{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "promote-to-detection",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "Exploitation of public-facing applications is the primary entry point for gaining the identities needed for cloud intrusions. A negative result validates the organization's perimeter integrity and the stability of its service identities."
      },
      "name": "Public app exploitation and cloud identity drift",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1190",
        "attack.t1204.002",
        "attack.t1078.004"
      ],
      "series": {
        "slug": "unmasking-cloud-identities-from-behavioral-clustering-to-automated-detection",
        "index": 1,
        "title": "Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection",
        "total": 2
      },
      "related": [
        {
          "hunt": "cloud-identity-behavioral-anomaly",
          "reason": "This hunt identifies the initial compromise; the follow-on hunt examines broader identity misuse within the cloud control plane.",
          "relation": "follows"
        }
      ],
      "targets": {
        "web": {
          "name": "Web server / proxy logs",
          "category": "siem",
          "telemetry": [
            "network"
          ]
        },
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        },
        "identity": {
          "name": "Identity / sign-in telemetry",
          "category": "identity",
          "telemetry": [
            "identity"
          ]
        }
      },
      "analysis": "While a detection rule might fire on a shell, it lacks the context of identity role drift. This hunt correlates vulnerability data, successful HTTP exploitation, and IAM sign-in context to evaluate behavior against a host's functional profile.",
      "coverage": [
        {
          "stage": "exploit-public-application",
          "steps": [
            "high-risk-vulnerable-hosts",
            "web-exploitation-indicators"
          ],
          "status": "covered"
        },
        {
          "stage": "client-side-execution",
          "steps": [
            "suspicious-shell-spawns",
            "encoded-script-execution"
          ],
          "status": "covered"
        },
        {
          "stage": "cloud-identity-authentication",
          "reason": "Belongs to another part of the 'Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "cloud-resource-discovery",
          "reason": "Belongs to another part of the 'Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection' series.",
          "status": "out_of_scope"
        },
        {
          "stage": "multi-hop-proxy-obfuscation",
          "reason": "Belongs to another part of the 'Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection' series.",
          "status": "out_of_scope"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Exploitation of Public-Facing Application",
            "slug": "exploit-public-application",
            "tactic": "initial-access",
            "techniques": [
              "T1190"
            ],
            "observables": [
              "Inbound exploitation attempts against internet-facing web servers",
              "Unauthorized HTTP POST requests to vulnerable endpoints"
            ]
          },
          {
            "name": "User Execution of Malicious File",
            "slug": "client-side-execution",
            "tactic": "execution",
            "techniques": [
              "T1204.002"
            ],
            "observables": [
              "Execution of downloaded suspicious documents or binaries",
              "Process spawning from browser or email client",
              "Malicious file creation in temporary directories"
            ]
          },
          {
            "name": "Cloud Identity Authentication",
            "slug": "cloud-identity-authentication",
            "tactic": "initial-access",
            "observables": [
              "ConsoleLogin events",
              "GetSigninToken activity",
              "Identity naming patterns containing 'admin'",
              "AWSReservedSSO_AdministratorAccess_ prefix usage"
            ]
          },
          {
            "name": "Cloud Resource Discovery",
            "slug": "cloud-resource-discovery",
            "tactic": "discovery",
            "observables": [
              "ListBuckets",
              "ListRoles",
              "ListNotificationHubs",
              "GetCostAndUsage",
              "GetCostForecast"
            ]
          },
          {
            "name": "Multi-hop Proxy Obfuscation",
            "slug": "multi-hop-proxy-obfuscation",
            "tactic": "command-and-control",
            "techniques": [
              "T1090.003"
            ],
            "observables": [
              "Sign-in activity from known Tor exit nodes",
              "Network connections to multi-hop VPS or ORB networks",
              "Anomalous source IP addresses for administrative sessions"
            ]
          }
        ],
        "summary": "Attackers leverage exploited applications or social engineering to gain access to over-privileged cloud identities, which are then used to perform resource enumeration and discovery within AWS Management Console. To evade detection, actors masquerade using benign permission profiles and mask their activity source through multi-hop proxies or Tor, requiring behavioral clustering to distinguish malicious reconnaissance from legitimate administrative activity."
