
            "kind": "article",
            "observed": "2023-10-20"
          },
          "type": "list[string]",
          "default": [
            "GetSecretValue",
            "DescribeInstances",
            "GetBucketPolicy",
            "ListAccessKeys",
            "AssumeRole"
          ],
          "description": "Cloud API operations associated with secret discovery."
        },
        "sensitive_shares": {
          "from": {
            "ref": "Internal assessment",
            "kind": "manual",
            "observed": "2024-05-20"
          },
          "type": "list[path]",
          "default": [
            "\\\\*\\admin$",
            "\\\\*\\c$",
            "\\\\*\\ipc$",
            "\\\\*\\backup",
            "\\\\*\\finance"
          ],
          "description": "Internal SMB shares typically targeted for credential or data discovery."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.sekoia.com/blog/with-sekoia-intelligence-we-gave-you-half-the-picture-heres-the-other-half",
          "gates": [
            "dry-run",
            "lint",
            "critic"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.sekoia.com/blog/with-sekoia-intelligence-we-gave-you-half-the-picture-heres-the-other-half",
          "name": "Sekoia \u2014 With Sekoia Intelligence, we gave you half the picture"
        },
        {
          "url": "https://www.mandiant.com/resources/blog/unc5537-snowflake-data-theft-investigation",
          "name": "Mandiant \u2014 Snowflake Data Theft Investigation"
        }
      ],
      "blind_spots": [
        {
          "id": "unmanaged-device-visibility",
          "risk": "Attackers harvesting credentials from personal laptops are invisible until they use the credential against corporate endpoints.",
          "owner": "Endpoint Engineering",
          "stage": "identity-led-initial-access",
          "question": "whether the initial infection happened on a device we do not manage",
          "requires": "EDR telemetry on personal devices",
          "remediation": "Enforce managed-device-only policies in the IDP."
        },
        {
          "id": "stolen-session-replay",
          "risk": "Cookie replay bypasses MFA and auth failure logging entirely.",
          "owner": "Identity Team",
          "stage": "identity-led-initial-access",
          "question": "whether a valid session cookie was replayed from a different IP",
          "requires": "hb_auth_signin with session correlation IDs",
          "remediation": "Enable session token binding or IP-pinning."
        }
      ]
    },
    "name": "Identity-Led Cloud Abuse and Secret Discovery",
    "description": "This hunt follows the transition from compromised identity to resource abuse, as seen in the Snowflake and Uber breaches. It begins by scoping users signing in from non-compliant devices, then examines authentication patterns for MFA fatigue and proxy usage. The second phase correlates these suspicious logons with secret discovery in cloud control planes and administrative SMB shares, connecting initial access to malicious intent."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "series": {
          "slug": "introducing-sekoia-digital-risk-track-identity-led-breaches",
          "index": 2,
          "title": "Introducing Sekoia Digital Risk: Track Identity-Led Breaches",
          "total": 2
        },
        "coverage": [
          {
            "stage": "identity-led-initial-access",
            "steps": [
              "non-compliant-device-scoping",
              "mfa-fatigue-patterns",
              "hudson-rock-exposure"
            ],
            "status": "covered"
          },
          {
            "stage": "internal-credential-discovery",
            "steps": [
              "cloud-discovery-exfil",
              "internal-smb-discovery"
            ],
            "status": "covered"
          },
          {
            "stage": "unauthorised-cloud-resource-access",
            "steps": [
              "cloud-discovery-exfil",
              "intent-correlation-agent"
            ],
            "status": "covered"
          },
          {
            "stage": "data-exfiltration-and-extortion",
            "steps": [
              "cloud-discovery-exfil",
              "route-on-verdict"
            ],
            "status": "covered"
          },
          {
            "stage": "infostealer-credential-harvesting",
            "reason": "Belongs to another part of the 'Introducing Sekoia Digital Risk: Track Identity-Led Breaches' series.",
            "status": "out_of_scope"
          }
        ],
        "rationale": "An attacker has used stolen credentials harvested from unmanaged devices to bypass MFA via push fatigue, subsequently discovering cloud secrets and internal shares to exfiltrate data.",
        "blind_spots": [
          {
            "id": "unmanaged-device-visibility",
            "risk": "Attackers harvesting credentials from personal laptops are invisible until they use the credential against corporate endpoints.",
            "owner": "Endpoint Engineering",
            "stage": "identity-led-initial-access",
            "question": "whether the initial infection happened on a device we do not manage",
            "requires": "EDR telemetry on personal devices",
            "remediation": "Enforce managed-device-only policies in the IDP."
