{
  "event_id": "detector-a:incident-4812:halt-v1",
  "asset_id": "security-test-agent",
  "reason": "Credential theft alert linked to this approved asset",
  "incident_reference": "INC-004812"
}