      },
      "severity": "medium",
      "rationale": "Focus on cloud instances with High or Critical vulnerabilities first. The scoping query uses a join to provide hostnames for the scope_hosts parameter. If no vulnerabilities are reported, widen the scope to all hosts with internet exposure found in hb_exposed_assets.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An adversary has exploited a public-facing application on a cloud instance to obtain its identity, which is now being used for activity that deviates from the host's established behavioral profile.",
      "parameters": {
        "scope_hosts": {
          "type": "list[host]",
          "default": [],
          "description": "Hostnames derived from the scoping step; leave empty to scan the full estate."
        },
        "lookback_days": {
          "type": "number",
          "default": "14",
          "description": "Days of history to examine for active behavior."
        },
        "sensitive_paths": {
          "type": "list[string]",
          "default": [
            "/etc/passwd",
            "/etc/shadow",
            "/wp-admin/",
            "/cgi-bin/",
            "/.env",
            "/config.php",
            "/aws/config",
            "/metadata/latest/"
          ],
          "description": "Web paths frequently targeted by directory traversal or cloud metadata theft."
        },
        "shell_processes": {
          "type": "list[string]",
          "default": [
            "cmd.exe",
            "powershell.exe",
            "pwsh.exe",
            "sh",
            "bash",
            "nc",
            "curl",
            "wget"
          ],
          "description": "Shells and network tools that indicate post-exploitation activity."
        },
        "web_parent_processes": {
          "type": "list[string]",
          "default": [
            "httpd",
            "nginx",
            "w3wp.exe",
            "apache2",
            "php-fpm",
            "chrome.exe",
            "msedge.exe",
            "outlook.exe"
          ],
          "description": "Parent processes commonly exploited or used to launch malicious payloads."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://unit42.paloaltonetworks.com/behavioral-clustering-map-to-cloud-identities/",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://unit42.paloaltonetworks.com/behavioral-clustering-map-to-cloud-identities/",
          "name": "Unit 42 \u2014 Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection"
        }
      ],
      "blind_spots": [
        {
          "id": "no-http-body-telemetry",
          "risk": "hb_http_activity lacks request bodies, making it hard to distinguish between legitimate API usage and exploitation on success.",
          "stage": "exploit-public-application",
          "question": "whether the specific payload in a successful POST request was malicious",
          "requires": "WAF or local server logs with body content"
        },
        {
          "id": "no-endpoint-telemetry",
          "risk": "A host without an agent provides no process or script visibility, leaving the hunt blind to the follow-on execution.",
          "stage": "client-side-execution",
          "question": "whether a shell was spawned on a host missing the telemetry agent",
          "requires": "hb_process_activity from an endpoint agent"
        }
      ]
    },
    "name": "Public app exploitation and cloud identity drift",
    "description": "This hunt identifies the initial entry points of a cloud-focused intrusion by examining internet-exposed hosts for vulnerabilities, successful web exploitation, and follow-on shell activity. Building on Unit 42 research regarding behavioral clustering of cloud identities, the hunt evaluates whether the activity observed on a compromised host aligns with its functional role. By correlating HTTP traffic, anomalous process execution, and the underlying IAM identity, analysts can detect when a service role has been co-opted for malicious discovery or lateral movement."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "series": {
          "slug": "unmasking-cloud-identities-from-behavioral-clustering-to-automated-detection",
          "index": 1,
          "title": "Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection",
          "total": 2
        },
        "coverage": [
          {
            "stage": "exploit-public-application",
            "steps": [
              "high-risk-vulnerable-hosts",
              "web-exploitation-indicators"
            ],
            "status": "covered"
          },
          {
            "stage": "client-side-execution",
            "steps": [
              "suspicious-shell-spawns",
              "encoded-script-execution"
            ],
            "status": "covered"
          },
          {
            "stage": "cloud-identity-authentication",
