{
  "hunt": {
    "meta": {
      "tlp": "clear",
      "hunt": {
        "handoff": "promote-to-detection",
        "trigger": "intel-report",
        "methodology": "model-assisted",
        "applicability": "campaign-specific",
        "justification": "Threat intelligence feeds provide the 'what', but a hunt is required to find the 'how' and 'where' the intrusion has progressed beyond a single match; a negative result over a high-vulnerability population confirms the integrity of the environment."
      },
      "name": "Threat Intelligence Lifecycle Detection",
      "type": "investigation",
      "labels": [
        "hunt",
        "attack.t1090.003",
        "attack.t1190",
        "attack.t1486",
        "attack.t1496",
        "attack.t1555",
        "attack.t1566"
      ],
      "related": [
        {
          "hunt": "scheduled-task-persistence-vulnerable-hosts",
          "reason": "This hunt focuses on the execution-to-impact lifecycle; persistence is a separate phase requiring hb_scheduled_job analysis.",
          "relation": "out-of-scope-alternative"
        }
      ],
      "targets": {
        "hunter": {
          "name": "Hunt agent",
          "agent": true
        },
        "analyst": {
          "name": "Tier-2 analyst",
          "role": "analyst"
        },
        "network": {
          "name": "Network telemetry",
          "category": "network",
          "telemetry": [
            "network"
          ]
        },
        "endpoint": {
          "name": "Endpoint telemetry (hb_ surfaces)",
          "category": "endpoint",
          "telemetry": [
            "endpoint"
          ]
        }
      },
      "analysis": "A simple rule alerts on a single hash or IP match. This hunt correlates that match with host vulnerability status, multi-hop DNS behavior, and mass file modification telemetry to validate an entire multi-stage intrusion chain, reducing noise from isolated indicators.",
      "coverage": [
        {
          "stage": "initial-access-phishing-and-exploitation",
          "steps": [
            "vulnerability-scoping",
            "dns-malicious-query"
          ],
          "status": "covered"
        },
        {
          "stage": "malware-execution-and-credential-theft",
          "steps": [
            "process-hash-query"
          ],
          "status": "covered"
        },
        {
          "stage": "command-and-control-proxy-networks",
          "steps": [
            "network-c2-query"
          ],
          "status": "covered"
        },
        {
          "stage": "impact-encryption-and-resource-hijacking",
          "steps": [
            "file-impact-baseline",
            "miner-behavior-triage"
          ],
          "status": "covered"
        }
      ],
      "scenario": {
        "stages": [
          {
            "name": "Initial Access via Phishing and Application Exploitation",
            "slug": "initial-access-phishing-and-exploitation",
            "tactic": "initial-access",
            "techniques": [
              "T1566",
              "T1190"
            ],
            "observables": [
              "malicious URLs in HTTP traffic",
              "phishing domains in DNS queries",
              "exploit attempts against vulnerable web services",
              "exposed internet-facing assets"
            ]
          },
          {
            "name": "Malware Execution and Credential Harvesting",
            "slug": "malware-execution-and-credential-theft",
            "tactic": "credential-access",
            "techniques": [
              "T1555"
            ],
            "observables": [
              "malicious file hashes on disk",
              "suspicious process execution on Linux and macOS",
              "access to browser password storage files",
              "access to keychain or secret vaults"
            ]
          },
          {
            "name": "C2 via Multi-hop Proxies",
            "slug": "command-and-control-proxy-networks",
            "tactic": "command-and-control",
            "techniques": [
              "T1090.003"
            ],
            "observables": [
              "DNS queries for .onion domains",
              "network connections to Tor exit nodes",
              "multi-hop proxy infrastructure traffic",
              "connections to known-malicious IPs"
            ]
          },
          {
            "name": "Impact via Encryption and Resource Hijacking",
            "slug": "impact-encryption-and-resource-hijacking",
            "tactic": "impact",
            "techniques": [
              "T1486",
              "T1496"
            ],
            "observables": [
              "mass file modification or encryption (ransomware)",
              "high CPU usage for cryptocurrency mining",
              "outbound connections to mining pools",
              "deployment of ransomware notes"
            ]
          }
        ],
        "summary": "This campaign lifecycle covers a variety of threat types including initial access via phishing or application exploitation, leading to credential theft, multi-hop proxy command-and-control, and final impact via ransomware or cryptomining."
