{
  "workflow_id": "REPLACE_WITH_YOUR_WORKFLOW_ID",
  "execution_argument": {
    "ioc_type": "domain",
    "ioc_value": "malicious.example",
    "source_event": {
      "event_id": "evt-shuffle-sample-001",
      "asset": {"hostname": "fw01"},
      "network": {"src_ip": "198.51.100.25"}
    }
  }
}