            "reason": "Belongs to another part of the 'Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "cloud-resource-discovery",
            "reason": "Belongs to another part of the 'Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection' series.",
            "status": "out_of_scope"
          },
          {
            "stage": "multi-hop-proxy-obfuscation",
            "reason": "Belongs to another part of the 'Unmasking Cloud Identities: From Behavioral Clustering to Automated Detection' series.",
            "status": "out_of_scope"
          }
        ],
        "rationale": "An adversary has exploited a public-facing application on a cloud instance to obtain its identity, which is now being used for activity that deviates from the host's established behavioral profile.",
        "blind_spots": [
          {
            "id": "no-http-body-telemetry",
            "risk": "hb_http_activity lacks request bodies, making it hard to distinguish between legitimate API usage and exploitation on success.",
            "stage": "exploit-public-application",
            "question": "whether the specific payload in a successful POST request was malicious",
            "requires": "WAF or local server logs with body content"
          },
          {
            "id": "no-endpoint-telemetry",
            "risk": "A host without an agent provides no process or script visibility, leaving the hunt blind to the follow-on execution.",
            "stage": "client-side-execution",
            "question": "whether a shell was spawned on a host missing the telemetry agent",
            "requires": "hb_process_activity from an endpoint agent"
          }
        ],
        "scoping_notes": "Focus on cloud instances with High or Critical vulnerabilities first. The scoping query uses a join to provide hostnames for the scope_hosts parameter. If no vulnerabilities are reported, widen the scope to all hosts with internet exposure found in hb_exposed_assets.",
        "beyond_detection": "While a detection rule might fire on a shell, it lacks the context of identity role drift. This hunt correlates vulnerability data, successful HTTP exploitation, and IAM sign-in context to evaluate behavior against a host's functional profile."
      }
    },
    {
      "id": "high-risk-vulnerable-hosts",
      "type": "query",
      "label": "Identify vulnerable internet-facing hosts",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT DISTINCT d.hostname AS device_hostname, v.cve_uid, v.title FROM hb_vulnerability_finding v JOIN hb_devices d ON v.device_uid = d.device_uid WHERE v.severity_id >= 4 AND v.resource_type = 'instance' AND v.status != 'suppressed' AND v.provider = d.provider",
        "surface": "hb_vulnerability_finding",
        "description": "Focus the hunt on instances with known high or critical vulnerabilities by joining vulnerability findings with device inventory to get hostnames.",
        "expected_signal": "A list of hostnames for cloud instances with critical vulnerabilities. If empty, the estate has no current high-risk exposures to focus on."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Identify vulnerable internet-facing hosts",
        "reads": [
          "v.device_uid",
          "d.device_uid",
          "d.hostname",
          "v.severity_id",
          "v.resource_type",
          "v.status",
          "v.provider",
          "d.provider"
        ],
        "source": "hb_vulnerability_finding",
        "target": "endpoint",
        "content": "SELECT DISTINCT d.hostname AS device_hostname, v.cve_uid, v.title FROM hb_vulnerability_finding v JOIN hb_devices d ON v.device_uid = d.device_uid WHERE v.severity_id >= 4 AND v.resource_type = 'instance' AND v.status != 'suppressed' AND v.provider = d.provider",
        "silence": "not_evidence_of_absence",
        "expected": "A list of hostnames for cloud instances with critical vulnerabilities. If empty, the estate has no current high-risk exposures to focus on.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "web-exploitation-indicators",
      "type": "query",
      "label": "Successful web application exploitation",
      "config": {
        "dsl": "sqlite",
        "role": "triage",
        "source": "web",
        "content": "SELECT device_hostname, url_path, status_code, src_endpoint_ip, COUNT(*) as total_requests FROM hb_http_activity WHERE (status_code = 200 OR status_code >= 400) AND (instr(',' || '{{sensitive_paths}}' || ',', ',' || LOWER(url_path) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, url_path, status_code, src_endpoint_ip",
        "surface": "hb_http_activity",
        "description": "Identify successful HTTP requests to sensitive paths or those resulting in errors that suggest attempts to exploit web vulnerabilities.",
        "expected_signal": "Requests resulting in status 200 for sensitive system files or cloud metadata, indicating potential successful exploitation."
