{
  "node": "triton",
  "role": "main",
  "generated_at": "2026-08-28T15:20:04.289643Z",
  "unique_ips": 25,
  "threats": [
    {
      "ip": "103.215.75.66",
      "first_seen": "2026-08-28T10:52:57-04:00",
      "last_seen": "2026-08-28T10:52:58-04:00",
      "scenarios": [
        {
          "name": "crowdsecurity/http-cve-probing",
          "category": "cve-exploit",
          "base_score": 0.9,
          "count": 1,
          "last_seen": "2026-08-28T10:52:58-04:00"
        },
        {
          "name": "crowdsecurity/http-probing",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-08-28T10:52:57-04:00"
        }
      ],
      "source": [
        "Zephyrus"
      ],
      "confidence": {
        "score": 0.73,
        "label": "medium"
      },
      "severity": {
        "level": "critical",
        "score": 9,
        "mitre_tactics": [
          "Initial Access",
          "Unknown"
        ],
        "mitre_techniques": [
          "T1190"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "34.26.200.217",
      "first_seen": "2026-08-28T10:47:20-04:00",
      "last_seen": "2026-08-28T10:47:20-04:00",
      "scenarios": [
        {
          "name": "mgmt-path-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-08-28T10:47:20-04:00"
        },
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-08-28T10:47:20-04:00"
        },
        {
          "name": "wp-sensitive-paths",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-08-28T10:47:20-04:00"
        },
        {
          "name": "wordpress-probe",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-08-28T10:47:20-04:00"
        },
        {
          "name": "crowdsecurity/http-sensitive-files",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-08-28T10:47:20-04:00"
        }
      ],
      "source": [
        "Argus"
      ],
      "confidence": {
        "score": 0.82,
        "label": "medium"
      },
      "severity": {
        "level": "high",
        "score": 7,
        "mitre_tactics": [
          "Initial Access",
          "Reconnaissance",
          "Unknown"
        ],
        "mitre_techniques": [
          "T1190",
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "34.48.222.61",
      "first_seen": "2026-08-28T10:44:02-04:00",
      "last_seen": "2026-08-28T10:44:02-04:00",
      "scenarios": [
        {
          "name": "wp-sensitive-paths",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-08-28T10:44:02-04:00"
        },
        {
          "name": "wordpress-probe",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-08-28T10:44:02-04:00"
        }
      ],
      "source": [
        "Triton"
      ],
      "confidence": {
        "score": 0.9,
        "label": "high"
      },
      "severity": {
        "level": "high",
        "score": 7,
        "mitre_tactics": [
          "Initial Access"
        ],
        "mitre_techniques": [
          "T1190"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "85.204.70.100",
      "first_seen": "2026-08-28T10:42:20-04:00",
      "last_seen": "2026-08-28T10:42:21-04:00",
      "scenarios": [
        {
          "name": "wordpress-probe",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-08-28T10:42:21-04:00"
        },
        {
          "name": "wp-sensitive-paths",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-08-28T10:42:21-04:00"
        },
        {
          "name": "crowdsecurity/http-probing",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-08-28T10:42:20-04:00"
        }
      ],
      "source": [
        "Iris"
      ],
      "confidence": {
        "score": 0.78,
        "label": "medium"
      },
      "severity": {
        "level": "high",
        "score": 7,
        "mitre_tactics": [
          "Initial Access",
          "Unknown"
        ],
        "mitre_techniques": [
          "T1190"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "34.63.154.64",
      "first_seen": "2026-08-28T10:30:55-04:00",
      "last_seen": "2026-08-28T10:30:55-04:00",
      "scenarios": [
        {
          "name": "wordpress-probe",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-08-28T10:30:55-04:00"
        },
        {
          "name": "mgmt-path-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-08-28T10:30:55-04:00"
        },
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-08-28T10:30:55-04:00"
        },
        {
          "name": "crowdsecurity/http-probing",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-08-28T10:30:55-04:00"
        },
        {
          "name": "wp-sensitive-paths",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-08-28T10:30:55-04:00"
        }
      ],
      "source": [
        "Triton"
      ],
      "confidence": {
        "score": 0.82,
        "label": "medium"
      },
      "severity": {
        "level": "high",
        "score": 7,
        "mitre_tactics": [
          "Initial Access",
          "Reconnaissance",
          "Unknown"
        ],
        "mitre_techniques": [
