{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "promote-to-detection",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "Protecting critical infrastructure from supply chain compromise is a primary obligation; this hunt validates the integrity of integrator access to sensitive SCADA data."
      },
      "name": "Integrator Supply Chain Compromise and SCADA Data Exfiltration",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1195",
        "attack.t1190",
        "attack.t1083",
        "attack.t1560",
        "attack.t1041"
      ],
      "related": [
        {
          "hunt": "lateral-movement-via-engineering-tools",
          "reason": "Once an integrator's beachhead is established, lateral movement using legitimate engineering tools is the next likely step.",
          "relation": "follows"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "network": {
          "name": "Network telemetry",
          "category": "network",
          "telemetry": [
            "network"
          ]
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        },
        "identity": {
          "name": "Identity / sign-in telemetry",
          "category": "identity",
          "telemetry": [
            "identity"
          ]
        }
      },
      "analysis": "A single detection rule cannot correlate the internet-exposed scoping with specific sensitive keyword discovery and rare archive staging behavior; this hunt uses three telemetry surfaces and a phased flow to distinguish a breach from normal engineering maintenance.",
      "coverage": [
        {
          "stage": "initial-access-integrator-pivot",
          "steps": [
            "exposed-asset-inventory",
            "auth-logins-from-integrators",
            "external-inbound-connections"
          ],
          "status": "covered"
        },
        {
          "stage": "discovery-sensitive-keywords",
          "steps": [
            "discovery-by-keywords"
          ],
          "status": "covered"
        },
        {
          "stage": "collection-archive-staging",
          "steps": [
            "archive-creation-prevalence"
          ],
          "status": "covered"
        },
        {
          "stage": "exfiltration-c2-channel",
          "steps": [
            "exfiltration-traffic-peaks"
          ],
          "status": "covered"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Supply Chain or Exploit Access",
            "slug": "initial-access-integrator-pivot",
            "tactic": "initial-access",
            "techniques": [
              "T1195",
              "T1190"
            ],
            "observables": [
              "Remote access connections from integrator networks",
              "Exploitation of public-facing applications",
              "Industrial automation solution company network access"
            ]
          },
          {
            "name": "File and Keyword Discovery",
            "slug": "discovery-sensitive-keywords",
            "tactic": "discovery",
            "techniques": [
              "T1083"
            ],
            "observables": [
              "Search terms: 'customers'",
              "Search terms: 'SCADA'",
              "Access to ICS device details and schematics"
            ]
          },
          {
            "name": "Data Staging in ZIP Archives",
            "slug": "collection-archive-staging",
            "tactic": "collection",
            "techniques": [
              "T1560"
            ],
            "observables": [
              "Creation of nine .zip files",
              "Bundling of approximately 800 files",
              "Archive names containing SCADA or customer information"
            ]
          },
          {
            "name": "Exfiltration over C2",
            "slug": "exfiltration-c2-channel",
            "tactic": "exfiltration",
            "techniques": [
              "T1041"
            ],
            "observables": [
              "Outbound transfer of ZIP archives",
              "Communication with external infrastructure"
            ]
          }
        ],
        "summary": "Foreign cyber actors compromised a U.S. industrial automation solutions provider to gain access to downstream critical infrastructure customer data. The actors searched for SCADA configurations and schematics, bundled them into ZIP archives, and exfiltrated the data to enable future disruptive attacks against ICS environments."
      },
      "severity": "high",
      "rationale": "Focus on engineering workstations, jump hosts, and jump servers that are accessible to third-party integrators. Use the internet-exposed inventory to identify potential entry points.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "A malicious actor has pivoted from a compromised third-party integrator network into the ICS environment, searched for SCADA schematics using sensitive keywords, and staged them in archives for exfiltration.",
      "parameters": {
        "scope_hosts": {
          "from": {
            "ref": "analyst-scoping",
            "kind": "manual",
            "observed": "2026-09-23"
          },
          "type": "list[host]",
          "default": [],
          "description": "Hosts identified in the scoping query to narrow the second-stage search."