      },
      "parents": [
        {
          "id": "high-risk-vulnerable-hosts"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "triage",
        "label": "Successful web application exploitation",
        "reads": [
          "device_hostname",
          "url_path",
          "status_code",
          "src_endpoint_ip",
          "time"
        ],
        "source": "hb_http_activity",
        "target": "web",
        "content": "SELECT device_hostname, url_path, status_code, src_endpoint_ip, COUNT(*) as total_requests FROM hb_http_activity WHERE (status_code = 200 OR status_code >= 400) AND (instr(',' || '{{sensitive_paths}}' || ',', ',' || LOWER(url_path) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, url_path, status_code, src_endpoint_ip",
        "silence": "not_evidence_of_absence",
        "expected": "Requests resulting in status 200 for sensitive system files or cloud metadata, indicating potential successful exploitation.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "suspicious-shell-spawns",
      "type": "query",
      "label": "Anomalous shell spawns from web processes",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, user_name, time FROM hb_process_activity WHERE (instr(',' || '{{web_parent_processes}}' || ',', ',' || LOWER(parent_process_name) || ',') > 0) AND (instr(',' || '{{shell_processes}}' || ',', ',' || LOWER(process_name) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_process_activity",
        "description": "Detect successful exploitation by finding shells spawned by web servers or other user-facing applications.",
        "expected_signal": "A shell running under a web server context (e.g., www-data) following a web request."
      },
      "parents": [
        {
          "id": "high-risk-vulnerable-hosts"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Anomalous shell spawns from web processes",
        "reads": [
          "device_hostname",
          "process_name",
          "process_cmd_line",
          "parent_process_name",
          "user_name",
          "time"
        ],
        "source": "hb_process_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_name, process_cmd_line, parent_process_name, user_name, time FROM hb_process_activity WHERE (instr(',' || '{{web_parent_processes}}' || ',', ',' || LOWER(parent_process_name) || ',') > 0) AND (instr(',' || '{{shell_processes}}' || ',', ',' || LOWER(process_name) || ',') > 0) AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "A shell running under a web server context (e.g., www-data) following a web request.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "encoded-script-execution",
      "type": "query",
      "label": "In-memory or encoded script activity",
      "config": {
        "dsl": "sqlite",
        "role": "triage",
        "source": "endpoint",
        "content": "SELECT device_hostname, script_name, script_content, actor_user_name, time FROM hb_script_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_script_activity",
        "description": "Capture encoded or in-memory execution which frequently follows initial exploitation to obfuscate post-compromise activity.",
        "expected_signal": "Encoded script blocks or suspicious PowerShell/Shell script content on potentially compromised hosts."
      },
      "parents": [
        {
          "id": "high-risk-vulnerable-hosts"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "triage",
        "label": "In-memory or encoded script activity",
        "reads": [
          "device_hostname",
          "script_name",
          "script_content",
          "actor_user_name",
          "time"
        ],
        "source": "hb_script_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, script_name, script_content, actor_user_name, time FROM hb_script_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Encoded script blocks or suspicious PowerShell/Shell script content on potentially compromised hosts.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "host-identity-context",
      "type": "query",
      "label": "Identify host-associated cloud identities",
      "config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "source": "identity",
        "content": "SELECT actor_user_name, src_endpoint_ip, dst_endpoint_name, auth_protocol, time FROM hb_auth_signin WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || dst_endpoint_name || ',') > 0 OR instr(',' || '{{scope_hosts}}' || ',', ',' || src_endpoint_ip || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_auth_signin",
        "description": "Identify the IAM role or user associated with the scoped hosts to look for signs of identity drift.",
        "expected_signal": "The IAM identities used by or signing into the target hosts, providing context for behavioral role analysis."
