[
 {
  "id": "C01",
  "http_status": 200,
  "recorded_at": "2026-11-04T00:17:14+00:00",
  "ms": 0,
  "reply": {
   "slug": "talosguard-siem",
   "title": "Add a brute-force rule, ingest login events, correlate",
   "status": "ok",
   "input": null,
   "total_ms": 11304,
   "steps": [
    {
     "call": "POST /guard/siem/rules",
     "request": {
      "rule": {
       "id": "demo-ssh-bruteforce",
       "type": "threshold",
       "name": "ssh brute force",
       "severity": "HIGH",
       "config": {
        "field": "ip",
        "operator": "eq",
        "value": "185.220.101.4",
        "min_count": 4,
        "window_seconds": 300
       }
      }
     },
     "status": 200,
     "ms": 11086,
     "reply": {
      "rule_id": "demo-ssh-bruteforce",
      "status": "added",
      "total_rules": 6
     }
    },
    {
     "call": "POST /guard/siem/ingest",
     "request": {
      "events": [
       {
        "source": "bastion-1",
        "severity": "WARN",
        "message": "sshd: Failed password for user root from 185.220.101.4 port 51120"
       },
       {
        "source": "bastion-1",
        "severity": "WARN",
        "message": "sshd: Failed password for user root from 185.220.101.4 port 51121"
       },
       {
        "source": "bastion-1",
        "severity": "WARN",
        "message": "sshd: Failed password for user root from 185.220.101.4 port 51122"
       },
       {
        "source": "bastion-1",
        "severity": "WARN",
        "message": "sshd: Failed password for user root from 185.220.101.4 port 51123"
       },
       {
        "source": "bastion-1",
        "severity": "INFO",
        "message": "sshd: Accepted password for user admin from 185.220.101.4 port 51188"
       }
      ]
     },
     "status": 200,
     "ms": 187,
     "reply": {
      "ingested": 5,
      "alerts_fired": 1,
      "parse_errors": 0,
      "total_events": 10
     }
    },
    {
     "call": "POST /guard/siem/correlate",
     "request": {
      "window_seconds": 300
     },
     "status": 200,
     "ms": 18,
     "reply": {
      "alerts": [
       {
        "rule_id": "demo-ssh-bruteforce",
        "rule_name": "ssh brute force",
        "events_matched": 5,
        "severity": "HIGH",
        "timestamp": 1793751434.273819,
        "detail": "ip=185.220.101.4 hit 5 times"
       }
      ],
      "rules_evaluated": 6,
      "events_in_window": 5
     }
    }
   ],
   "note": "Real calls to the running service with the public demo identity; replies are unedited."
  }
 },
 {
  "id": "C02",
  "http_status": 200,
  "recorded_at": "2026-11-04T00:17:14+00:00",
  "ms": 0,
  "reply": {
   "slug": "talosguard-siem",
   "title": "Add a brute-force rule, ingest login events, correlate",
   "status": "ok",
   "input": null,
   "total_ms": 11304,
   "steps": [
    {
     "call": "POST /guard/siem/rules",
     "request": {
      "rule": {
       "id": "demo-ssh-bruteforce",
       "type": "threshold",
       "name": "ssh brute force",
       "severity": "HIGH",
       "config": {
        "field": "ip",
        "operator": "eq",
        "value": "185.220.101.4",
        "min_count": 4,
        "window_seconds": 300
       }
      }
     },
     "status": 200,
     "ms": 11086,
     "reply": {
      "rule_id": "demo-ssh-bruteforce",
      "status": "added",
      "total_rules": 6
     }
    },
    {
     "call": "POST /guard/siem/ingest",
     "request": {
      "events": [
       {
        "source": "bastion-1",
        "severity": "WARN",
        "message": "sshd: Failed password for user root from 185.220.101.4 port 51120"
       },
       {
        "source": "bastion-1",
        "severity": "WARN",
        "message": "sshd: Failed password for user root from 185.220.101.4 port 51121"
       },
       {
        "source": "bastion-1",
        "severity": "WARN",
        "message": "sshd: Failed password for user root from 185.220.101.4 port 51122"
       },
       {
        "source": "bastion-1",
        "severity": "WARN",
        "message": "sshd: Failed password for user root from 185.220.101.4 port 51123"
       },
       {
        "source": "bastion-1",
        "severity": "INFO",
        "message": "sshd: Accepted password for user admin from 185.220.101.4 port 51188"
       }
      ]
     },
     "status": 200,
     "ms": 187,
     "reply": {
      "ingested": 5,
      "alerts_fired": 1,
      "parse_errors": 0,
      "total_events": 10
     }
    },
    {
     "call": "POST /guard/siem/correlate",
     "request": {
      "window_seconds": 300
     },
     "status": 200,
     "ms": 18,
     "reply": {
      "alerts": [
       {
        "rule_id": "demo-ssh-bruteforce",
        "rule_name": "ssh brute force",
        "events_matched": 5,
        "severity": "HIGH",
        "timestamp": 1793751434.273819,
        "detail": "ip=185.220.101.4 hit 5 times"
       }
      ],
      "rules_evaluated": 6,
      "events_in_window": 5
     }
    }
   ],
   "note": "Real calls to the running service with the public demo identity; replies are unedited."
