{
  "alert": {
    "id": 5,
    "ts": 1789158486.6315343,
    "host": "web01",
    "rule": "sudo_command",
    "severity": "low",
    "message": "Ejecución de comando con sudo",
    "mitre_tactic": "Privilege Escalation",
    "mitre_technique": "T1548.003",
    "mitre_technique_name": "Abuse Elevation Control Mechanism: Sudo and Sudo Caching"
  },
  "raw_evidence": [
    {
      "ts": 1789158486.6315343,
      "raw_text": "<86>Sep 11 10:01:00 web01 sudo: abraham : TTY=pts/0 ; PWD=/home/abraham ; USER=root ; COMMAND=/usr/bin/systemctl restart nginx"
    }
  ]
}