          "T1190",
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "185.242.3.167",
      "first_seen": "2026-08-28T10:19:00-04:00",
      "last_seen": "2026-08-28T10:19:00-04:00",
      "scenarios": [
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-08-28T10:19:00-04:00"
        }
      ],
      "source": [
        "Ares"
      ],
      "confidence": {
        "score": 0.6,
        "label": "low"
      },
      "severity": {
        "level": "low",
        "score": 1,
        "mitre_tactics": [
          "Reconnaissance"
        ],
        "mitre_techniques": [
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "34.139.159.204",
      "first_seen": "2026-08-28T10:12:53-04:00",
      "last_seen": "2026-08-28T10:12:54-04:00",
      "scenarios": [
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-08-28T10:12:54-04:00"
        },
        {
          "name": "mgmt-path-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-08-28T10:12:53-04:00"
        },
        {
          "name": "wordpress-probe",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-08-28T10:12:53-04:00"
        },
        {
          "name": "crowdsecurity/http-probing",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-08-28T10:12:53-04:00"
        },
        {
          "name": "wp-sensitive-paths",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-08-28T10:12:53-04:00"
        },
        {
          "name": "crowdsecurity/http-sensitive-files",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-08-28T10:12:53-04:00"
        }
      ],
      "source": [
        "Argus"
      ],
      "confidence": {
        "score": 0.77,
        "label": "medium"
      },
      "severity": {
        "level": "high",
        "score": 7,
        "mitre_tactics": [
          "Initial Access",
          "Reconnaissance",
          "Unknown"
        ],
        "mitre_techniques": [
          "T1190",
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "104.196.180.125",
      "first_seen": "2026-08-28T10:00:25-04:00",
      "last_seen": "2026-08-28T10:00:25-04:00",
      "scenarios": [
        {
          "name": "wordpress-probe",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-08-28T10:00:25-04:00"
        },
        {
          "name": "wp-sensitive-paths",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-08-28T10:00:25-04:00"
        },
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-08-28T10:00:25-04:00"
        },
        {
          "name": "mgmt-path-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-08-28T10:00:25-04:00"
        }
      ],
      "source": [
        "Triton"
      ],
      "confidence": {
        "score": 0.88,
        "label": "high"
      },
      "severity": {
        "level": "high",
        "score": 7,
        "mitre_tactics": [
          "Initial Access",
          "Reconnaissance"
        ],
        "mitre_techniques": [
          "T1190",
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "34.131.122.53",
      "first_seen": "2026-08-28T09:50:33-04:00",
      "last_seen": "2026-08-28T09:50:33-04:00",
      "scenarios": [
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-08-28T09:50:33-04:00"
        },
        {
          "name": "mgmt-path-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-08-28T09:50:33-04:00"
        },
        {
          "name": "crowdsecurity/http-probing",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-08-28T09:50:33-04:00"
        },
        {
          "name": "crowdsecurity/http-sensitive-files",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-08-28T09:50:33-04:00"
        }
      ],
      "source": [
        "Argus"
      ],
      "confidence": {
        "score": 0.54,
        "label": "low"
      },
      "severity": {
        "level": "low",
        "score": 1,
        "mitre_tactics": [
          "Reconnaissance",
          "Unknown"
        ],
        "mitre_techniques": [
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "34.63.153.124",
      "first_seen": "2026-08-28T09:06:39-04:00",
      "last_seen": "2026-08-28T09:06:40-04:00",
      "scenarios": [
        {
          "name": "wordpress-probe",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-08-28T09:06:40-04:00"
        },
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-08-28T09:06:40-04:00"
        },
        {
          "name": "wp-sensitive-paths",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-08-28T09:06:40-04:00"
        },
        {
          "name": "crowdsecurity/http-probing",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-08-28T09:06:39-04:00"
        },
        {
          "name": "crowdsecurity/http-sensitive-files",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-08-28T09:06:39-04:00"
        },
        {
          "name": "mgmt-path-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-08-28T09:06:39-04:00"
        }
      ],
      "source": [
        "Argus"
      ],
      "confidence": {
        "score": 0.77,
