playbook	mitre_id	attack	attack_rc	falco_rule	falco_detected	sidekick_forwarded	talon_received	talon_playbook	talon_matched	playbook_started	primary_action	primary_action_success	notify_admin	response_verified	final_status	namespace	pod	proof_path	detail	start_ts	end_ts
PB1	T1057	ps aux	0	PR10 Response Trigger PB1 Process Discovery	YES	YES	YES	PB1 Evidence Collection Playbook	YES	YES	PB1 Collect Runtime Evidence	YES	N/A	YES	PASS	default	cible1	response/pb1/	Falco=YES; Sidekick=YES; TalonReceived=YES; TalonMatch=YES; Started=YES; Action=YES; Evidence=YES; Severity=LOW; TalonK8sEvent=YES; SidekickHTTP200=6	2026-11-09T06:13:24Z	2026-11-09T06:13:27Z
PB2	T1105	/tmp/manual-curl-tool.sh préparé en mode 0755; déclencheur PR10_PB2_RESPONSE=1	0	PR10 Response Trigger PB2 Tool Transfer	YES	YES	YES	PB2 File Quarantine Playbook	YES	YES	PB2 Quarantine Artifact	YES	N/A	YES	PASS	default	cible1	response/pb2/	Falco=YES; Sidekick=YES; TalonReceived=YES; TalonMatch=YES; Started=YES; Action=YES; Quarantine=YES; ModeBefore=755; ModeAfter=400; HashMatch=YES; Severity=HIGH; TalonK8sEvent=YES; SidekickHTTP200=10	2026-11-09T06:13:32Z	2026-11-09T06:13:35Z
PB3	T1059.004	PR10_PB3_RESPONSE=1; /bin/sh /tmp/manual-response-shell.sh	0	PR10 Response Trigger PB3 Shell Execution	YES	YES	YES	PB3 Pod Isolation Playbook	YES	YES	PB3 Isolate Pod	YES	N/A	YES	PASS	default	cible1	response/pb3/	Falco=YES; Sidekick=YES; TalonReceived=YES; TalonMatch=YES; Started=YES; Action=YES; Containment=YES; Outbound=BLOCKED; Inbound=BLOCKED; OldPreserved=YES; Replacement=cible1-replacement-99b589dcc-cq7bd; ServiceAfter=OPEN; Severity=URGENT; TalonK8sEvent=NO; SidekickHTTP200=10	2026-11-09T06:13:44Z	2026-11-09T06:13:59Z