{"timestamp":"2026-06-18T13:58:02Z","host":"HR-LT-044","user":"morgan.lee","event_type":"file_create","process":"OUTLOOK.EXE","path":"C:\\Users\\morgan.lee\\Downloads\\benefits-review.docm","sha256":"8b7b66122f74d0cf886e3bd642f6dd66155d50d0463821d6cf8b3c59f6d1f411","correlation_id":"E-2001"}
{"timestamp":"2026-06-18T13:59:28Z","host":"HR-LT-044","user":"morgan.lee","event_type":"process_start","process":"WINWORD.EXE","parent":"OUTLOOK.EXE","command_line":"WINWORD.EXE benefits-review.docm","sha256":"known-office-binary","correlation_id":"E-2002"}
{"timestamp":"2026-06-18T14:00:16Z","host":"HR-LT-044","user":"morgan.lee","event_type":"process_start","process":"powershell.exe","parent":"WINWORD.EXE","command_line":"powershell.exe -NoProfile -EncodedCommand SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkA","sha256":"known-windows-binary","correlation_id":"E-2003"}
{"timestamp":"2026-06-18T14:00:31Z","host":"HR-LT-044","user":"morgan.lee","event_type":"file_create","process":"powershell.exe","path":"C:\\ProgramData\\sync-update.ps1","sha256":"146050edb2d77ab57ab50f0a8c46e09409bb512493b86bfcf2d26a73730168cc","correlation_id":"E-2004"}
{"timestamp":"2026-06-18T14:01:10Z","host":"HR-LT-044","user":"morgan.lee","event_type":"scheduled_task_create","process":"schtasks.exe","parent":"powershell.exe","task_name":"Document Sync Update","task_action":"powershell.exe -File C:\\ProgramData\\sync-update.ps1","correlation_id":"E-2005"}
{"timestamp":"2026-06-18T14:02:49Z","host":"HR-LT-044","user":"morgan.lee","event_type":"network_connect","process":"powershell.exe","destination_ip":"203.0.113.90","destination_port":443,"bytes_sent":18432,"correlation_id":"E-2006"}
{"timestamp":"2026-06-18T14:20:12Z","host":"FIN-LT-021","user":"alex.rivera","event_type":"process_start","process":"powershell.exe","parent":"software-center.exe","command_line":"powershell.exe -File C:\\ProgramData\\Company\\inventory.ps1","sha256":"approved-inventory-script","correlation_id":"E-2007"}
{"timestamp":"2026-06-18T14:21:02Z","host":"FIN-LT-021","user":"alex.rivera","event_type":"network_connect","process":"powershell.exe","destination_ip":"192.0.2.80","destination_port":443,"bytes_sent":2301,"correlation_id":"E-2008"}