          },
          {
            "id": "stolen-session-replay",
            "risk": "Cookie replay bypasses MFA and auth failure logging entirely.",
            "owner": "Identity Team",
            "stage": "identity-led-initial-access",
            "question": "whether a valid session cookie was replayed from a different IP",
            "requires": "hb_auth_signin with session correlation IDs",
            "remediation": "Enable session token binding or IP-pinning."
          }
        ],
        "scoping_notes": "Start with users reporting 'false' for compliance in hb_auth_signin. Focus on servers and administrative workstations first. Widen the domain check if high exposure is found in Hudson Rock.",
        "beyond_detection": "A rule fires on MFA failures. This hunt connects those failures to compliance state, underground exposure, and subsequent cloud discovery\u2014providing the context required to justify account suspension."
      }
    },
    {
      "id": "non-compliant-device-scoping",
      "type": "query",
      "label": "Identify non-compliant device sign-ins",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "identity",
        "content": "SELECT DISTINCT device_hostname, actor_user_name, provider, src_endpoint_ip, time FROM hb_auth_signin WHERE device_is_compliant = 'false' AND time >= datetime('now', '-{{lookback_days}} days') ORDER BY time DESC",
        "surface": "hb_auth_signin",
        "description": "Scope the estate to users and hosts accessing corporate resources from devices that do not meet management policy.",
        "expected_signal": "A list of hosts and users signing in from personal or unmanaged machines. Silence suggests high compliance."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Identify non-compliant device sign-ins",
        "reads": [
          "actor_user_name",
          "device_hostname",
          "device_is_compliant",
          "provider",
          "src_endpoint_ip",
          "time"
        ],
        "source": "hb_auth_signin",
        "target": "identity",
        "content": "SELECT DISTINCT device_hostname, actor_user_name, provider, src_endpoint_ip, time FROM hb_auth_signin WHERE device_is_compliant = 'false' AND time >= datetime('now', '-{{lookback_days}} days') ORDER BY time DESC",
        "silence": "not_evidence_of_absence",
        "expected": "A list of hosts and users signing in from personal or unmanaged machines. Silence suggests high compliance.",
        "verified": "dry-run",
        "verified_at": "2026-10-13"
      }
    },
    {
      "id": "mfa-fatigue-patterns",
      "type": "query",
      "label": "MFA push fatigue patterns",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "identity",
        "content": "SELECT actor_user_name, src_endpoint_ip, SUM(CASE WHEN activity_id = 5 THEN 1 ELSE 0 END) as failures, SUM(CASE WHEN activity_id = 1 THEN 1 ELSE 0 END) as successes FROM hb_auth_signin WHERE time >= datetime('now', '-{{lookback_days}} days') GROUP BY actor_user_name, src_endpoint_ip HAVING failures >= 5 AND successes > 0 ORDER BY failures DESC",
        "surface": "hb_auth_signin",
        "description": "Detect many authentication failures followed by a success for a single user, indicating a push bombing attack.",
        "expected_signal": "A high count of failures followed by success. This is the primary indicator for the Uber-style compromise."