      },
      "severity": "medium",
      "rationale": "Focus the hunt on servers and DMZ assets first by identifying device_uids in the scoping query. If any hits appear, broaden the search to the entire workstation fleet using the 'scope_hosts' parameter.",
      "guardrails": {
        "claims": "no_unsupported",
        "evidence": "citation_required",
        "telemetry": "untrusted",
        "missing_data": "not_benign"
      },
      "hypothesis": "An intruder has exploited a vulnerable service or leveraged phishing to gain a beachhead, followed by multi-hop proxy C2 communication and subsequent mass file modification or resource hijacking.",
      "parameters": {
        "scope_hosts": {
          "type": "list[host]",
          "default": [],
          "description": "Optional hostnames to narrow the search; leave empty for fleet-wide."
        },
        "lookback_days": {
          "type": "number",
          "default": "14",
          "description": "Days of history to examine."
        },
        "malicious_ips": {
          "from": {
            "ref": "elastic-security-labs-gti",
            "kind": "article",
            "observed": "2026-06-02"
          },
          "type": "list[ip]",
          "default": [
            "185.199.110.153",
            "104.21.233.1"
          ],
          "description": "Malicious IPs from GTI associated with C2 or proxy networks."
        },
        "malicious_hashes": {
          "from": {
            "ref": "elastic-security-labs-gti",
            "kind": "article",
            "observed": "2026-06-02"
          },
          "type": "list[hash]",
          "default": [
            "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
            "5d41402abc4b2a76b9719d911017c592"
          ],
          "description": "Malicious file hashes (SHA256) for malware detection."
        },
        "malicious_domains": {
          "from": {
            "ref": "elastic-security-labs-gti",
            "kind": "article",
            "observed": "2026-06-02"
          },
          "type": "list[domain]",
          "default": [
            "malicious.io",
            "phish-gate.com",
            "c2-server.net"
          ],
          "description": "Malicious domains from GTI for phishing or C2."
        }
      },
      "provenance": {
        "authors": [
          {
            "org": "huntbase.io",
            "name": "Huntbase hunt generation"
          }
        ],
        "generated": {
          "by": "huntbase-hunt-generation",
          "from": "https://www.elastic.co/security-labs/blog/elastic-security-google-threat-intelligence",
          "gates": [
            "dry-run",
            "lint"
          ],
          "model": "hb_google/gemini-3-flash-preview"
        }
      },
      "references": [
        {
          "url": "https://www.elastic.co/security-labs/blog/elastic-security-google-threat-intelligence",
          "name": "Elastic Security Labs \u2014 From API key to live threat detections in minutes"
        }
      ],
      "blind_spots": [
        {
          "id": "limited-endpoint-retention",
          "risk": "An intrusion with a long dwell time may have its beachhead telemetry aged out, making the hunt appear as isolated impact behavior.",
          "question": "whether the initial access occurred prior to the current lookback window",
          "requires": "endpoint telemetry retention exceeding 30 days"
        },
        {
          "id": "memory-only-malware",
          "risk": "SHA256-based hunting in GTI fails for fileless threats that never drop a binary, potentially missing the malware execution stage.",
          "stage": "malware-execution-and-credential-theft",
          "question": "whether malware is running purely in-memory without a file match",
          "requires": "hb_module_activity and on_disk=0 process monitoring"
        }
      ]
    },
    "name": "Threat Intelligence Lifecycle Detection",
    "description": "This hunt operationalizes Google Threat Intelligence (GTI) by following a phased intrusion lifecycle. It begins by identifying the vulnerable host population to scope the effort, then searches for early-stage signals including malicious DNS resolutions and binary execution matches. The second phase pivots to follow-on behaviors: connections to multi-hop proxy infrastructure, high-volume file modification activity typical of ransomware, and unauthorized resource hijacking. Two agents sequentially weigh the evidence to confirm if a beachhead has progressed to an impact-oriented intrusion."