        "label": "medium"
      },
      "severity": {
        "level": "high",
        "score": 7,
        "mitre_tactics": [
          "Initial Access",
          "Reconnaissance",
          "Unknown"
        ],
        "mitre_techniques": [
          "T1190",
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "34.42.236.107",
      "first_seen": "2026-08-28T08:56:21-04:00",
      "last_seen": "2026-08-28T08:56:21-04:00",
      "scenarios": [
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-08-28T08:56:21-04:00"
        },
        {
          "name": "wordpress-probe",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-08-28T08:56:21-04:00"
        },
        {
          "name": "crowdsecurity/http-sensitive-files",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-08-28T08:56:21-04:00"
        },
        {
          "name": "wp-sensitive-paths",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-08-28T08:56:21-04:00"
        },
        {
          "name": "mgmt-path-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-08-28T08:56:21-04:00"
        },
        {
          "name": "crowdsecurity/http-probing",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-08-28T08:56:21-04:00"
        }
      ],
      "source": [
        "Argus"
      ],
      "confidence": {
        "score": 0.77,
        "label": "medium"
      },
      "severity": {
        "level": "high",
        "score": 7,
        "mitre_tactics": [
          "Initial Access",
          "Reconnaissance",
          "Unknown"
        ],
        "mitre_techniques": [
          "T1190",
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "167.94.146.62",
      "first_seen": "2026-08-28T08:54:38-04:00",
      "last_seen": "2026-08-28T08:54:38-04:00",
      "scenarios": [
        {
          "name": "crowdsecurity/http-bad-user-agent",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-08-28T08:54:38-04:00"
        }
      ],
      "source": [
        "Argus"
      ],
      "confidence": {
        "score": 0.3,
        "label": "low"
      },
      "severity": {
        "level": "low",
        "score": 1,
        "mitre_tactics": [
          "Unknown"
        ],
        "mitre_techniques": []
      },
      "scope": "fleet"
    },
    {
      "ip": "34.58.249.110",
      "first_seen": "2026-08-28T08:52:31-04:00",
      "last_seen": "2026-08-28T08:52:31-04:00",
      "scenarios": [
        {
          "name": "wordpress-probe",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-08-28T08:52:31-04:00"
        },
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-08-28T08:52:31-04:00"
        },
        {
          "name": "wp-sensitive-paths",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-08-28T08:52:31-04:00"
        },
        {
          "name": "mgmt-path-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-08-28T08:52:31-04:00"
        }
      ],
      "source": [
        "Triton"
      ],
      "confidence": {
        "score": 0.88,
        "label": "high"
      },
      "severity": {
        "level": "high",
        "score": 7,
        "mitre_tactics": [
          "Initial Access",
          "Reconnaissance"
        ],
        "mitre_techniques": [
          "T1190",
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "35.227.69.226",
      "first_seen": "2026-08-28T08:46:42-04:00",
      "last_seen": "2026-08-28T08:46:42-04:00",
      "scenarios": [
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-08-28T08:46:42-04:00"
        },
        {
          "name": "wordpress-probe",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-08-28T08:46:42-04:00"
        },
        {
          "name": "mgmt-path-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-08-28T08:46:42-04:00"
        },
        {
          "name": "crowdsecurity/http-sensitive-files",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-08-28T08:46:42-04:00"
        },
        {
          "name": "wp-sensitive-paths",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-08-28T08:46:42-04:00"
        },
        {
          "name": "crowdsecurity/http-probing",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-08-28T08:46:42-04:00"
        }
      ],
      "source": [
        "Ares"
      ],
      "confidence": {
        "score": 0.77,
        "label": "medium"
      },
      "severity": {
        "level": "high",
        "score": 7,
        "mitre_tactics": [
          "Initial Access",
          "Reconnaissance",
          "Unknown"
        ],
        "mitre_techniques": [
          "T1190",
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "34.86.15.169",
      "first_seen": "2026-08-28T08:37:58-04:00",
      "last_seen": "2026-08-28T08:37:58-04:00",
      "scenarios": [
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-08-28T08:37:58-04:00"
        },
        {
          "name": "wp-sensitive-paths",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-08-28T08:37:58-04:00"
        },
        {
