{
  "type": "bundle",
  "id": "bundle--2f6e3e92-9396-5558-899e-aab33c59bcd6",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--5c8eaef2-3c46-595a-848c-879eec9f4208",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "org:3ffa6d56-9460-55ed-90f3-b748ee12c50f",
      "name": "Microsoft",
      "identity_class": "organization"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--f0a8b606-7bf8-517a-80a8-f27af5e453a0",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "inc:57b13225-6aa6-5bfa-ab18-7db05471ff89",
      "name": "Microsoft security incident"
    },
    {
      "type": "incident",
      "spec_version": "2.1",
      "id": "incident--f56b00f8-8b42-5862-8b92-7a7802e3c1a1",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "brh:4d82f8e3-7106-553f-8bed-708690c6dd8c",
      "name": "Microsoft security incident"
    },
    {
      "type": "relationship",
      "spec_version": "2.1",
      "id": "relationship--6e04a294-02d3-5ad6-8ede-7a3a266d9809",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "clm:6765ed0c-b214-5636-b040-5fc28e6ac582",
      "relationship_type": "affected-organization",
      "source_ref": "incident--f0a8b606-7bf8-517a-80a8-f27af5e453a0",
      "target_ref": "identity--5c8eaef2-3c46-595a-848c-879eec9f4208",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Microsoft",
          "url": "https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/",
          "external_id": "cit:a06d98ae-b2ca-5ead-9b88-5c22829011f2",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:206ffd8b9f9081fd179a134bb4cccf253e4997a688d4f739d2ca5c3dbc8e0da6"
        }
      ]
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--4e56e366-0082-5555-8661-5b70b944b16f",
      "created": "2026-09-18T12:00:00Z",
      "modified": "2026-09-18T12:00:00Z",
      "x_ally_original_id": "clm:5c38c499-231e-52b0-b7ec-55443ca48c7e",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Microsoft",
          "url": "https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/",
          "external_id": "cit:e0658034-0da4-5816-a248-4c49128e29a8",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:206ffd8b9f9081fd179a134bb4cccf253e4997a688d4f739d2ca5c3dbc8e0da6"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "The reviewed source documents the microsoft security incident involving Microsoft."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--922a973e-cb44-52ed-8477-d80ac8544ddd",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:24e746a6-ad60-5a4f-b13e-3d9b2fe3b59e",
      "confidence": 89,
      "external_references": [
        {
          "source_name": "Microsoft",
          "url": "https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/",
          "external_id": "cit:ede05804-9d85-52bd-876b-18c41a02a9cf",
          "description": "Our investigation has found a single account had been compromised, granting limited access.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:9c73412e9745128d1f8334f92a589dcfc9da547f5664c2c8ccd2bfafc2edaec5"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Lapsus$; single compromised employee account."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--ba6ad009-0be4-5a53-89bb-b761ed1e1139",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:af7bdfe9-77e0-5c84-b35d-c225fb018f7b",
      "confidence": 84,
      "external_references": [
        {
          "source_name": "Microsoft",
          "url": "https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/",
          "external_id": "cit:e7ebfe79-2fdf-52ac-8820-1a9da780672a",
          "description": "They then proceeded to search collaboration platforms like SharePoint or Confluence, issue-tracking solutions like JIRA, code repositories like GitLab and GitHub, and organization collaboration channels like Teams or Slack to discover further high-privilege account credentials to access other sensitive information.",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:9c73412e9745128d1f8334f92a589dcfc9da547f5664c2c8ccd2bfafc2edaec5"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "string",
        "value": "Partial source code for Bing/Cortana and other products accessed."
      }
    },
    {
      "type": "x-ally-claim",
      "spec_version": "2.1",
      "id": "x-ally-claim--d17c8280-b3ce-573f-89d4-f78c23eed8c4",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "clm:8f4ed4c2-50dc-5b39-9b52-30a4b3ea88e2",
      "confidence": 100,
      "external_references": [
        {
          "source_name": "Microsoft",
          "url": "https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/",
          "external_id": "cit:38056606-f823-5cae-a9dc-00aa170ef1fb",
          "x_ally_stance": "supports",
          "x_ally_snapshot_id": "snp:sha256:9c73412e9745128d1f8334f92a589dcfc9da547f5664c2c8ccd2bfafc2edaec5"
        }
      ],
      "x_ally_claim_object": {
        "kind": "value",
        "datatype": "date",
        "value": "2022-03-22"
      }
    },
    {
      "type": "x-ally-event",
      "spec_version": "2.1",
      "id": "x-ally-event--940de140-ef37-5899-848f-3fb2df321a19",
      "created": "2026-09-19T12:00:00Z",
      "modified": "2026-09-19T12:00:00Z",
      "x_ally_original_id": "evt:1e473337-f011-5b25-861e-03d6da9724ad",
      "name": "Documented public update"
    }
  ]
}