{
  "node": "triton",
  "role": "main",
  "generated_at": "2026-10-12T20:00:06.218196Z",
  "unique_ips": 25,
  "threats": [
    {
      "ip": "142.93.135.237",
      "first_seen": "2026-10-12T15:43:09-04:00",
      "last_seen": "2026-10-12T15:43:09-04:00",
      "scenarios": [
        {
          "name": "crowdsecurity/http-probing",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-10-12T15:43:09-04:00"
        },
        {
          "name": "crowdsecurity/http-cve-probing",
          "category": "cve-exploit",
          "base_score": 0.9,
          "count": 1,
          "last_seen": "2026-10-12T15:43:09-04:00"
        },
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-10-12T15:43:09-04:00"
        },
        {
          "name": "crowdsecurity/CVE-2017-9841",
          "category": "cve-exploit",
          "base_score": 0.9,
          "count": 1,
          "last_seen": "2026-10-12T15:43:09-04:00"
        }
      ],
      "source": [
        "Zephyrus"
      ],
      "confidence": {
        "score": 0.84,
        "label": "medium"
      },
      "severity": {
        "level": "critical",
        "score": 9,
        "mitre_tactics": [
          "Initial Access",
          "Reconnaissance",
          "Unknown"
        ],
        "mitre_techniques": [
          "T1190",
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "34.95.226.207",
      "first_seen": "2026-10-12T15:41:49-04:00",
      "last_seen": "2026-10-12T15:41:55-04:00",
      "scenarios": [
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-10-12T15:41:55-04:00"
        },
        {
          "name": "mgmt-path-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-10-12T15:41:54-04:00"
        },
        {
          "name": "crowdsecurity/http-cve-2021-41773",
          "category": "cve-exploit",
          "base_score": 0.9,
          "count": 1,
          "last_seen": "2026-10-12T15:41:52-04:00"
        },
        {
          "name": "crowdsecurity/http-path-traversal-probing",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-10-12T15:41:51-04:00"
        },
        {
          "name": "crowdsecurity/http-admin-interface-probing",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-10-12T15:41:50-04:00"
        },
        {
          "name": "crowdsecurity/http-bad-user-agent",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-10-12T15:41:50-04:00"
        },
        {
          "name": "crowdsecurity/http-sensitive-files",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-10-12T15:41:50-04:00"
        },
        {
          "name": "crowdsecurity/http-crawl-non_statics",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-10-12T15:41:49-04:00"
        },
        {
          "name": "crowdsecurity/http-probing",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-10-12T15:41:49-04:00"
        }
      ],
      "source": [
        "Iris"
      ],
      "confidence": {
        "score": 0.73,
        "label": "medium"
      },
      "severity": {
        "level": "critical",
        "score": 9,
        "mitre_tactics": [
          "Initial Access",
          "Reconnaissance",
          "Unknown"
        ],
        "mitre_techniques": [
          "T1190",
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "136.66.141.161",
      "first_seen": "2026-10-12T15:33:02-04:00",
      "last_seen": "2026-10-12T15:33:04-04:00",
      "scenarios": [
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-10-12T15:33:04-04:00"
        },
        {
          "name": "mgmt-path-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-10-12T15:33:04-04:00"
        },
        {
          "name": "crowdsecurity/http-bad-user-agent",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-10-12T15:33:03-04:00"
        },
        {
          "name": "crowdsecurity/http-cve-2021-41773",
          "category": "cve-exploit",
          "base_score": 0.9,
          "count": 1,
          "last_seen": "2026-10-12T15:33:03-04:00"
        },
        {
          "name": "crowdsecurity/nginx-req-limit-exceeded",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-10-12T15:33:03-04:00"
        },
        {
          "name": "crowdsecurity/http-crawl-non_statics",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-10-12T15:33:02-04:00"
        },
        {
          "name": "crowdsecurity/http-probing",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-10-12T15:33:02-04:00"
        },
        {
          "name": "crowdsecurity/http-path-traversal-probing",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-10-12T15:33:02-04:00"
        }
      ],
      "source": [
        "Triton"
      ],
      "confidence": {
        "score": 0.7,
        "label": "medium"
      },
      "severity": {
        "level": "critical",
        "score": 9,
        "mitre_tactics": [
          "Initial Access",
          "Reconnaissance",
          "Unknown"
        ],
        "mitre_techniques": [
          "T1190",
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "201.79.52.171",
      "first_seen": "2026-10-12T15:28:15-04:00",
      "last_seen": "2026-10-12T15:28:15-04:00",
      "scenarios": [
        {
          "name": "crowdsecurity/http-cve-probing",
          "category": "cve-exploit",
          "base_score": 0.9,
          "count": 1,
          "last_seen": "2026-10-12T15:28:15-04:00"
        },
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-10-12T15:28:15-04:00"
        },
        {
          "name": "crowdsecurity/CVE-2017-9841",
