{
  "generated_at": "2026-07-11T16:49:31.182796Z",
  "window_hours": 24,
  "threat_index": {
    "value": 31,
    "label": "LOW",
    "basis": "volume vs a 200k/24h reference, plus observed high-severity techniques and hands-on activity"
  },
  "kpis": {
    "events": "217K",
    "unique_ips": "5,573",
    "protocols_covered": 1,
    "continents_covered": 3,
    "top_technique": {
      "id": "T1190",
      "name": "Exploit Public-Facing Application",
      "pct": 100
    }
  },
  "hourly_volume": [
    10,
    16,
    32,
    12,
    809,
    51,
    142,
    50,
    22,
    22,
    45,
    74,
    21,
    1293,
    59,
    46,
    20,
    109,
    134,
    74,
    100,
    223,
    84,
    47
  ],
  "origins": [
    {
      "name": "The Netherlands",
      "pct": 61
    },
    {
      "name": "United States",
      "pct": 13
    },
    {
      "name": "Netherlands",
      "pct": 6
    },
    {
      "name": "Germany",
      "pct": 5
    },
    {
      "name": "Singapore",
      "pct": 4
    },
    {
      "name": "Other",
      "pct": 11
    }
  ],
  "protocols": [
    {
      "name": "HTTP",
      "pct": 100,
      "amber": false
    }
  ],
  "credentials": [],
  "mitre": [
    {
      "id": "T1190",
      "name": "Exploit Public-Facing Application",
      "pct": 100
    }
  ],
  "map_origins": [
    {
      "name": "United States",
      "lat": 39,
      "lon": -98,
      "pct": 13
    },
    {
      "name": "Netherlands",
      "lat": 52,
      "lon": 5,
      "pct": 6
    },
    {
      "name": "Germany",
      "lat": 51,
      "lon": 10,
      "pct": 5
    },
    {
      "name": "Singapore",
      "lat": 1,
      "lon": 104,
      "pct": 4
    }
  ],
  "feed": [],
  "nuisance_filtered": 1,
  "captures": {
    "window_days": 9,
    "events": 1950665,
    "sessions": 512477,
    "unique_ips": 5573,
    "per_day": 216741,
    "per_week": 1517184,
    "per_month": 6502217,
    "alltime_estimate": 24346639,
    "alltime_floor": 24000000
  },
  "_notes": "Aggregated from real fleet captures. No node counts or sensor locations. Feed delayed >= 24h and redacted."
}