[
  {
    "logged_at": "2026-11-14T02:45:31.889872+00:00",
    "dry_run": true,
    "simulated": true,
    "demo_label": "DEMO / simulated data",
    "platform": "discord",
    "client_id": "demo",
    "chat_id": "demo-announcements",
    "message_id": "1",
    "user_id": "1001",
    "username": "demo_user_1",
    "text_redacted": "gm, is the docs link still docs.orehook.com?",
    "timestamp": "2026-11-14T22:07:11-05:00",
    "in_coverage": true,
    "severity": "info",
    "rule_ids": [],
    "summary": "No rule matched.",
    "skipped_reason": null,
    "actions": [
      {
        "type": "log",
        "reason": "clean message",
        "duration_seconds": null,
        "template_id": null
      }
    ],
    "extra": {
      "dry_run": true
    }
  },
  {
    "logged_at": "2026-11-14T02:45:31.890149+00:00",
    "dry_run": true,
    "simulated": true,
    "demo_label": "DEMO / simulated data",
    "platform": "discord",
    "client_id": "demo",
    "chat_id": "demo-general",
    "message_id": "2",
    "user_id": "1002",
    "username": "demo_user_2",
    "text_redacted": "Claim your free airdrop now: https://claim-airdrop.app/orehook-bonus connect your wallet",
    "timestamp": "2026-11-14T22:14:03-05:00",
    "in_coverage": true,
    "severity": "sev1",
    "rule_ids": [
      "suspicious_host",
      "kw:wallet_drainer",
      "kw:airdrop_phish",
      "link_plus_scam_kw"
    ],
    "summary": "SEV1 on discord: suspicious_host:host:claim-airdrop.app; kw:wallet_drainer:connect your wallet; kw:airdrop_phish:free airdrop; link_plus_scam_kw:claim-airdrop.app",
    "skipped_reason": null,
    "actions": [
      {
        "type": "delete",
        "reason": "remove matching message (suspicious_host:host:claim-airdrop.app; kw:wallet_drainer:connect your wallet; kw:airdrop_phish:free airdrop; link_plus_scam_kw:claim-airdrop.app)",
        "duration_seconds": null,
        "template_id": null
      },
      {
        "type": "timeout",
        "reason": "timeout after Sev1",
        "duration_seconds": 86400,
        "template_id": null
      },
      {
        "type": "escalate",
        "reason": "Sev1 page to on-call",
        "duration_seconds": null,
        "template_id": null
      },
      {
        "type": "log",
        "reason": "suspicious_host:host:claim-airdrop.app; kw:wallet_drainer:connect your wallet; kw:airdrop_phish:free airdrop; link_plus_scam_kw:claim-airdrop.app",
        "duration_seconds": null,
        "template_id": null
      }
    ],
    "extra": {
      "escalation": {
        "method": "webhook",
        "ok": true,
        "detail": "dry-run: not sent",
        "dry_run": true
      },
      "dry_run": true
    }
  },
  {
    "logged_at": "2026-11-14T02:45:31.890349+00:00",
    "dry_run": true,
    "simulated": true,
    "demo_label": "DEMO / simulated data",
    "platform": "telegram",
    "client_id": "demo",
    "chat_id": "demo-tg-main",
    "message_id": "3",
    "user_id": "1003",
    "username": "demo_scam_bot",
    "text_redacted": "Soporte oficial: envíame md y pega tu frase semilla para validar tu wallet https://bit.ly/demo-fake",
    "timestamp": "2026-11-14T22:21:44-05:00",
    "in_coverage": true,
    "severity": "sev1",
    "rule_ids": [
      "url_shortener",
      "kw:seed_phrase",
      "kw:impersonation_support",
      "link_plus_scam_kw"
    ],
    "summary": "SEV1 on telegram: url_shortener:shortener:bit.ly; kw:seed_phrase:frase semilla; kw:impersonation_support:soporte oficial; kw:impersonation_support:enviame md; kw:impersonation_support:enviame md; link_plus_scam_kw:bit.ly",
    "skipped_reason": null,
    "actions": [
      {
        "type": "delete",
        "reason": "remove matching message (url_shortener:shortener:bit.ly; kw:seed_phrase:frase semilla; kw:impersonation_support:soporte oficial; kw:impersonation_support:enviame md; kw:impersonation_support:enviame md; link_plus_scam_kw:bit.ly)",
        "duration_seconds": null,
        "template_id": null
      },
      {
        "type": "timeout",
        "reason": "timeout after Sev1",
        "duration_seconds": 86400,
