[
  {
    "id": "00000000-0000-0000-0000-000000000001",
    "severity": "warning",
    "title": "IP permanently rate-limited",
    "message": "A source IP reached the login failure limit and requires review.",
    "seen_at": null,
    "resolved_at": null,
    "created_at": "2026-10-25T12:00:00Z"
  }
]