{
  "generated_at": "2026-07-12T12:24:30.033620Z",
  "window_hours": 24,
  "threat_index": {
    "value": 30,
    "label": "LOW",
    "basis": "volume vs a 200k/24h reference, plus observed high-severity techniques and hands-on activity"
  },
  "kpis": {
    "events": "218K",
    "unique_ips": "6,040",
    "protocols_covered": 1,
    "continents_covered": 3,
    "top_technique": {
      "id": "T1190",
      "name": "Exploit Public-Facing Application",
      "pct": 100
    }
  },
  "hourly_volume": [
    125,
    35,
    136,
    61,
    28,
    28,
    178,
    9,
    32,
    111,
    82,
    103,
    26,
    19,
    37,
    67,
    56,
    38,
    42,
    74,
    47,
    39,
    15,
    132
  ],
  "origins": [
    {
      "name": "United States",
      "pct": 25
    },
    {
      "name": "Netherlands",
      "pct": 20
    },
    {
      "name": "Germany",
      "pct": 14
    },
    {
      "name": "India",
      "pct": 6
    },
    {
      "name": "The Netherlands",
      "pct": 6
    },
    {
      "name": "Other",
      "pct": 29
    }
  ],
  "protocols": [
    {
      "name": "HTTP",
      "pct": 100,
      "amber": false
    }
  ],
  "credentials": [],
  "mitre": [
    {
      "id": "T1190",
      "name": "Exploit Public-Facing Application",
      "pct": 100
    }
  ],
  "map_origins": [
    {
      "name": "United States",
      "lat": 39,
      "lon": -98,
      "pct": 25
    },
    {
      "name": "Netherlands",
      "lat": 52,
      "lon": 5,
      "pct": 20
    },
    {
      "name": "Germany",
      "lat": 51,
      "lon": 10,
      "pct": 14
    },
    {
      "name": "India",
      "lat": 21,
      "lon": 78,
      "pct": 6
    }
  ],
  "feed": [],
  "nuisance_filtered": 0,
  "captures": {
    "window_days": 10,
    "events": 2184560,
    "sessions": 567542,
    "unique_ips": 6040,
    "per_day": 218456,
    "per_week": 1529192,
    "per_month": 6553680,
    "alltime_estimate": 24584560,
    "alltime_floor": 24000000
  },
  "_notes": "Aggregated from real fleet captures. No node counts or sensor locations. Feed delayed >= 24h and redacted."
}