        "template_id": null
      },
      {
        "type": "escalate",
        "reason": "Sev1 page to on-call",
        "duration_seconds": null,
        "template_id": null
      },
      {
        "type": "log",
        "reason": "url_shortener:shortener:bit.ly; kw:seed_phrase:frase semilla; kw:impersonation_support:soporte oficial; kw:impersonation_support:enviame md; kw:impersonation_support:enviame md; link_plus_scam_kw:bit.ly",
        "duration_seconds": null,
        "template_id": null
      }
    ],
    "extra": {
      "escalation": {
        "method": "webhook",
        "ok": true,
        "detail": "dry-run: not sent",
        "dry_run": true
      },
      "dry_run": true
    }
  },
  {
    "logged_at": "2026-11-14T02:45:31.890540+00:00",
    "dry_run": true,
    "simulated": true,
    "demo_label": "DEMO / simulated data",
    "platform": "discord",
    "client_id": "demo",
    "chat_id": "demo-general",
    "message_id": "4",
    "user_id": "1004",
    "username": "official_orehook_demo_mod",
    "text_redacted": "I am @orehook_demo_mod, verify your account at https://wallet-verify.com/login",
    "timestamp": "2026-11-14T23:02:09-05:00",
    "in_coverage": true,
    "severity": "sev1",
    "rule_ids": [
      "suspicious_host",
      "kw:phishing",
      "impersonation_claim",
      "impersonation_username",
      "link_plus_scam_kw"
    ],
    "summary": "SEV1 on discord: suspicious_host:host:allet-verify.com; kw:phishing:verify your account; impersonation_claim:orehook_demo_mod; impersonation_username:official_orehook_demo_mod; link_plus_scam_kw:allet-verify.com",
    "skipped_reason": null,
    "actions": [
      {
        "type": "delete",
        "reason": "remove matching message (suspicious_host:host:allet-verify.com; kw:phishing:verify your account; impersonation_claim:orehook_demo_mod; impersonation_username:official_orehook_demo_mod; link_plus_scam_kw:allet-verify.com)",
        "duration_seconds": null,
        "template_id": null
      },
      {
        "type": "timeout",
        "reason": "timeout after Sev1",
        "duration_seconds": 86400,
        "template_id": null
      },
      {
        "type": "escalate",
        "reason": "Sev1 page to on-call",
        "duration_seconds": null,
        "template_id": null
      },
      {
        "type": "log",
        "reason": "suspicious_host:host:allet-verify.com; kw:phishing:verify your account; impersonation_claim:orehook_demo_mod; impersonation_username:official_orehook_demo_mod; link_plus_scam_kw:allet-verify.com",
        "duration_seconds": null,
        "template_id": null
      }
    ],
    "extra": {
      "escalation": {
        "method": "webhook",
        "ok": true,
        "detail": "dry-run: not sent",
        "dry_run": true
      },
      "dry_run": true
    }
  },
  {
    "logged_at": "2026-11-14T02:45:31.890658+00:00",
    "dry_run": true,
    "simulated": true,
    "demo_label": "DEMO / simulated data",
    "platform": "discord",
    "client_id": "demo",
    "chat_id": "demo-general",
    "message_id": "5",
    "user_id": "1005",
    "username": "demo_user_3",
    "text_redacted": "Should I buy now? Price prediction for tonight?",
    "timestamp": "2026-11-14T23:15:00-05:00",
    "in_coverage": true,
    "severity": "info",
    "rule_ids": [
      "no_financial_advice"
    ],
    "summary": "Member asked for financial advice; refused and logged.",
    "skipped_reason": null,
    "actions": [
      {
        "type": "reply",
        "reason": "refuse financial advice",
        "duration_seconds": null,
        "template_id": "no_financial_advice"
      },
      {
        "type": "log",
        "reason": "replied with no-advice template",
        "duration_seconds": null,
        "template_id": null
      }
    ],
    "extra": {
      "replies": [
        {
          "template_id": "no_financial_advice",
          "text": "We cannot give financial advice or price calls. Please rely on the project's public docs (https://orehook.com/night-desk/) and your own research. This is not a recommendation to buy, sell or hold."