      },
      "parents": [
        {
          "id": "high-risk-vulnerable-hosts"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "enrichment",
        "label": "Identify host-associated cloud identities",
        "reads": [
          "actor_user_name",
          "src_endpoint_ip",
          "dst_endpoint_name",
          "auth_protocol",
          "time"
        ],
        "source": "hb_auth_signin",
        "target": "identity",
        "content": "SELECT actor_user_name, src_endpoint_ip, dst_endpoint_name, auth_protocol, time FROM hb_auth_signin WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || dst_endpoint_name || ',') > 0 OR instr(',' || '{{scope_hosts}}' || ',', ',' || src_endpoint_ip || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "The IAM identities used by or signing into the target hosts, providing context for behavioral role analysis.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "triage-compromise",
      "type": "analytic",
      "label": "Weigh compromise evidence and identity drift",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "identity",
          "web"
        ],
        "context": [
          "high-risk-vulnerable-hosts",
          "web-exploitation-indicators",
          "suspicious-shell-spawns",
          "encoded-script-execution",
          "host-identity-context"
        ],
        "objective": "Determine if any vulnerable host shows signs of successful exploitation. Explicitly look for 'identity role drift'\u2014comparing the actions taken by the compromised host's IAM role (found in host-identity-context) against its typical activity profile (e.g., a backup service suddenly spawning shells or a developer role accessing restricted web paths).",
        "description": "Correlate vulnerability state, HTTP traffic patterns, process execution, and script content to determine if a host identity has drifted from its profile.",
        "max_iterations": 5,
        "expected_signal": "A per-host verdict of malicious, suspicious, or benign based on overlapping evidence.",
        "success_criteria": "A detailed verdict citing specific HTTP requests and shell commands for each host, highlighting drift from the identity's known role."
      },
      "parents": [
        {
          "id": "web-exploitation-indicators",
          "kind": "merge"
        },
        {
          "id": "suspicious-shell-spawns",
          "kind": "merge"
        },
        {
          "id": "encoded-script-execution",
          "kind": "merge"
        },
        {
          "id": "host-identity-context",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-on-compromise",
      "type": "checkpoint",
      "label": "Route based on compromise verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the triage verdict is malicious for at least one host showing overlapping signals of exploitation and identity drift",
        "condition": "the triage verdict is malicious for at least one host showing overlapping signals of exploitation and identity drift",
        "blind_spot": "no-endpoint-telemetry",
        "confidence": "high",
        "description": "Isolate hosts with confirmed compromise while routing uncertain cases to manual analyst review.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "triage-compromise"
        }
      ]
    },
    {
      "id": "isolate-compromised-host",
      "type": "action",
      "label": "Isolate host and revoke sessions",
      "config": {
        "target": "endpoint",
        "description": "Sever the adversary's foothold to prevent them from using the host's identity to access cloud APIs.",
        "instructions": "Isolate the host at the network level and terminate all active user sessions associated with its identity profile.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-on-compromise",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "manual-investigation",
      "type": "task",
      "label": "Analyze forensic evidence and identity logs",
      "config": {
        "assignee": "analyst",
        "description": "Review forensic artifacts and cloud audit logs to confirm the extent of the identity's misuse.",
        "instructions": "Examine the host's activity in AWS CloudTrail to verify if it performed operations outside of its established behavioral cluster."
      },
      "parents": [
        {
          "id": "route-on-compromise",
          "branch": "default"
        },
        {
          "id": "route-on-compromise",
          "branch": "on_unavailable"
        },
        {
          "id": "isolate-compromised-host"
        }
      ]
    },
    {
      "id": "close-out-investigation",
      "type": "task",
      "label": "Close out and remediate vulnerabilities",
      "config": {
        "assignee": "analyst",
        "description": "Document findings and ensure the root cause vulnerability is patched.",
        "instructions": "Patch the vulnerable application and document the behavioral indicators observed for future tuning of the identity clustering model."
      },
      "parents": [
        {
          "id": "route-on-compromise",
          "branch": "on_refutes"
        },
        {
          "id": "manual-investigation"
        }
      ]
    }
  ]
}