          "name": "wordpress-probe",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-08-28T08:37:58-04:00"
        },
        {
          "name": "mgmt-path-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-08-28T08:37:58-04:00"
        },
        {
          "name": "crowdsecurity/http-sensitive-files",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-08-28T08:37:58-04:00"
        }
      ],
      "source": [
        "Hermes"
      ],
      "confidence": {
        "score": 0.82,
        "label": "medium"
      },
      "severity": {
        "level": "high",
        "score": 7,
        "mitre_tactics": [
          "Initial Access",
          "Reconnaissance",
          "Unknown"
        ],
        "mitre_techniques": [
          "T1190",
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "35.232.115.51",
      "first_seen": "2026-08-28T08:37:45-04:00",
      "last_seen": "2026-08-28T08:37:45-04:00",
      "scenarios": [
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-08-28T08:37:45-04:00"
        },
        {
          "name": "wordpress-probe",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-08-28T08:37:45-04:00"
        },
        {
          "name": "wp-sensitive-paths",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-08-28T08:37:45-04:00"
        },
        {
          "name": "crowdsecurity/http-sensitive-files",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-08-28T08:37:45-04:00"
        },
        {
          "name": "mgmt-path-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-08-28T08:37:45-04:00"
        }
      ],
      "source": [
        "Zephyrus"
      ],
      "confidence": {
        "score": 0.82,
        "label": "medium"
      },
      "severity": {
        "level": "high",
        "score": 7,
        "mitre_tactics": [
          "Initial Access",
          "Reconnaissance",
          "Unknown"
        ],
        "mitre_techniques": [
          "T1190",
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "34.41.136.165",
      "first_seen": "2026-08-28T08:19:02-04:00",
      "last_seen": "2026-08-28T08:19:02-04:00",
      "scenarios": [
        {
          "name": "mgmt-path-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-08-28T08:19:02-04:00"
        },
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-08-28T08:19:02-04:00"
        },
        {
          "name": "crowdsecurity/http-probing",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-08-28T08:19:02-04:00"
        },
        {
          "name": "crowdsecurity/http-sensitive-files",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-08-28T08:19:02-04:00"
        },
        {
          "name": "wordpress-probe",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-08-28T08:19:02-04:00"
        },
        {
          "name": "wp-sensitive-paths",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-08-28T08:19:02-04:00"
        }
      ],
      "source": [
        "Argus"
      ],
      "confidence": {
        "score": 0.77,
        "label": "medium"
      },
      "severity": {
        "level": "high",
        "score": 7,
        "mitre_tactics": [
          "Initial Access",
          "Reconnaissance",
          "Unknown"
        ],
        "mitre_techniques": [
          "T1190",
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "34.29.185.15",
      "first_seen": "2026-08-28T08:01:09-04:00",
      "last_seen": "2026-08-28T08:01:09-04:00",
      "scenarios": [
        {
          "name": "wordpress-probe",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-08-28T08:01:09-04:00"
        },
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-08-28T08:01:09-04:00"
        },
        {
          "name": "wp-sensitive-paths",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-08-28T08:01:09-04:00"
        },
        {
          "name": "mgmt-path-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-08-28T08:01:09-04:00"
        },
        {
          "name": "crowdsecurity/http-sensitive-files",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-08-28T08:01:09-04:00"
        },
        {
          "name": "crowdsecurity/http-probing",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-08-28T08:01:09-04:00"
        }
      ],
      "source": [
        "Ares"
      ],
      "confidence": {
        "score": 0.77,
        "label": "medium"
      },
      "severity": {
        "level": "high",
        "score": 7,
        "mitre_tactics": [
          "Initial Access",
          "Reconnaissance",
          "Unknown"
        ],
        "mitre_techniques": [
          "T1190",
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "45.148.10.95",
      "first_seen": "2026-08-28T08:00:43-04:00",
      "last_seen": "2026-08-28T08:00:43-04:00",
      "scenarios": [
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-08-28T08:00:43-04:00"
        }
      ],
      "source": [
        "Triton"
      ],
      "confidence": {
        "score": 0.6,
        "label": "low"
      },
