{
  "generated_at": "2026-07-12T06:27:49.710846Z",
  "window_hours": 24,
  "threat_index": {
    "value": 30,
    "label": "LOW",
    "basis": "volume vs a 200k/24h reference, plus observed high-severity techniques and hands-on activity"
  },
  "kpis": {
    "events": "210K",
    "unique_ips": "5,891",
    "protocols_covered": 1,
    "continents_covered": 3,
    "top_technique": {
      "id": "T1190",
      "name": "Exploit Public-Facing Application",
      "pct": 100
    }
  },
  "hourly_volume": [
    7,
    31,
    56,
    6,
    9,
    43,
    110,
    36,
    135,
    64,
    25,
    28,
    178,
    9,
    39,
    106,
    85,
    100,
    27,
    16,
    37,
    68,
    55,
    38
  ],
  "origins": [
    {
      "name": "United States",
      "pct": 24
    },
    {
      "name": "Netherlands",
      "pct": 16
    },
    {
      "name": "Germany",
      "pct": 15
    },
    {
      "name": "The Netherlands",
      "pct": 6
    },
    {
      "name": "India",
      "pct": 6
    },
    {
      "name": "Other",
      "pct": 33
    }
  ],
  "protocols": [
    {
      "name": "HTTP",
      "pct": 100,
      "amber": false
    }
  ],
  "credentials": [],
  "mitre": [
    {
      "id": "T1190",
      "name": "Exploit Public-Facing Application",
      "pct": 100
    }
  ],
  "map_origins": [
    {
      "name": "United States",
      "lat": 39,
      "lon": -98,
      "pct": 24
    },
    {
      "name": "Netherlands",
      "lat": 52,
      "lon": 5,
      "pct": 16
    },
    {
      "name": "Germany",
      "lat": 51,
      "lon": 10,
      "pct": 15
    },
    {
      "name": "India",
      "lat": 21,
      "lon": 78,
      "pct": 6
    }
  ],
  "feed": [],
  "nuisance_filtered": 0,
  "captures": {
    "window_days": 10,
    "events": 2101574,
    "sessions": 548776,
    "unique_ips": 5891,
    "per_day": 210157,
    "per_week": 1471102,
    "per_month": 6304722,
    "alltime_estimate": 24501574,
    "alltime_floor": 24000000
  },
  "_notes": "Aggregated from real fleet captures. No node counts or sensor locations. Feed delayed >= 24h and redacted."
}