      },
      "parents": [
        {
          "id": "non-compliant-device-scoping"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "MFA push fatigue patterns",
        "reads": [
          "activity_id",
          "actor_user_name",
          "src_endpoint_ip",
          "time"
        ],
        "source": "hb_auth_signin",
        "target": "identity",
        "content": "SELECT actor_user_name, src_endpoint_ip, SUM(CASE WHEN activity_id = 5 THEN 1 ELSE 0 END) as failures, SUM(CASE WHEN activity_id = 1 THEN 1 ELSE 0 END) as successes FROM hb_auth_signin WHERE time >= datetime('now', '-{{lookback_days}} days') GROUP BY actor_user_name, src_endpoint_ip HAVING failures >= 5 AND successes > 0 ORDER BY failures DESC",
        "silence": "not_evidence_of_absence",
        "expected": "A high count of failures followed by success. This is the primary indicator for the Uber-style compromise.",
        "verified": "dry-run",
        "verified_at": "2026-10-13"
      }
    },
    {
      "id": "hudson-rock-exposure",
      "type": "query",
      "label": "Check organizational exposure",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "hudsonrock",
        "content": "SELECT domain, total_stealers, last_employee_compromised FROM hudsonrock_search_by_domain WHERE domain = '{{target_domain}}'",
        "product": "hudsonrock",
        "surface": "hudsonrock_search_by_domain",
        "extension": "hudsonrock",
        "description": "Enrich the hunt by checking if the organizational domain has existing stealer log exposure.",
        "expected_signal": "Confirmed stealer log exposure for the domain, increasing the likelihood that recent sign-ins involve stolen material."
      },
      "parents": [
        {
          "id": "non-compliant-device-scoping"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "Check organizational exposure",
        "reads": [
          "domain",
          "last_employee_compromised",
          "total_stealers"
        ],
        "source": "hudsonrock_search_by_domain",
        "target": "hudsonrock",
        "content": "SELECT domain, total_stealers, last_employee_compromised FROM hudsonrock_search_by_domain WHERE domain = '{{target_domain}}'",
        "silence": "not_evidence_of_absence",
        "expected": "Confirmed stealer log exposure for the domain, increasing the likelihood that recent sign-ins involve stolen material.",
        "verified": "dry-run",
        "verified_at": "2026-10-13",
        "target_extension": "hudsonrock"
      }
    },
    {
      "id": "early-stage-triage",
      "type": "analytic",
      "label": "Evaluate initial access risk",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "hudsonrock",
          "identity"
        ],
        "context": [
          "non-compliant-device-scoping",
          "mfa-fatigue-patterns",
          "hudson-rock-exposure"
        ],
        "objective": "Determine if sign-in patterns indicate a successful account takeover via credential theft or MFA fatigue.",
        "description": "Weigh compliance state, MFA patterns, and domain exposure to determine if an account was compromised.",
        "max_iterations": 6,
        "expected_signal": "A risk assessment per user citing the combination of unmanaged device use and MFA fatigue.",
        "success_criteria": "A per-user verdict (malicious | suspicious | benign) citing MFA success and exposure data."
      },
      "parents": [
        {
          "id": "mfa-fatigue-patterns",
          "kind": "merge"
        },
        {
          "id": "hudson-rock-exposure",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "cloud-discovery-exfil",
      "type": "query",
      "label": "Cloud secret discovery and exfiltration",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "endpoint",
        "content": "SELECT actor_user_name, api_operation, resource_type, resource_name, bytes_out, time FROM hb_cloud_api_activity WHERE (instr(',' || '{{secret_api_ops}}' || ',', ',' || api_operation || ',') > 0 OR bytes_out > 50000000) AND time >= datetime('now', '-{{lookback_days}} days') ORDER BY bytes_out DESC",
        "surface": "hb_cloud_api_activity",
        "description": "Search Cloud API logs for secret-reading operations or large data transfers.",
        "expected_signal": "A user reading access keys, assuming roles, or downloading large amounts of data from S3 or similar services."
