[
  {
    "id": "contained",
    "name": "A malicious login is contained automatically",
    "inputs": {
      "alertId": "A-1",
      "hostId": "wks-17"
    },
    "mocks": {
      "threat-intel-enrich": {
        "outputs": {
          "reputation": 9,
          "criticality": 4
        }
      },
      "edr-host-isolate": {
        "outputs": {
          "isolated": true
        }
      },
      "iam-credentials-reset": {},
      "case-create": {
        "outputs": {
          "caseId": "CASE-5"
        }
      }
    },
    "expect": {
      "path": [
        "score-alert",
        "isolate-host",
        "reset-credentials",
        "open-case",
        "case-opened"
      ],
      "variables": {
        "riskScore": 36,
        "caseId": "CASE-5"
      }
    }
  },
  {
    "id": "false-positive",
    "name": "A low-scoring alert is closed",
    "inputs": {
      "alertId": "A-2",
      "hostId": "wks-3"
    },
    "mocks": {
      "threat-intel-enrich": {
        "outputs": {
          "reputation": 2,
          "criticality": 3
        }
      },
      "siem-alert-close": {}
    },
    "expect": {
      "path": [
        "score-alert",
        "close-alert",
        "alert-closed"
      ],
      "variables": {
        "riskScore": 6
      }
    }
  },
  {
    "id": "isolation-failed",
    "name": "Isolation fails and an analyst contains the host by hand",
    "inputs": {
      "alertId": "A-3",
      "hostId": "srv-db-1"
    },
    "mocks": {
      "threat-intel-enrich": {
        "outputs": {
          "reputation": 8,
          "criticality": 5
        }
      },
      "edr-host-isolate": {
        "outputs": {
          "isolated": false
        }
      },
      "userTask": {},
      "case-create": {
        "outputs": {
          "caseId": "CASE-6"
        }
      }
    },
    "expect": {
      "path": [
        "isolate-host",
        "containment-failed",
        "on-containment-failed",
        "manual-containment",
        "open-case"
      ]
    }
  }
]