[
 {
  "id": "C01",
  "http_status": 200,
  "recorded_at": "2026-11-03T23:37:27+00:00",
  "ms": 0,
  "reply": {
   "slug": "talosguard-intel",
   "title": "Hunt threat indicators in an incident write-up",
   "status": "ok",
   "input": "Beacon to 185.220.101.4 and evil-cdn.example; dropper hash 44d88612fea8a8f36de82e1278abb02f; phishing from billing@acme-invoices.example",
   "total_ms": 25,
   "steps": [
    {
     "call": "POST /hunt-artifacts",
     "request": {
      "text": "Beacon to 185.220.101.4 and evil-cdn.example; dropper hash 44d88612fea8a8f36de82e1278abb02f; phishing from billing@acme-invoices.example"
     },
     "status": 200,
     "ms": 10,
     "reply": {
      "artifacts": [
       {
        "indicator": "185.220.101.4",
        "type": "ip",
        "risk_score": 90,
        "risk_tier": "CRITICAL",
        "enrichment_data": {
         "ip_class": "public",
         "tor": true,
         "region": "Europe",
         "subnet_24": "185.220.101.0/24"
        },
        "tags": [
         "tor_exit_node",
         "anonymization"
        ]
       },
       {
        "indicator": "44d88612fea8a8f36de82e1278abb02f",
        "type": "hash_md5",
        "risk_score": 30,
        "risk_tier": "MEDIUM",
        "enrichment_data": {
         "hash_type": "hash_md5",
         "length": 32
        },
        "tags": [
         "file_hash"
        ]
       }
      ],
      "total_found": 2,
      "cves": [],
      "summary": {
       "ips": 1,
       "domains": 0,
       "urls": 0,
       "hashes": 1,
       "cves": 0
      },
      "high_risk_artifacts": [
       {
        "indicator": "185.220.101.4",
        "type": "ip",
        "risk_score": 90,
        "risk_tier": "CRITICAL",
        "enrichment_data": {
         "ip_class": "public",
         "tor": true,
         "region": "Europe",
         "subnet_24": "185.220.101.0/24"
        },
        "tags": [
         "tor_exit_node",
         "anonymization"
        ]
       }
      ]
     }
    }
   ],
   "note": "Real calls to the running service with the public demo identity; replies are unedited."
  }
 },
 {
  "id": "C02",
  "http_status": 200,
  "recorded_at": "2026-11-03T23:37:27+00:00",
  "ms": 0,
  "reply": {
   "slug": "talosguard-intel",
   "title": "Hunt threat indicators in an incident write-up",
   "status": "ok",
   "input": "Beacon to 185.220.101.4 and evil-cdn.example; dropper hash 44d88612fea8a8f36de82e1278abb02f; phishing from billing@acme-invoices.example",
   "total_ms": 25,
   "steps": [
    {
     "call": "POST /hunt-artifacts",
     "request": {
      "text": "Beacon to 185.220.101.4 and evil-cdn.example; dropper hash 44d88612fea8a8f36de82e1278abb02f; phishing from billing@acme-invoices.example"
     },
     "status": 200,
     "ms": 10,
     "reply": {
      "artifacts": [
       {
        "indicator": "185.220.101.4",
        "type": "ip",
        "risk_score": 90,
        "risk_tier": "CRITICAL",
        "enrichment_data": {
         "ip_class": "public",
         "tor": true,
         "region": "Europe",
         "subnet_24": "185.220.101.0/24"
        },
        "tags": [
         "tor_exit_node",
         "anonymization"
        ]
       },
       {
        "indicator": "44d88612fea8a8f36de82e1278abb02f",
        "type": "hash_md5",
        "risk_score": 30,
        "risk_tier": "MEDIUM",
        "enrichment_data": {
         "hash_type": "hash_md5",
         "length": 32
        },
        "tags": [
         "file_hash"
        ]
       }
      ],
      "total_found": 2,
      "cves": [],
      "summary": {
       "ips": 1,
       "domains": 0,
       "urls": 0,
       "hashes": 1,
       "cves": 0
      },
      "high_risk_artifacts": [
       {
        "indicator": "185.220.101.4",
        "type": "ip",
        "risk_score": 90,
        "risk_tier": "CRITICAL",
        "enrichment_data": {
         "ip_class": "public",
         "tor": true,
         "region": "Europe",
         "subnet_24": "185.220.101.0/24"
        },
        "tags": [
         "tor_exit_node",
         "anonymization"
        ]
       }
      ]
     }
    }
   ],
   "note": "Real calls to the running service with the public demo identity; replies are unedited."
  }
 }
]