{
  "generated_at": "2026-07-12T00:24:12.035042Z",
  "window_hours": 24,
  "threat_index": {
    "value": 30,
    "label": "LOW",
    "basis": "volume vs a 200k/24h reference, plus observed high-severity techniques and hands-on activity"
  },
  "kpis": {
    "events": "205K",
    "unique_ips": "5,745",
    "protocols_covered": 1,
    "continents_covered": 2,
    "top_technique": {
      "id": "T1190",
      "name": "Exploit Public-Facing Application",
      "pct": 100
    }
  },
  "hourly_volume": [
    0,
    26,
    15,
    209,
    489,
    9,
    7,
    31,
    56,
    6,
    9,
    40,
    113,
    36,
    135,
    62,
    27,
    28,
    178,
    9,
    38,
    106,
    85,
    100
  ],
  "origins": [
    {
      "name": "The Netherlands",
      "pct": 37
    },
    {
      "name": "United States",
      "pct": 13
    },
    {
      "name": "Netherlands",
      "pct": 12
    },
    {
      "name": "Germany",
      "pct": 10
    },
    {
      "name": "United Kingdom",
      "pct": 5
    },
    {
      "name": "Other",
      "pct": 23
    }
  ],
  "protocols": [
    {
      "name": "HTTP",
      "pct": 100,
      "amber": false
    }
  ],
  "credentials": [],
  "mitre": [
    {
      "id": "T1190",
      "name": "Exploit Public-Facing Application",
      "pct": 100
    }
  ],
  "map_origins": [
    {
      "name": "United States",
      "lat": 39,
      "lon": -98,
      "pct": 13
    },
    {
      "name": "Netherlands",
      "lat": 52,
      "lon": 5,
      "pct": 12
    },
    {
      "name": "Germany",
      "lat": 51,
      "lon": 10,
      "pct": 10
    },
    {
      "name": "United Kingdom",
      "lat": 54,
      "lon": -2,
      "pct": 5
    }
  ],
  "feed": [],
  "nuisance_filtered": 0,
  "captures": {
    "window_days": 10,
    "events": 2053603,
    "sessions": 538594,
    "unique_ips": 5745,
    "per_day": 205360,
    "per_week": 1437522,
    "per_month": 6160809,
    "alltime_estimate": 24453603,
    "alltime_floor": 24000000
  },
  "_notes": "Aggregated from real fleet captures. No node counts or sensor locations. Feed delayed >= 24h and redacted."
}