        },
        "lookback_days": {
          "from": {
            "ref": "standard-baseline",
            "kind": "manual",
            "observed": "2026-09-23"
          },
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        },
        "integrator_ips": {
          "from": {
            "ref": "customer-inventory",
            "kind": "manual",
            "observed": "2026-09-23"
          },
          "type": "list[ip]",
          "default": [],
          "description": "Known IP ranges of third-party integrators; if empty, the hunt checks all external successes."
        },
        "scada_keywords": {
          "from": {
            "ref": "cisa-advisory-integrators",
            "kind": "article",
            "observed": "2026-09-23"
          },
          "type": "list[string]",
          "default": [
            "scada",
            "customer",
            "customers",
            "schematic",
            "plc",
            "diagram"
          ],
          "description": "Keywords potentially used in filenames during the discovery phase."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.cisa.gov/resources-tools/resources/considerations-critical-infrastructure-operators-working-third-party-ics-integrators",
          "gates": [
            "dry-run",
            "lint",
            "critic"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.cisa.gov/resources-tools/resources/considerations-critical-infrastructure-operators-working-third-party-ics-integrators",
          "name": "CISA Advisory: Considerations for Critical Infrastructure Operators Working With Third-Party ICS Integrators"
        }
      ],
      "blind_spots": [
        {
          "id": "limited-endpoint-visibility",
          "risk": "An actor moving directly to a controller via a legacy protocol may be invisible to endpoint-based file and process monitoring.",
          "stage": "initial-access-integrator-pivot",
          "question": "Are the PLC or SCADA controllers themselves logging process and file activity?",
          "requires": "Endpoint telemetry on legacy ICS controllers"
        },
        {
          "id": "exfil-payload-opacity",
          "risk": "The hunt relies on byte counts; without inspection, we cannot prove the content of the transfer.",
          "stage": "exfiltration-c2-channel",
          "question": "Are the network connections carrying the staged ZIP files or benign maintenance data?",
          "requires": "DPI or TLS inspection"
        }
      ]
    },
    "name": "Integrator Supply Chain Compromise and SCADA Data Exfiltration",
    "description": "This hunt follows a phased flow to detect the end-to-end attack chain reported by FBI and CISA. The hunt first identifies internet-exposed assets and triages early access markers like logins from integrator-owned IPs or anomalous inbound traffic. If the hunt identifies an early beachhead, it fans out to look for follow-on discovery behavior like keyword searches for SCADA and customers, rare data staging in .zip archives, and significant outbound traffic spikes. This mirrors the activity where an adversary compromised a U.S. industrial automation company to reach power and transportation utility customers. One agent evaluates the early signs of breach, while a second agent weighs the complete chain to confirm exfiltration. Finally, an analyst reviews the findings to isolate the host and revoke credentials."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "coverage": [
          {
            "stage": "initial-access-integrator-pivot",
            "steps": [
              "exposed-asset-inventory",
              "auth-logins-from-integrators",
              "external-inbound-connections"
            ],
            "status": "covered"
          },
          {
            "stage": "discovery-sensitive-keywords",
            "steps": [
              "discovery-by-keywords"
            ],
            "status": "covered"
          },
          {
            "stage": "collection-archive-staging",
            "steps": [
              "archive-creation-prevalence"
            ],
            "status": "covered"
          },
          {
            "stage": "exfiltration-c2-channel",
            "steps": [
              "exfiltration-traffic-peaks"
            ],
            "status": "covered"
          }
        ],
        "rationale": "A malicious actor has pivoted from a compromised third-party integrator network into the ICS environment, searched for SCADA schematics using sensitive keywords, and staged them in archives for exfiltration.",
        "blind_spots": [
          {
            "id": "limited-endpoint-visibility",
            "risk": "An actor moving directly to a controller via a legacy protocol may be invisible to endpoint-based file and process monitoring.",
            "stage": "initial-access-integrator-pivot",
            "question": "Are the PLC or SCADA controllers themselves logging process and file activity?",
            "requires": "Endpoint telemetry on legacy ICS controllers"
          },
          {
            "id": "exfil-payload-opacity",
            "risk": "The hunt relies on byte counts; without inspection, we cannot prove the content of the transfer.",
            "stage": "exfiltration-c2-channel",
            "question": "Are the network connections carrying the staged ZIP files or benign maintenance data?",
            "requires": "DPI or TLS inspection"
          }
        ],
        "scoping_notes": "Focus on engineering workstations, jump hosts, and jump servers that are accessible to third-party integrators. Use the internet-exposed inventory to identify potential entry points.",
        "beyond_detection": "A single detection rule cannot correlate the internet-exposed scoping with specific sensitive keyword discovery and rare archive staging behavior; this hunt uses three telemetry surfaces and a phased flow to distinguish a breach from normal engineering maintenance."