  },
  "nodes": [
    {
      "id": "hypothesis",
      "type": "hypothesis",
      "label": "Hypothesis",
      "config": {
        "tags": [],
        "coverage": [
          {
            "stage": "initial-access-phishing-and-exploitation",
            "steps": [
              "vulnerability-scoping",
              "dns-malicious-query"
            ],
            "status": "covered"
          },
          {
            "stage": "malware-execution-and-credential-theft",
            "steps": [
              "process-hash-query"
            ],
            "status": "covered"
          },
          {
            "stage": "command-and-control-proxy-networks",
            "steps": [
              "network-c2-query"
            ],
            "status": "covered"
          },
          {
            "stage": "impact-encryption-and-resource-hijacking",
            "steps": [
              "file-impact-baseline",
              "miner-behavior-triage"
            ],
            "status": "covered"
          }
        ],
        "rationale": "An intruder has exploited a vulnerable service or leveraged phishing to gain a beachhead, followed by multi-hop proxy C2 communication and subsequent mass file modification or resource hijacking.",
        "blind_spots": [
          {
            "id": "limited-endpoint-retention",
            "risk": "An intrusion with a long dwell time may have its beachhead telemetry aged out, making the hunt appear as isolated impact behavior.",
            "question": "whether the initial access occurred prior to the current lookback window",
            "requires": "endpoint telemetry retention exceeding 30 days"
          },
          {
            "id": "memory-only-malware",
            "risk": "SHA256-based hunting in GTI fails for fileless threats that never drop a binary, potentially missing the malware execution stage.",
            "stage": "malware-execution-and-credential-theft",
            "question": "whether malware is running purely in-memory without a file match",
            "requires": "hb_module_activity and on_disk=0 process monitoring"
          }
        ],
        "scoping_notes": "Focus the hunt on servers and DMZ assets first by identifying device_uids in the scoping query. If any hits appear, broaden the search to the entire workstation fleet using the 'scope_hosts' parameter.",
        "beyond_detection": "A simple rule alerts on a single hash or IP match. This hunt correlates that match with host vulnerability status, multi-hop DNS behavior, and mass file modification telemetry to validate an entire multi-stage intrusion chain, reducing noise from isolated indicators."
      }
    },
    {
      "id": "vulnerability-scoping",
      "type": "query",
      "label": "Scope vulnerable assets",
      "config": {
        "dsl": "sqlite",
        "role": "scoping",
        "source": "endpoint",
        "content": "SELECT device_uid, cve_uid, severity_id, title FROM hb_vulnerability_finding WHERE severity_id >= 4",
        "surface": "hb_vulnerability_finding",
        "description": "Identify the initial target population by listing hosts with critical vulnerabilities (severity_id >= 4).",
        "expected_signal": "A list of vulnerable device UIDs. This defines the blast radius for exploitation-based initial access."
      },
      "parents": [
        {
          "id": "hypothesis"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "scoping",
        "label": "Scope vulnerable assets",
        "reads": [
          "cve_uid",
          "device_uid",
          "severity_id",
          "title"
        ],
        "source": "hb_vulnerability_finding",
        "target": "endpoint",
        "content": "SELECT device_uid, cve_uid, severity_id, title FROM hb_vulnerability_finding WHERE severity_id >= 4",
        "silence": "not_evidence_of_absence",
        "expected": "A list of vulnerable device UIDs. This defines the blast radius for exploitation-based initial access.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "dns-malicious-query",
      "type": "query",
      "label": "Malicious domain and proxy DNS",
      "config": {
        "dsl": "sqlite",
        "role": "triage",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_name, query_hostname, time FROM hb_dns_activity WHERE (instr(',' || '{{malicious_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 OR LOWER(query_hostname) LIKE '%.onion%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_dns_activity",
        "description": "Find resolutions for GTI-flagged domains or multi-hop proxy (.onion) addresses.",
        "expected_signal": "A hit indicates a host resolving infrastructure associated with phishing, C2, or multi-hop anonymity networks."
      },
      "parents": [
        {
          "id": "vulnerability-scoping"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "triage",
        "label": "Malicious domain and proxy DNS",
        "reads": [
          "device_hostname",
          "process_name",
          "query_hostname",
          "time"
        ],
        "source": "hb_dns_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_name, query_hostname, time FROM hb_dns_activity WHERE (instr(',' || '{{malicious_domains}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 OR LOWER(query_hostname) LIKE '%.onion%') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "A hit indicates a host resolving infrastructure associated with phishing, C2, or multi-hop anonymity networks.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "process-hash-query",
      "type": "query",
      "label": "Match process hashes to GTI malware",
      "config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_name, process_path, process_hash_sha256, time FROM hb_process_activity WHERE instr(',' || '{{malicious_hashes}}' || ',', ',' || LOWER(process_hash_sha256) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_process_activity",
        "description": "Identify active execution of binaries known to be malicious via GTI SHA256 matches.",
        "expected_signal": "Confirmed execution of malicious code. This is a high-confidence signal of a successful landing."