      },
      "parents": [
        {
          "id": "early-stage-triage"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "Cloud secret discovery and exfiltration",
        "reads": [
          "actor_user_name",
          "api_operation",
          "bytes_out",
          "resource_name",
          "resource_type",
          "time"
        ],
        "source": "hb_cloud_api_activity",
        "target": "endpoint",
        "content": "SELECT actor_user_name, api_operation, resource_type, resource_name, bytes_out, time FROM hb_cloud_api_activity WHERE (instr(',' || '{{secret_api_ops}}' || ',', ',' || api_operation || ',') > 0 OR bytes_out > 50000000) AND time >= datetime('now', '-{{lookback_days}} days') ORDER BY bytes_out DESC",
        "silence": "not_evidence_of_absence",
        "expected": "A user reading access keys, assuming roles, or downloading large amounts of data from S3 or similar services.",
        "verified": "dry-run",
        "verified_at": "2026-10-13"
      }
    },
    {
      "id": "internal-smb-discovery",
      "type": "query",
      "label": "Sensitive SMB share access",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "endpoint",
        "content": "SELECT actor_user_name, share_name, file_name, device_hostname, time FROM hb_smb_activity WHERE instr(',' || '{{sensitive_shares}}' || ',', ',' || LOWER(share_name) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ORDER BY time DESC",
        "surface": "hb_smb_activity",
        "description": "Correlate identity access with discovery of backup files or credentials on administrative shares.",
        "expected_signal": "Users previously identified as high-risk accessing sensitive shares like ADMIN$ or backup locations."
      },
      "parents": [
        {
          "id": "early-stage-triage"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "Sensitive SMB share access",
        "reads": [
          "actor_user_name",
          "device_hostname",
          "file_name",
          "share_name",
          "time"
        ],
        "source": "hb_smb_activity",
        "target": "endpoint",
        "content": "SELECT actor_user_name, share_name, file_name, device_hostname, time FROM hb_smb_activity WHERE instr(',' || '{{sensitive_shares}}' || ',', ',' || LOWER(share_name) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') ORDER BY time DESC",
        "silence": "not_evidence_of_absence",
        "expected": "Users previously identified as high-risk accessing sensitive shares like ADMIN$ or backup locations.",
        "verified": "dry-run",
        "verified_at": "2026-10-13"
      }
    },
    {
      "id": "intent-correlation-agent",
      "type": "analytic",
      "label": "Correlate intent and impact",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "hudsonrock",
          "identity"
        ],
        "context": [
          "early-stage-triage",
          "cloud-discovery-exfil",
          "internal-smb-discovery"
        ],
        "objective": "Confirm if accounts identified in the first phase have engaged in unauthorized secret discovery or large-scale exfiltration.",
        "description": "Connect anomalous initial access with specific discovery and exfiltration activity.",
        "max_iterations": 6,
        "expected_signal": "A comprehensive verdict confirming active intrusion and data risk.",
        "success_criteria": "A final verdict citing the initial access anomaly and the cloud/share activity that confirms malicious intent."
      },
      "parents": [
        {
          "id": "cloud-discovery-exfil",
          "kind": "merge"
        },
        {
          "id": "internal-smb-discovery",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-on-verdict",
      "type": "checkpoint",
      "label": "Route on verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the intent-correlation-agent confirms a high-risk compromise with evidence of secret discovery or exfiltration",
        "condition": "the intent-correlation-agent confirms a high-risk compromise with evidence of secret discovery or exfiltration",
        "blind_spot": "unmanaged-device-visibility",
        "confidence": "high",
        "description": "Direct the hunt to containment or review based on the agent's findings.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "intent-correlation-agent"
        }
      ]
    },
    {
      "id": "suspend-account",
      "type": "action",
      "label": "Suspend compromised identity",
      "config": {
        "target": "identity",
        "description": "Immediately halt the attacker's progress by suspending the user account.",
        "instructions": "Suspend the account(s) identified and revoke all active session tokens.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-remediation",
      "type": "task",
      "label": "Analyst remediation review",
      "config": {
        "assignee": "analyst",
        "description": "Ensure all traces of the identity-led breach are addressed.",
        "instructions": "Review Cloud API activity for AssumeRole operations and subsequent actions. Verify if any downloaded files contained sensitive PII."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "default"
        },
        {
          "id": "route-on-verdict",
          "branch": "on_unavailable"
        },
        {
          "id": "suspend-account"
        }
      ]
    },
    {
      "id": "hunt-close-out",
      "type": "task",
      "label": "Close out hunt",
      "config": {
        "assignee": "analyst",
        "description": "Finalize the hunt and record findings.",
        "instructions": "Record the usernames investigated and shares hit. Note any visibility gaps encountered."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_refutes"
        },
        {
          "id": "analyst-remediation"
        }
      ]
    }
  ]
}