      }
    },
    {
      "id": "exposed-asset-inventory",
      "type": "query",
      "label": "Identify internet-exposed assets",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT domain_or_ip, product, asset_type, port FROM hb_exposed_assets WHERE asset_type = 'service'",
        "surface": "hb_exposed_assets",
        "description": "Find the assets that are externally reachable and serve as the most likely pivot points from an integrator.",
        "expected_signal": "A list of hostnames or IPs with internet exposure. Silence means no assets are currently cataloged as exposed."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Identify internet-exposed assets",
        "reads": [
          "domain_or_ip",
          "product",
          "asset_type",
          "port"
        ],
        "source": "hb_exposed_assets",
        "target": "endpoint",
        "content": "SELECT domain_or_ip, product, asset_type, port FROM hb_exposed_assets WHERE asset_type = 'service'",
        "silence": "not_evidence_of_absence",
        "expected": "A list of hostnames or IPs with internet exposure. Silence means no assets are currently cataloged as exposed.",
        "verified": "dry-run",
        "verified_at": "2026-09-24"
      }
    },
    {
      "id": "auth-logins-from-integrators",
      "type": "query",
      "label": "Authentication from integrator sources",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "identity",
        "content": "SELECT actor_user_name, src_endpoint_ip, dst_endpoint_name, time FROM hb_auth_signin WHERE status_id = 1 AND ('{{integrator_ips}}' = '' OR instr(',' || '{{integrator_ips}}' || ',', ',' || src_endpoint_ip || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_auth_signin",
        "description": "Check for successful logins from the integrator's network or external sources into the estate.",
        "expected_signal": "Rows mapping users and IPs to successful logins. If integrator_ips is empty, any external-to-internal successful auth is returned."
      },
      "parents": [
        {
          "id": "exposed-asset-inventory"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "Authentication from integrator sources",
        "reads": [
          "actor_user_name",
          "src_endpoint_ip",
          "dst_endpoint_name",
          "time",
          "status_id"
        ],
        "source": "hb_auth_signin",
        "target": "identity",
        "content": "SELECT actor_user_name, src_endpoint_ip, dst_endpoint_name, time FROM hb_auth_signin WHERE status_id = 1 AND ('{{integrator_ips}}' = '' OR instr(',' || '{{integrator_ips}}' || ',', ',' || src_endpoint_ip || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Rows mapping users and IPs to successful logins. If integrator_ips is empty, any external-to-internal successful auth is returned.",
        "verified": "dry-run",
        "verified_at": "2026-09-24"
      }
    },
    {
      "id": "external-inbound-connections",
      "type": "query",
      "label": "Anomalous inbound network sessions",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "network",
        "content": "SELECT device_hostname, src_endpoint_ip, dst_endpoint_port, time FROM hb_network_connection WHERE direction = 'inbound' AND state_kind = 'log' AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_network_connection",
        "description": "Identify inbound log sessions from external IPs that might signify exploitation of a public application.",
        "expected_signal": "Evidence of external IP addresses establishing connections to internal endpoints."
