{
  "changes": [
    {
      "timestamp": "2026-04-02T02:11:14Z",
      "action": "delete",
      "rule_id": "R-4451-lsass-dump",
      "name": "LSASS Dump via comsvcs.dll"
    },
    {
      "timestamp": "2026-04-02T02:12:03Z",
      "action": "disable",
      "rule_id": "R-9030-suspicious-ps1"
    }
  ]
}