          "category": "cve-exploit",
          "base_score": 0.9,
          "count": 1,
          "last_seen": "2026-10-12T15:28:15-04:00"
        }
      ],
      "source": [
        "Iris"
      ],
      "confidence": {
        "score": 0.93,
        "label": "high"
      },
      "severity": {
        "level": "critical",
        "score": 9,
        "mitre_tactics": [
          "Initial Access",
          "Reconnaissance"
        ],
        "mitre_techniques": [
          "T1190",
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "172.233.190.104",
      "first_seen": "2026-10-12T15:26:38-04:00",
      "last_seen": "2026-10-12T15:26:38-04:00",
      "scenarios": [
        {
          "name": "crowdsecurity/http-probing",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-10-12T15:26:38-04:00"
        },
        {
          "name": "mgmt-path-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-10-12T15:26:38-04:00"
        }
      ],
      "source": [
        "Iris"
      ],
      "confidence": {
        "score": 0.52,
        "label": "low"
      },
      "severity": {
        "level": "low",
        "score": 1,
        "mitre_tactics": [
          "Reconnaissance",
          "Unknown"
        ],
        "mitre_techniques": [
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "66.132.195.162",
      "first_seen": "2026-10-12T15:09:17-04:00",
      "last_seen": "2026-10-12T15:09:17-04:00",
      "scenarios": [
        {
          "name": "crowdsecurity/http-bad-user-agent",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-10-12T15:09:17-04:00"
        }
      ],
      "source": [
        "Argus"
      ],
      "confidence": {
        "score": 0.3,
        "label": "low"
      },
      "severity": {
        "level": "low",
        "score": 1,
        "mitre_tactics": [
          "Unknown"
        ],
        "mitre_techniques": []
      },
      "scope": "fleet"
    },
    {
      "ip": "170.64.163.177",
      "first_seen": "2026-10-12T14:31:05-04:00",
      "last_seen": "2026-10-12T14:31:05-04:00",
      "scenarios": [
        {
          "name": "crowdsecurity/CVE-2017-9841",
          "category": "cve-exploit",
          "base_score": 0.9,
          "count": 1,
          "last_seen": "2026-10-12T14:31:05-04:00"
        },
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-10-12T14:31:05-04:00"
        }
      ],
      "source": [
        "Triton"
      ],
      "confidence": {
        "score": 0.89,
        "label": "high"
      },
      "severity": {
        "level": "critical",
        "score": 9,
        "mitre_tactics": [
          "Initial Access",
          "Reconnaissance"
        ],
        "mitre_techniques": [
          "T1190",
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "34.106.179.90",
      "first_seen": "2026-10-12T13:48:00-04:00",
      "last_seen": "2026-10-12T13:48:00-04:00",
      "scenarios": [
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-10-12T13:48:00-04:00"
        }
      ],
      "source": [
        "Zephyrus"
      ],
      "confidence": {
        "score": 0.6,
        "label": "low"
      },
      "severity": {
        "level": "low",
        "score": 1,
        "mitre_tactics": [
          "Reconnaissance"
        ],
        "mitre_techniques": [
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "94.130.23.168",
      "first_seen": "2026-10-12T13:47:38-04:00",
      "last_seen": "2026-10-12T13:47:38-04:00",
      "scenarios": [
        {
          "name": "crowdsecurity/http-bad-user-agent",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-10-12T13:47:38-04:00"
        }
      ],
      "source": [
        "Iris"
      ],
      "confidence": {
        "score": 0.3,
        "label": "low"
      },
      "severity": {
        "level": "low",
        "score": 1,
        "mitre_tactics": [
          "Unknown"
        ],
        "mitre_techniques": []
      },
      "scope": "fleet"
    },
    {
      "ip": "13.70.110.189",
      "first_seen": "2026-10-12T13:40:56-04:00",
      "last_seen": "2026-10-12T13:40:59-04:00",
      "scenarios": [
        {
          "name": "webshell-high-confidence",
          "category": "post-exploitation",
          "base_score": 0.95,
          "count": 1,
          "last_seen": "2026-10-12T13:40:59-04:00"
        },
        {
          "name": "wp-sensitive-paths",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-10-12T13:40:56-04:00"
        }
      ],
      "source": [
        "Iris"
      ],
      "confidence": {
        "score": 1.0,
        "label": "high"
      },
      "severity": {
        "level": "critical",
        "score": 9,
        "mitre_tactics": [
          "Command and Control / Persistence",
          "Initial Access"
        ],
        "mitre_techniques": [
          "T1059",
          "T1105",
          "T1190"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "74.225.203.7",
      "first_seen": "2026-10-12T13:36:40-04:00",
      "last_seen": "2026-10-12T13:36:42-04:00",
      "scenarios": [
        {
          "name": "webshell-high-confidence",
          "category": "post-exploitation",
          "base_score": 0.95,
          "count": 1,
          "last_seen": "2026-10-12T13:36:42-04:00"
        },
        {
          "name": "wp-sensitive-paths",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-10-12T13:36:40-04:00"
        }
      ],
      "source": [
        "Zephyrus"
      ],
      "confidence": {
        "score": 1.0,
        "label": "high"
      },