      },
      "parents": [
        {
          "id": "exposed-asset-inventory"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "Anomalous inbound network sessions",
        "reads": [
          "device_hostname",
          "src_endpoint_ip",
          "dst_endpoint_port",
          "time",
          "direction",
          "state_kind"
        ],
        "source": "hb_network_connection",
        "target": "network",
        "content": "SELECT device_hostname, src_endpoint_ip, dst_endpoint_port, time FROM hb_network_connection WHERE direction = 'inbound' AND state_kind = 'log' AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Evidence of external IP addresses establishing connections to internal endpoints.",
        "verified": "dry-run",
        "verified_at": "2026-09-24"
      }
    },
    {
      "id": "early-access-triage",
      "type": "analytic",
      "label": "Triaging early access",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "identity",
          "network"
        ],
        "context": [
          "exposed-asset-inventory",
          "auth-logins-from-integrators",
          "external-inbound-connections"
        ],
        "objective": "Determine if any host in the scope has received suspicious logins or network traffic from external sources.",
        "description": "Analyze whether any host from the scoping inventory shows active sign-in or connection markers from the integrator's direction.",
        "max_iterations": 3,
        "expected_signal": "A per-host verdict of suspicious if the beachhead phase is corroborated.",
        "success_criteria": "A verdict citing specific rows for any host with external login success or anomalous inbound traffic."
      },
      "parents": [
        {
          "id": "auth-logins-from-integrators",
          "kind": "merge"
        },
        {
          "id": "external-inbound-connections",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "discovery-by-keywords",
      "type": "query",
      "label": "Sensitive keyword file access",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "endpoint",
        "content": "SELECT device_hostname, file_name, file_path, process_name, time FROM hb_file_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND instr(',' || '{{scada_keywords}}' || ',', ',' || LOWER(file_name) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_file_activity",
        "description": "Detect an actor searching for SCADA schematics or customer data as mentioned in the advisory.",
        "expected_signal": "A process accessing or creating files with keywords like 'SCADA' or 'customer'. None means those exact terms were not observed in filenames."
      },
      "parents": [
        {
          "id": "early-access-triage"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Sensitive keyword file access",
        "reads": [
          "device_hostname",
          "file_name",
          "file_path",
          "process_name",
          "time"
        ],
        "source": "hb_file_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, file_name, file_path, process_name, time FROM hb_file_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND instr(',' || '{{scada_keywords}}' || ',', ',' || LOWER(file_name) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "A process accessing or creating files with keywords like 'SCADA' or 'customer'. None means those exact terms were not observed in filenames.",
        "verified": "dry-run",
        "verified_at": "2026-09-24"
      }
    },
    {
      "id": "archive-creation-prevalence",
      "type": "query",
      "label": "Rare archive creation prevalence",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_name, COUNT(DISTINCT file_path) AS archive_count, MIN(time) AS first_seen FROM hb_file_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(file_path) LIKE '%.zip' OR LOWER(file_path) LIKE '%.7z') AND activity_id = 1 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_name HAVING archive_count > 1",
        "surface": "hb_file_activity",
        "description": "Find the staging of multiple files into archives, which is rare across the fleet.",
        "expected_signal": "A host where a process creates multiple archives. Baseline analysis highlights those that are rare."
      },
      "parents": [
        {
          "id": "early-access-triage"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Rare archive creation prevalence",
        "reads": [
          "device_hostname",
          "process_name",
          "file_path",
          "activity_id",
          "time"
        ],
        "source": "hb_file_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_name, COUNT(DISTINCT file_path) AS archive_count, MIN(time) AS first_seen FROM hb_file_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(file_path) LIKE '%.zip' OR LOWER(file_path) LIKE '%.7z') AND activity_id = 1 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, process_name HAVING archive_count > 1",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "A host where a process creates multiple archives. Baseline analysis highlights those that are rare.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "process_name"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-09-24"
      }
    },
    {
      "id": "exfiltration-traffic-peaks",
      "type": "query",
      "label": "Exfiltration traffic peaks",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "network",
        "content": "SELECT device_hostname, dst_endpoint_ip, SUM(traffic_bytes) AS total_bytes FROM hb_network_connection WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND direction = 'outbound' AND state_kind = 'log' AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, dst_endpoint_ip HAVING total_bytes > 5000000",
        "surface": "hb_network_connection",
        "description": "Identify significant outbound data transfers that match the expected staging size.",
        "expected_signal": "A host sending more than 5MB of data to an external IP. Silence proofs absence of large transfers to single destinations."