  }
 },
 {
  "id": "C03",
  "http_status": 200,
  "recorded_at": "2026-11-04T00:17:15+00:00",
  "ms": 0,
  "reply": {
   "slug": "talosguard-siem",
   "title": "Add a brute-force rule, ingest login events, correlate",
   "status": "ok",
   "input": null,
   "total_ms": 11304,
   "steps": [
    {
     "call": "POST /guard/siem/rules",
     "request": {
      "rule": {
       "id": "demo-ssh-bruteforce",
       "type": "threshold",
       "name": "ssh brute force",
       "severity": "HIGH",
       "config": {
        "field": "ip",
        "operator": "eq",
        "value": "185.220.101.4",
        "min_count": 4,
        "window_seconds": 300
       }
      }
     },
     "status": 200,
     "ms": 11086,
     "reply": {
      "rule_id": "demo-ssh-bruteforce",
      "status": "added",
      "total_rules": 6
     }
    },
    {
     "call": "POST /guard/siem/ingest",
     "request": {
      "events": [
       {
        "source": "bastion-1",
        "severity": "WARN",
        "message": "sshd: Failed password for user root from 185.220.101.4 port 51120"
       },
       {
        "source": "bastion-1",
        "severity": "WARN",
        "message": "sshd: Failed password for user root from 185.220.101.4 port 51121"
       },
       {
        "source": "bastion-1",
        "severity": "WARN",
        "message": "sshd: Failed password for user root from 185.220.101.4 port 51122"
       },
       {
        "source": "bastion-1",
        "severity": "WARN",
        "message": "sshd: Failed password for user root from 185.220.101.4 port 51123"
       },
       {
        "source": "bastion-1",
        "severity": "INFO",
        "message": "sshd: Accepted password for user admin from 185.220.101.4 port 51188"
       }
      ]
     },
     "status": 200,
     "ms": 187,
     "reply": {
      "ingested": 5,
      "alerts_fired": 1,
      "parse_errors": 0,
      "total_events": 10
     }
    },
    {
     "call": "POST /guard/siem/correlate",
     "request": {
      "window_seconds": 300
     },
     "status": 200,
     "ms": 18,
     "reply": {
      "alerts": [
       {
        "rule_id": "demo-ssh-bruteforce",
        "rule_name": "ssh brute force",
        "events_matched": 5,
        "severity": "HIGH",
        "timestamp": 1793751434.273819,
        "detail": "ip=185.220.101.4 hit 5 times"
       }
      ],
      "rules_evaluated": 6,
      "events_in_window": 5
     }
    }
   ],
   "note": "Real calls to the running service with the public demo identity; replies are unedited."
  }
 },
 {
  "id": "C04",
  "http_status": 200,
  "recorded_at": "2026-11-04T00:17:15+00:00",
  "ms": 0,
  "reply": {
   "slug": "talosguard-siem",
   "title": "Add a brute-force rule, ingest login events, correlate",
   "status": "ok",
   "input": null,
   "total_ms": 11304,
   "steps": [
    {
     "call": "POST /guard/siem/rules",
     "request": {
      "rule": {
       "id": "demo-ssh-bruteforce",
       "type": "threshold",
       "name": "ssh brute force",
       "severity": "HIGH",
       "config": {
        "field": "ip",
        "operator": "eq",
        "value": "185.220.101.4",
        "min_count": 4,
        "window_seconds": 300
       }
      }
     },
     "status": 200,
     "ms": 11086,
     "reply": {
      "rule_id": "demo-ssh-bruteforce",
      "status": "added",
      "total_rules": 6
     }
    },
    {
     "call": "POST /guard/siem/ingest",
     "request": {
      "events": [
       {
        "source": "bastion-1",
        "severity": "WARN",
        "message": "sshd: Failed password for user root from 185.220.101.4 port 51120"
       },
       {
        "source": "bastion-1",
        "severity": "WARN",
        "message": "sshd: Failed password for user root from 185.220.101.4 port 51121"
       },
       {
        "source": "bastion-1",
        "severity": "WARN",
        "message": "sshd: Failed password for user root from 185.220.101.4 port 51122"
       },
       {
        "source": "bastion-1",
        "severity": "WARN",
        "message": "sshd: Failed password for user root from 185.220.101.4 port 51123"
       },
       {
        "source": "bastion-1",
        "severity": "INFO",
        "message": "sshd: Accepted password for user admin from 185.220.101.4 port 51188"
       }
      ]
     },
     "status": 200,
     "ms": 187,
     "reply": {
      "ingested": 5,
      "alerts_fired": 1,
      "parse_errors": 0,
      "total_events": 10
     }
    },
    {
     "call": "POST /guard/siem/correlate",
     "request": {
      "window_seconds": 300
     },
     "status": 200,
     "ms": 18,
     "reply": {
      "alerts": [
       {
        "rule_id": "demo-ssh-bruteforce",
        "rule_name": "ssh brute force",
        "events_matched": 5,
        "severity": "HIGH",
        "timestamp": 1793751434.273819,
        "detail": "ip=185.220.101.4 hit 5 times"
       }
      ],
      "rules_evaluated": 6,
      "events_in_window": 5
     }
    }
   ],
   "note": "Real calls to the running service with the public demo identity; replies are unedited."
  }
 }
]