      },
      "parents": [
        {
          "id": "vulnerability-scoping"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "detection-candidate",
        "label": "Match process hashes to GTI malware",
        "reads": [
          "device_hostname",
          "process_hash_sha256",
          "process_name",
          "process_path",
          "time"
        ],
        "source": "hb_process_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_name, process_path, process_hash_sha256, time FROM hb_process_activity WHERE instr(',' || '{{malicious_hashes}}' || ',', ',' || LOWER(process_hash_sha256) || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Confirmed execution of malicious code. This is a high-confidence signal of a successful landing.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "agent-early-read",
      "type": "analytic",
      "label": "Analyze initial breach evidence",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "network"
        ],
        "context": [
          "vulnerability-scoping",
          "dns-malicious-query",
          "process-hash-query"
        ],
        "objective": "Confirm if vulnerable hosts show early-stage breach indicators (DNS/Process) and cite the findings.",
        "description": "Evaluate if the vulnerable hosts found in scoping are also showing active breach signals from DNS or process telemetry.",
        "max_iterations": 4,
        "expected_signal": "A list of hosts with confirmed or highly suspected beachheads.",
        "success_criteria": "Host-specific verdicts citing DNS queries or malicious hash executions."
      },
      "parents": [
        {
          "id": "dns-malicious-query",
          "kind": "merge"
        },
        {
          "id": "process-hash-query",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "network-c2-query",
      "type": "query",
      "label": "C2 network connections",
      "config": {
        "dsl": "sqlite",
        "role": "triage",
        "source": "network",
        "content": "SELECT device_hostname, process_path, dst_endpoint_ip, dst_endpoint_port, time FROM hb_network_connection WHERE instr(',' || '{{malicious_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "surface": "hb_network_connection",
        "description": "Identify established connections to known-malicious GTI IPs associated with C2 infrastructure.",
        "expected_signal": "Row results confirm active network communication between a host and blacklisted C2 infrastructure."
      },
      "parents": [
        {
          "id": "agent-early-read"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "triage",
        "label": "C2 network connections",
        "reads": [
          "device_hostname",
          "dst_endpoint_ip",
          "dst_endpoint_port",
          "process_path",
          "time"
        ],
        "source": "hb_network_connection",
        "target": "network",
        "content": "SELECT device_hostname, process_path, dst_endpoint_ip, dst_endpoint_port, time FROM hb_network_connection WHERE instr(',' || '{{malicious_ips}}' || ',', ',' || dst_endpoint_ip || ',') > 0 AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')",
        "silence": "not_evidence_of_absence",
        "expected": "Row results confirm active network communication between a host and blacklisted C2 infrastructure.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "file-impact-baseline",
      "type": "query",
      "label": "Mass file modification baseline",
      "config": {
        "dsl": "sqlite",
        "role": "baseline",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_name, COUNT(*) AS event_count, MIN(time) AS first_seen FROM hb_file_activity WHERE activity_id IN (1, 3, 4, 5) AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) GROUP BY device_hostname, process_name HAVING event_count > 100",
        "surface": "hb_file_activity",
        "description": "Identify processes performing high volumes of file modifications or deletions, which is characteristic of ransomware encryption.",
        "expected_signal": "A high event count from a process on a single host may indicate ransomware; compare against fleet prevalence to identify anomalies."
      },
      "parents": [
        {
          "id": "agent-early-read"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "baseline",
        "label": "Mass file modification baseline",
        "reads": [
          "activity_id",
          "device_hostname",
          "process_name",
          "time"
        ],
        "source": "hb_file_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_name, COUNT(*) AS event_count, MIN(time) AS first_seen FROM hb_file_activity WHERE activity_id IN (1, 3, 4, 5) AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) GROUP BY device_hostname, process_name HAVING event_count > 100",
        "silence": "not_evidence_of_absence",
        "baseline": {
          "window": "{{lookback_days}}d",
          "compare": "first_seen"
        },
        "expected": "A high event count from a process on a single host may indicate ransomware; compare against fleet prevalence to identify anomalies.",
        "verified": "dry-run",
        "prevalence": {
          "by": "device_hostname",
          "key": [
            "process_name"
          ],
          "rare_below": 3
        },
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "miner-behavior-triage",
      "type": "query",
      "label": "Cryptomining behavior detection",
      "config": {
        "dsl": "sqlite",
        "role": "triage",
        "source": "endpoint",
        "content": "SELECT device_hostname, process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%miner%' OR LOWER(process_cmd_line) LIKE '%xmrig%' OR LOWER(process_cmd_line) LIKE '%stratum%') AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)",
        "surface": "hb_process_activity",
        "description": "Search for process and command-line indicators associated with resource hijacking and cryptocurrency miners.",
        "expected_signal": "Matches indicate resource hijacking for profit, often a secondary stage of a cloud or server breach."
