{
  "sources": [
    {"id": "synthetic_example", "title": "Documentation examples, not threat intelligence"}
  ],
  "patterns": [
    {
      "id": "example_download_command",
      "pattern": "(?i)\\b(?:curl|wget)\\s+https?://",
      "description": "A download command appears in the log. Check its destination, arguments and execution evidence; legitimate administration can match.",
      "source": "synthetic_example"
    }
  ],
  "indicators": [
    {"type": "ipv4", "value": "192.0.2.42", "status": "reference_only", "source": "synthetic_example"},
    {"type": "domain", "value": "triage-demo.example.invalid", "status": "reference_only", "source": "synthetic_example"}
  ]
}