      },
      "parents": [
        {
          "id": "early-access-triage"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "Exfiltration traffic peaks",
        "reads": [
          "device_hostname",
          "dst_endpoint_ip",
          "traffic_bytes",
          "direction",
          "state_kind",
          "time"
        ],
        "source": "hb_network_connection",
        "target": "network",
        "content": "SELECT device_hostname, dst_endpoint_ip, SUM(traffic_bytes) AS total_bytes FROM hb_network_connection WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND direction = 'outbound' AND state_kind = 'log' AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, dst_endpoint_ip HAVING total_bytes > 5000000",
        "silence": "evidence_of_absence",
        "expected": "A host sending more than 5MB of data to an external IP. Silence proofs absence of large transfers to single destinations.",
        "verified": "dry-run",
        "verified_at": "2026-09-24"
      }
    },
    {
      "id": "follow-on-triage",
      "type": "analytic",
      "label": "Full chain verdict",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "identity",
          "network"
        ],
        "context": [
          "early-access-triage",
          "discovery-by-keywords",
          "archive-creation-prevalence",
          "exfiltration-traffic-peaks"
        ],
        "objective": "Decide if the observed behavior on a host constitutes a successful exfiltration of sensitive industrial data following an integrator pivot.",
        "description": "Combine the early access triage with the follow-on discovery and exfiltration evidence to determine if a breach occurred.",
        "max_iterations": 5,
        "expected_signal": "A high-confidence verdict for any host showing the full progression.",
        "success_criteria": "A per-host verdict citing the beachhead markers followed by keyword-specific file access or rare staging behavior."
      },
      "parents": [
        {
          "id": "discovery-by-keywords",
          "kind": "merge"
        },
        {
          "id": "archive-creation-prevalence",
          "kind": "merge"
        },
        {
          "id": "exfiltration-traffic-peaks",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "incident-decision",
      "type": "checkpoint",
      "label": "Route on full verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the follow-on-triage verdict identifies a host with both early-access markers and subsequent discovery or staging behavior",
        "condition": "the follow-on-triage verdict identifies a host with both early-access markers and subsequent discovery or staging behavior",
        "blind_spot": "limited-endpoint-visibility",
        "confidence": "high",
        "description": "Direct the response based on the agent's judgment of the attack chain.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "follow-on-triage"
        }
      ]
    },
    {
      "id": "contain-host",
      "type": "action",
      "label": "Contain suspected host",
      "config": {
        "target": "endpoint",
        "description": "Isolate the host to prevent further exfiltration or lateral movement.",
        "instructions": "Isolate the endpoint and revoke any associated integrator credentials.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "incident-decision",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-review",
      "type": "task",
      "label": "Analyst final review",
      "config": {
        "assignee": "analyst",
        "description": "Validate the findings and prepare the IR handoff.",
        "instructions": "Review the file paths and process command lines for the keywords; confirm the destination of the exfiltration traffic."
      },
      "parents": [
        {
          "id": "incident-decision",
          "branch": "default"
        },
        {
          "id": "incident-decision",
          "branch": "on_unavailable"
        },
        {
          "id": "contain-host"
        }
      ]
    },
    {
      "id": "close-out",
      "type": "task",
      "label": "Close out hunt",
      "config": {
        "assignee": "analyst",
        "description": "Record the coverage and negative findings.",
        "instructions": "Document that the integrator pivot and SCADA exfiltration scenario was not observed for the given scope and window."
      },
      "parents": [
        {
          "id": "incident-decision",
          "branch": "on_refutes"
        }
      ]
    }
  ]
}