{
  "alert": {
    "id": 2,
    "ts": 1789158486.6315343,
    "host": "web01",
    "rule": "bruteforce",
    "severity": "high",
    "message": "Posible fuerza bruta: 5 en 5 min",
    "mitre_tactic": "Credential Access",
    "mitre_technique": "T1110.001",
    "mitre_technique_name": "Brute Force: Password Guessing"
  },
  "raw_evidence": [
    {
      "ts": 1789158486.6315343,
      "raw_text": "<38>Sep 11 10:00:13 web01 sshd[1238]: Failed password for invalid user test from 203.0.113.5 port 51248 ssh2"
    }
  ]
}