{
  "_comment": "Sample KVDB content for a SHA-256 blocklist. Paste the key/value pairs into Security Analytics > KVDBs > Actions > Create on the Wazuh dashboard (Draft space), then promote Draft -> Test -> Custom. The Wazuh 5.0 beta documentation describes a KVDB entry as a string key paired with a JSON value; the value shape below is this repository's own convention, not a documented schema. Remove this _comment key before pasting.",

  "275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f": {
    "source": "internal-ir",
    "first_seen": "2026-01-14",
    "confidence": "high",
    "note": "EICAR test string. Safe to keep as a pipeline self-test."
  },

  "0000000000000000000000000000000000000000000000000000000000000000": {
    "source": "REPLACE_ME",
    "first_seen": "YYYY-MM-DD",
    "confidence": "low",
    "note": "Placeholder. Replace with a real SHA-256 from your own intelligence."
  }
}