[
  {
    "alert_id": "ALERT-2001",
    "incident_id": "INC-1001",
    "title": "Suspicious outbound C2 traffic from container",
    "severity": "high",
    "status": "open",
    "source": "SIEM",
    "detected_at": "2026-06-18T02:14:00Z",
    "asset_id": "ASSET-001",
    "user_id": "USR-301",
    "container_id": "c0ffee1234ab",
    "related_cve": "CVE-2024-3094",
    "description": "Beaconing to a known-bad host observed from the suspicious-nginx container on web-prod-01."
  },
  {
    "alert_id": "ALERT-2002",
    "incident_id": "INC-1002",
    "title": "Repeated failed logins (possible brute force)",
    "severity": "medium",
    "status": "open",
    "source": "SIEM",
    "detected_at": "2026-06-18T05:41:00Z",
    "asset_id": "ASSET-003",
    "user_id": "USR-302",
    "container_id": null,
    "related_cve": null,
    "description": "120 failed authentications for USR-302 within five minutes from a single source IP."
  },
  {
    "alert_id": "ALERT-2003",
    "incident_id": "INC-1003",
    "title": "Vulnerable package detected on production database host",
    "severity": "high",
    "status": "open",
    "source": "vuln_scanner",
    "detected_at": "2026-06-17T22:03:00Z",
    "asset_id": "ASSET-002",
    "user_id": null,
    "container_id": null,
    "related_cve": "CVE-2021-44228",
    "description": "Log4j 2.x detected on db-prod-01; exposure to CVE-2021-44228 (Log4Shell)."
  }
]