        }
      ],
      "dry_run": true
    }
  },
  {
    "logged_at": "2026-11-14T02:45:31.890764+00:00",
    "dry_run": true,
    "simulated": true,
    "demo_label": "DEMO / simulated data",
    "platform": "telegram",
    "client_id": "demo",
    "chat_id": "demo-tg-main",
    "message_id": "6",
    "user_id": "1006",
    "username": "demo_user_4",
    "text_redacted": "See the official site: https://orehook.com/night-desk/",
    "timestamp": "2026-11-14T23:18:22-05:00",
    "in_coverage": true,
    "severity": "info",
    "rule_ids": [],
    "summary": "No rule matched.",
    "skipped_reason": null,
    "actions": [
      {
        "type": "log",
        "reason": "clean message",
        "duration_seconds": null,
        "template_id": null
      }
    ],
    "extra": {
      "dry_run": true
    }
  },
  {
    "logged_at": "2026-11-14T02:45:31.890842+00:00",
    "dry_run": true,
    "simulated": true,
    "demo_label": "DEMO / simulated data",
    "platform": "discord",
    "client_id": "demo",
    "chat_id": "demo-general",
    "message_id": "7",
    "user_id": "1007",
    "username": "demo_user_5",
    "text_redacted": "cheap followers cheap followers",
    "timestamp": "2026-11-15T00:11:03-05:00",
    "in_coverage": true,
    "severity": "sev3",
    "rule_ids": [
      "kw:generic_spam"
    ],
    "summary": "SEV3 on discord: kw:generic_spam:cheap followers",
    "skipped_reason": null,
    "actions": [
      {
        "type": "delete",
        "reason": "remove matching message (kw:generic_spam:cheap followers)",
        "duration_seconds": null,
        "template_id": null
      },
      {
        "type": "warn",
        "reason": "low-severity notice",
        "duration_seconds": null,
        "template_id": "spam_warn"
      },
      {
        "type": "log",
        "reason": "kw:generic_spam:cheap followers",
        "duration_seconds": null,
        "template_id": null
      }
    ],
    "extra": {
      "dry_run": true
    }
  },
  {
    "logged_at": "2026-11-14T02:45:31.890946+00:00",
    "dry_run": true,
    "simulated": true,
    "demo_label": "DEMO / simulated data",
    "platform": "discord",
    "client_id": "demo",
    "chat_id": "demo-general",
    "message_id": "8",
    "user_id": "1008",
    "username": "demo_user_6",
    "text_redacted": "Send 0.5 ETH to 0x1111111111111111111111111111111111111111 to unlock funds",
    "timestamp": "2026-11-15T00:40:17-05:00",
    "in_coverage": true,
    "severity": "sev1",
    "rule_ids": [
      "kw:phishing",
      "send_to_address"
    ],
    "summary": "SEV1 on discord: kw:phishing:unlock funds; send_to_address:address + send request",
    "skipped_reason": null,
    "actions": [
      {
        "type": "delete",
        "reason": "remove matching message (kw:phishing:unlock funds; send_to_address:address + send request)",
        "duration_seconds": null,
        "template_id": null
      },
      {
        "type": "timeout",
        "reason": "timeout after Sev1",
        "duration_seconds": 86400,
        "template_id": null
      },
      {
        "type": "escalate",
        "reason": "Sev1 page to on-call",
        "duration_seconds": null,
        "template_id": null
      },
      {
        "type": "log",
        "reason": "kw:phishing:unlock funds; send_to_address:address + send request",
        "duration_seconds": null,
        "template_id": null
      }
    ],
    "extra": {
      "escalation": {
        "method": "webhook",
        "ok": true,
        "detail": "dry-run: not sent",
        "dry_run": true
      },
      "dry_run": true
    }
  },
  {
    "logged_at": "2026-11-14T02:45:31.890987+00:00",
    "dry_run": true,
    "simulated": true,
    "demo_label": "DEMO / simulated data",
    "platform": "discord",
    "client_id": "demo",
    "chat_id": "demo-staff",
    "message_id": "9",
    "user_id": "2001",
    "username": "agency_mod",
    "text_redacted": "Just posting a docs reminder, ignore if noisy.",
    "timestamp": "2026-11-15T01:00:00-05:00",
    "in_coverage": true,
    "severity": "info",
    "rule_ids": [
      "trusted"
    ],
    "summary": "Skipped: trusted sender.",
    "skipped_reason": "trusted",
    "actions": [],
    "extra": {
      "dry_run": true
    }
  },
  {
    "logged_at": "2026-11-14T02:45:31.891018+00:00",
    "dry_run": true,
    "simulated": true,
    "demo_label": "DEMO / simulated data",
    "platform": "discord",
    "client_id": "demo",
    "chat_id": "demo-general",
    "message_id": "10",
    "user_id": "1009",
    "username": "demo_user_7",
    "text_redacted": "This would be a scam at 15:00, claim airdrop https://claim-airdrop.app/x",
    "timestamp": "2026-11-14T15:04:00-05:00",
    "in_coverage": false,
    "severity": "info",
    "rule_ids": [
      "outside_hours"
    ],
    "summary": "Outside the coverage window; logged only.",
    "skipped_reason": "outside_hours",
    "actions": [
      {
        "type": "log",
        "reason": "outside coverage window",
        "duration_seconds": null,
        "template_id": null
      }
    ],
    "extra": {
      "dry_run": true
    }
  }
]