      "severity": {
        "level": "low",
        "score": 1,
        "mitre_tactics": [
          "Reconnaissance"
        ],
        "mitre_techniques": [
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "66.132.172.142",
      "first_seen": "2026-08-28T07:57:20-04:00",
      "last_seen": "2026-08-28T07:57:20-04:00",
      "scenarios": [
        {
          "name": "crowdsecurity/http-bad-user-agent",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-08-28T07:57:20-04:00"
        }
      ],
      "source": [
        "Zephyrus"
      ],
      "confidence": {
        "score": 0.3,
        "label": "low"
      },
      "severity": {
        "level": "low",
        "score": 1,
        "mitre_tactics": [
          "Unknown"
        ],
        "mitre_techniques": []
      },
      "scope": "fleet"
    },
    {
      "ip": "45.148.10.62",
      "first_seen": "2026-08-28T07:52:43-04:00",
      "last_seen": "2026-08-28T07:52:43-04:00",
      "scenarios": [
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-08-28T07:52:43-04:00"
        }
      ],
      "source": [
        "Zephyrus"
      ],
      "confidence": {
        "score": 0.6,
        "label": "low"
      },
      "severity": {
        "level": "low",
        "score": 1,
        "mitre_tactics": [
          "Reconnaissance"
        ],
        "mitre_techniques": [
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "46.105.48.30",
      "first_seen": "2026-08-28T07:16:51-04:00",
      "last_seen": "2026-08-28T07:16:51-04:00",
      "scenarios": [
        {
          "name": "crowdsecurity/http-bad-user-agent",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-08-28T07:16:51-04:00"
        }
      ],
      "source": [
        "Triton"
      ],
      "confidence": {
        "score": 0.3,
        "label": "low"
      },
      "severity": {
        "level": "low",
        "score": 1,
        "mitre_tactics": [
          "Unknown"
        ],
        "mitre_techniques": []
      },
      "scope": "fleet"
    },
    {
      "ip": "35.239.28.134",
      "first_seen": "2026-08-28T07:09:25-04:00",
      "last_seen": "2026-08-28T07:09:26-04:00",
      "scenarios": [
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-08-28T07:09:26-04:00"
        },
        {
          "name": "mgmt-path-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-08-28T07:09:25-04:00"
        },
        {
          "name": "crowdsecurity/http-probing",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-08-28T07:09:25-04:00"
        },
        {
          "name": "wordpress-probe",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-08-28T07:09:25-04:00"
        },
        {
          "name": "crowdsecurity/http-sensitive-files",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-08-28T07:09:25-04:00"
        },
        {
          "name": "wp-sensitive-paths",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-08-28T07:09:25-04:00"
        }
      ],
      "source": [
        "Argus"
      ],
      "confidence": {
        "score": 0.77,
        "label": "medium"
      },
      "severity": {
        "level": "high",
        "score": 7,
        "mitre_tactics": [
          "Initial Access",
          "Reconnaissance",
          "Unknown"
        ],
        "mitre_techniques": [
          "T1190",
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "93.123.109.178",
      "first_seen": "2026-08-28T06:43:21-04:00",
      "last_seen": "2026-08-28T06:43:21-04:00",
      "scenarios": [
        {
          "name": "crowdsecurity/http-cve-probing",
          "category": "cve-exploit",
          "base_score": 0.9,
          "count": 1,
          "last_seen": "2026-08-28T06:43:21-04:00"
        }
      ],
      "source": [
        "Zephyrus"
      ],
      "confidence": {
        "score": 0.93,
        "label": "high"
      },
      "severity": {
        "level": "critical",
        "score": 9,
        "mitre_tactics": [
          "Initial Access"
        ],
        "mitre_techniques": [
          "T1190"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "34.105.2.34",
      "first_seen": "2026-08-28T06:28:55-04:00",
      "last_seen": "2026-08-28T06:28:56-04:00",
      "scenarios": [
        {
          "name": "wordpress-probe",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-08-28T06:28:56-04:00"
        },
        {
          "name": "wp-sensitive-paths",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-08-28T06:28:56-04:00"
        },
        {
          "name": "crowdsecurity/http-probing",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-08-28T06:28:55-04:00"
        }
      ],
      "source": [
        "Triton"
      ],
      "confidence": {
        "score": 0.78,
        "label": "medium"
      },
      "severity": {
        "level": "high",
        "score": 7,
        "mitre_tactics": [
          "Initial Access",
          "Unknown"
        ],
        "mitre_techniques": [
          "T1190"
        ]
      },
      "scope": "fleet"
    }
  ]
}