      },
      "parents": [
        {
          "id": "agent-early-read"
        }
      ],
      "primitive_config": {
        "dsl": "sqlite",
        "role": "triage",
        "label": "Cryptomining behavior detection",
        "reads": [
          "device_hostname",
          "process_cmd_line",
          "process_name",
          "time",
          "user_name"
        ],
        "source": "hb_process_activity",
        "target": "endpoint",
        "content": "SELECT device_hostname, process_name, process_cmd_line, user_name, time FROM hb_process_activity WHERE (LOWER(process_name) LIKE '%miner%' OR LOWER(process_cmd_line) LIKE '%xmrig%' OR LOWER(process_cmd_line) LIKE '%stratum%') AND time >= datetime('now', '-{{lookback_days}} days') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0)",
        "silence": "not_evidence_of_absence",
        "expected": "Matches indicate resource hijacking for profit, often a secondary stage of a cloud or server breach.",
        "verified": "dry-run",
        "verified_at": "2026-09-20"
      }
    },
    {
      "id": "agent-follow-on-read",
      "type": "analytic",
      "label": "Analyze intrusion progression",
      "config": {
        "cite": "required",
        "tools": [
          "endpoint",
          "network"
        ],
        "context": [
          "agent-early-read",
          "network-c2-query",
          "file-impact-baseline",
          "miner-behavior-triage"
        ],
        "objective": "Synthesize the entire lifecycle: does the early breach align with the observed C2, file impact, or mining behavior on the same hosts?",
        "description": "Correlate early beachhead evidence with late-stage C2 and impact indicators to determine the severity and status of the threat.",
        "max_iterations": 4,
        "expected_signal": "A complete intrusion timeline per host with a severity verdict.",
        "success_criteria": "A final verdict of malicious | suspicious | benign per host, citing the progression from access to impact."
      },
      "parents": [
        {
          "id": "network-c2-query",
          "kind": "merge"
        },
        {
          "id": "file-impact-baseline",
          "kind": "merge"
        },
        {
          "id": "miner-behavior-triage",
          "kind": "merge"
        }
      ]
    },
    {
      "id": "route-on-verdict",
      "type": "checkpoint",
      "label": "Route on final verdict",
      "config": {
        "fuzzy": true,
        "judge": "hunter",
        "question": "the agent-follow-on-read verdict is malicious for at least one host based on the intrusion chain",
        "condition": "the agent-follow-on-read verdict is malicious for at least one host based on the intrusion chain",
        "blind_spot": "limited-endpoint-retention",
        "confidence": "high",
        "description": "Initiate immediate response for confirmed threats or route to manual analyst review.",
        "checkpoint_type": "mandatory"
      },
      "parents": [
        {
          "id": "agent-follow-on-read"
        }
      ]
    },
    {
      "id": "contain-host",
      "type": "action",
      "label": "Isolate compromised host",
      "config": {
        "target": "endpoint",
        "description": "Stop C2 communication and prevent further file encryption by isolating the affected host.",
        "instructions": "Isolate the host from the network. Revoke any active sessions for the user accounts identified in the queries.",
        "action_approval": "required"
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_supports"
        }
      ]
    },
    {
      "id": "analyst-validation",
      "type": "task",
      "label": "Analyst incident validation",
      "config": {
        "assignee": "analyst",
        "description": "Perform manual review of the evidence chain and confirm the GTI indicator status.",
        "instructions": "Review the rows cited by both agent steps. Verify the reputation of the domains and hashes using an external GTI or VirusTotal search. Finalize the triage verdict."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "default"
        },
        {
          "id": "route-on-verdict",
          "branch": "on_unavailable"
        },
        {
          "id": "contain-host"
        }
      ]
    },
    {
      "id": "documentation-and-tuning",
      "type": "task",
      "label": "Documentation and tuning",
      "config": {
        "assignee": "analyst",
        "description": "Record hunt findings and tune indicators to reduce noise in future runs.",
        "instructions": "Record the hunt outcome. If malicious activity was found, update the 'malicious_hashes' and 'malicious_ips' parameters. If benign, document common updaters or backup processes to be excluded."
      },
      "parents": [
        {
          "id": "route-on-verdict",
          "branch": "on_refutes"
        },
        {
          "id": "analyst-validation"
        }
      ]
    }
  ]
}