{
  "name": "Ransomware Activity Detected on WORKSTATION-042",
  "incident_id": "5001",
  "creation_time": 1705312200000,
  "modification_time": 1705315800000,
  "status": "new",
  "severity": "high",
  "alert_count": 3,
  "assigned_user_mail": "analyst@example.com",
  "description": "Multiple alerts indicating ransomware behavior on endpoint",
  "alert_sources": [
    "XDR Agent",
    "XDR Analytics BIOC"
  ]
}