{"_time":"2026-08-25T14:02:10Z","sourcetype":"lab:endpoint","user":"ada.lovelace","host":"wkstn-104","process_name":"powershell.exe","command_line":"powershell.exe -NoProfile -EncodedCommand SYNTHETIC_VALUE","action":"process_start"}
{"_time":"2026-08-25T14:05:41Z","sourcetype":"lab:identity","user":"ada.lovelace","host":"wkstn-104","action":"failure","reason":"mfa_denied","source_ip":"198.51.100.24"}
{"_time":"2026-08-25T14:08:09Z","sourcetype":"lab:network","user":"ada.lovelace","host":"wkstn-104","direction":"outbound","dest_ip":"203.0.113.42","dest_port":8443,"bytes_out":725000,"action":"allowed"}
{"_time":"2026-08-25T15:01:04Z","sourcetype":"lab:endpoint","user":"grace.hopper","host":"wkstn-210","process_name":"powershell.exe","command_line":"powershell.exe Get-Process","action":"process_start"}
{"_time":"2026-08-25T15:03:20Z","sourcetype":"lab:network","user":"grace.hopper","host":"wkstn-210","direction":"outbound","dest_ip":"192.0.2.15","dest_port":443,"bytes_out":22000,"action":"allowed"}