{
  "generated_at": "2026-07-11T18:25:59.600583Z",
  "window_hours": 24,
  "threat_index": {
    "value": 31,
    "label": "LOW",
    "basis": "volume vs a 200k/24h reference, plus observed high-severity techniques and hands-on activity"
  },
  "kpis": {
    "events": "219K",
    "unique_ips": "5,605",
    "protocols_covered": 1,
    "continents_covered": 3,
    "top_technique": {
      "id": "T1190",
      "name": "Exploit Public-Facing Application",
      "pct": 100
    }
  },
  "hourly_volume": [
    10,
    805,
    59,
    137,
    52,
    25,
    23,
    67,
    51,
    244,
    1100,
    43,
    28,
    68,
    180,
    20,
    79,
    111,
    243,
    58,
    149,
    72,
    49,
    32
  ],
  "origins": [
    {
      "name": "The Netherlands",
      "pct": 58
    },
    {
      "name": "United States",
      "pct": 12
    },
    {
      "name": "Netherlands",
      "pct": 9
    },
    {
      "name": "Germany",
      "pct": 4
    },
    {
      "name": "Singapore",
      "pct": 4
    },
    {
      "name": "Other",
      "pct": 13
    }
  ],
  "protocols": [
    {
      "name": "HTTP",
      "pct": 100,
      "amber": false
    }
  ],
  "credentials": [],
  "mitre": [
    {
      "id": "T1190",
      "name": "Exploit Public-Facing Application",
      "pct": 100
    }
  ],
  "map_origins": [
    {
      "name": "United States",
      "lat": 39,
      "lon": -98,
      "pct": 12
    },
    {
      "name": "Netherlands",
      "lat": 52,
      "lon": 5,
      "pct": 9
    },
    {
      "name": "Germany",
      "lat": 51,
      "lon": 10,
      "pct": 4
    },
    {
      "name": "Singapore",
      "lat": 1,
      "lon": 104,
      "pct": 4
    }
  ],
  "feed": [],
  "nuisance_filtered": 1,
  "captures": {
    "window_days": 9,
    "events": 1973187,
    "sessions": 516085,
    "unique_ips": 5605,
    "per_day": 219243,
    "per_week": 1534701,
    "per_month": 6577290,
    "alltime_estimate": 24373187,
    "alltime_floor": 24000000
  },
  "_notes": "Aggregated from real fleet captures. No node counts or sensor locations. Feed delayed >= 24h and redacted."
}