{
  "verified": true,
  "mode": "native-memory",
  "incidents": [
    {
      "tenant": "acme",
      "label": "Acme Security",
      "identity": "employee-438",
      "report": {
        "findings": [
          {
            "references": [
              "EVT-acme-001",
              "EVT-acme-002",
              "EVT-acme-003",
              "EVT-acme-004",
              "EVT-acme-005",
              "EVT-acme-006",
              "EVT-acme-007",
              "indicator-7",
              "SEC-IR-01"
            ],
            "severity": "high",
            "summary": "Observed 6 failed logins followed by authentication activity; correlated with threat intelligence."
          }
        ],
        "recommend_disable": true,
        "summary": "Corroborated credential abuse requires analyst review.",
        "timeline": [
          "2026-10-01T09:01:00Z \u00b7 failed_login [EVT-acme-001]",
          "2026-10-01T09:02:00Z \u00b7 failed_login [EVT-acme-002]",
          "2026-10-01T09:03:00Z \u00b7 failed_login [EVT-acme-003]",
          "2026-10-01T09:04:00Z \u00b7 failed_login [EVT-acme-004]",
          "2026-10-01T09:05:00Z \u00b7 failed_login [EVT-acme-005]",
          "2026-10-01T09:06:00Z \u00b7 failed_login [EVT-acme-006]",
          "2026-10-01T09:08:00Z \u00b7 successful_login [EVT-acme-007]"
        ]
      },
      "evidence": [
        {
          "id": "EVT-acme-001",
          "detail": "Synthetic failed login at 2026-10-01 09:01 UTC from TEST-NET-3. Indicator: indicator-7."
        },
        {
          "id": "EVT-acme-002",
          "detail": "Synthetic failed login at 2026-10-01 09:02 UTC from TEST-NET-3. Indicator: indicator-7."
        },
        {
          "id": "EVT-acme-003",
          "detail": "Synthetic failed login at 2026-10-01 09:03 UTC from TEST-NET-3. Indicator: indicator-7."
        },
        {
          "id": "EVT-acme-004",
          "detail": "Synthetic failed login at 2026-10-01 09:04 UTC from TEST-NET-3. Indicator: indicator-7."
        },
        {
          "id": "EVT-acme-005",
          "detail": "Synthetic failed login at 2026-10-01 09:05 UTC from TEST-NET-3. Indicator: indicator-7."
        },
        {
          "id": "EVT-acme-006",
          "detail": "Synthetic failed login at 2026-10-01 09:06 UTC from TEST-NET-3. Indicator: indicator-7."
        },
        {
          "id": "EVT-acme-007",
          "detail": "Synthetic successful login at 2026-10-01 09:08 UTC from TEST-NET-3. Indicator: indicator-7."
        },
        {
          "id": "indicator-7",
          "detail": "Synthetic high-risk indicator associated with credential abuse. Source reference: TI-007."
        },
        {
          "id": "SEC-IR-01",
          "detail": "Section 4.3: investigate six failed logins followed by a success. Containment requires independent human approval."
        },
        {
          "id": "asset-17",
          "detail": "Engineering workstation \u00b7 internal classification \u00b7 owner: engineering."
        },
        {
          "id": "employee-438",
          "detail": "Synthetic Employee 438 \u00b7 workstation asset-17."
        }
      ],
      "verifiedDecision": "approve",
      "disabledAfterDecision": true,
      "toolCalls": 6
    },
    {
      "tenant": "orbit",
      "label": "Orbit Security",
      "identity": "employee-438",
      "report": {
        "findings": [
          {
            "references": [
              "EVT-orbit-001",
              "EVT-orbit-002",
              "EVT-orbit-003",
              "EVT-orbit-004",
              "EVT-orbit-005",
              "EVT-orbit-006",
              "EVT-orbit-007",
              "indicator-7",
              "SEC-IR-01"
            ],
            "severity": "high",
            "summary": "Observed 6 failed logins followed by authentication activity; correlated with threat intelligence."
          }
        ],
        "recommend_disable": true,
        "summary": "Corroborated credential abuse requires analyst review.",
        "timeline": [
          "2026-10-01T09:01:00Z \u00b7 failed_login [EVT-orbit-001]",
          "2026-10-01T09:02:00Z \u00b7 failed_login [EVT-orbit-002]",
          "2026-10-01T09:03:00Z \u00b7 failed_login [EVT-orbit-003]",
          "2026-10-01T09:04:00Z \u00b7 failed_login [EVT-orbit-004]",
          "2026-10-01T09:05:00Z \u00b7 failed_login [EVT-orbit-005]",
          "2026-10-01T09:06:00Z \u00b7 failed_login [EVT-orbit-006]",
          "2026-10-01T09:08:00Z \u00b7 successful_login [EVT-orbit-007]"
        ]
      },
      "evidence": [
        {
          "id": "EVT-orbit-001",
          "detail": "Synthetic failed login at 2026-10-01 09:01 UTC from TEST-NET-3. Indicator: indicator-7."
        },
        {
          "id": "EVT-orbit-002",
          "detail": "Synthetic failed login at 2026-10-01 09:02 UTC from TEST-NET-3. Indicator: indicator-7."
        },
        {
          "id": "EVT-orbit-003",
          "detail": "Synthetic failed login at 2026-10-01 09:03 UTC from TEST-NET-3. Indicator: indicator-7."
        },
        {
          "id": "EVT-orbit-004",
          "detail": "Synthetic failed login at 2026-10-01 09:04 UTC from TEST-NET-3. Indicator: indicator-7."
        },
        {
          "id": "EVT-orbit-005",
          "detail": "Synthetic failed login at 2026-10-01 09:05 UTC from TEST-NET-3. Indicator: indicator-7."
        },
        {
          "id": "EVT-orbit-006",
          "detail": "Synthetic failed login at 2026-10-01 09:06 UTC from TEST-NET-3. Indicator: indicator-7."
        },
        {
          "id": "EVT-orbit-007",
          "detail": "Synthetic successful login at 2026-10-01 09:08 UTC from TEST-NET-3. Indicator: indicator-7."
        },
        {
          "id": "indicator-7",
          "detail": "Synthetic high-risk indicator associated with credential abuse. Source reference: TI-007."
        },
        {
          "id": "SEC-IR-01",
          "detail": "Section 4.3: investigate six failed logins followed by a success. Containment requires independent human approval."
        },
        {
          "id": "asset-17",
          "detail": "Engineering workstation \u00b7 internal classification \u00b7 owner: engineering."
        },
        {
          "id": "employee-438",
          "detail": "Synthetic Employee 438 \u00b7 workstation asset-17."
        }
      ],
      "verifiedDecision": "reject",
      "disabledAfterDecision": false,
      "toolCalls": 6
    }
  ],
  "checks": [
    "Cited findings",
    "Independent approval",
    "Approved simulated containment",
    "Rejected containment leaves identity enabled",
    "Idempotent decisions",
    "Denial audit"
  ]
}