      "severity": {
        "level": "critical",
        "score": 9,
        "mitre_tactics": [
          "Command and Control / Persistence",
          "Initial Access"
        ],
        "mitre_techniques": [
          "T1059",
          "T1105",
          "T1190"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "45.156.87.16",
      "first_seen": "2026-10-12T13:11:01-04:00",
      "last_seen": "2026-10-12T13:11:05-04:00",
      "scenarios": [
        {
          "name": "crowdsecurity/CVE-2017-9841",
          "category": "cve-exploit",
          "base_score": 0.9,
          "count": 1,
          "last_seen": "2026-10-12T13:11:05-04:00"
        },
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-10-12T13:11:04-04:00"
        },
        {
          "name": "mgmt-path-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-10-12T13:11:04-04:00"
        },
        {
          "name": "wp-sensitive-paths",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-10-12T13:11:03-04:00"
        },
        {
          "name": "crowdsecurity/http-probing",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-10-12T13:11:01-04:00"
        }
      ],
      "source": [
        "Triton"
      ],
      "confidence": {
        "score": 0.85,
        "label": "medium"
      },
      "severity": {
        "level": "critical",
        "score": 9,
        "mitre_tactics": [
          "Initial Access",
          "Reconnaissance",
          "Unknown"
        ],
        "mitre_techniques": [
          "T1190",
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "34.152.54.207",
      "first_seen": "2026-10-12T13:10:42-04:00",
      "last_seen": "2026-10-12T13:10:49-04:00",
      "scenarios": [
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-10-12T13:10:49-04:00"
        },
        {
          "name": "mgmt-path-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-10-12T13:10:49-04:00"
        },
        {
          "name": "crowdsecurity/http-cve-2021-41773",
          "category": "cve-exploit",
          "base_score": 0.9,
          "count": 1,
          "last_seen": "2026-10-12T13:10:48-04:00"
        },
        {
          "name": "crowdsecurity/http-admin-interface-probing",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-10-12T13:10:43-04:00"
        },
        {
          "name": "crowdsecurity/http-bad-user-agent",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-10-12T13:10:43-04:00"
        },
        {
          "name": "crowdsecurity/http-path-traversal-probing",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-10-12T13:10:43-04:00"
        },
        {
          "name": "crowdsecurity/http-sensitive-files",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-10-12T13:10:42-04:00"
        },
        {
          "name": "crowdsecurity/http-crawl-non_statics",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-10-12T13:10:42-04:00"
        },
        {
          "name": "crowdsecurity/http-probing",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-10-12T13:10:42-04:00"
        }
      ],
      "source": [
        "Iris"
      ],
      "confidence": {
        "score": 0.73,
        "label": "medium"
      },
      "severity": {
        "level": "critical",
        "score": 9,
        "mitre_tactics": [
          "Initial Access",
          "Reconnaissance",
          "Unknown"
        ],
        "mitre_techniques": [
          "T1190",
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "35.187.193.155",
      "first_seen": "2026-10-12T13:02:32-04:00",
      "last_seen": "2026-10-12T13:02:39-04:00",
      "scenarios": [
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-10-12T13:02:39-04:00"
        },
        {
          "name": "mgmt-path-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-10-12T13:02:39-04:00"
        },
        {
          "name": "crowdsecurity/http-cve-2021-41773",
          "category": "cve-exploit",
          "base_score": 0.9,
          "count": 1,
          "last_seen": "2026-10-12T13:02:34-04:00"
        },
        {
          "name": "crowdsecurity/http-bad-user-agent",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-10-12T13:02:33-04:00"
        },
        {
          "name": "crowdsecurity/http-sensitive-files",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-10-12T13:02:33-04:00"
        },
        {
          "name": "crowdsecurity/http-path-traversal-probing",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-10-12T13:02:33-04:00"
        },
        {
          "name": "crowdsecurity/http-admin-interface-probing",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-10-12T13:02:32-04:00"
        },
        {
          "name": "crowdsecurity/http-crawl-non_statics",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-10-12T13:02:32-04:00"
        },
        {
          "name": "crowdsecurity/http-probing",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-10-12T13:02:32-04:00"
        }
      ],
      "source": [
        "Iris"
      ],
      "confidence": {
        "score": 0.73,
        "label": "medium"
      },
      "severity": {
        "level": "critical",
        "score": 9,
        "mitre_tactics": [
          "Initial Access",
          "Reconnaissance",
          "Unknown"
        ],
        "mitre_techniques": [
          "T1190",
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "74.225.146.100",
      "first_seen": "2026-10-12T12:53:11-04:00",
      "last_seen": "2026-10-12T12:53:19-04:00",
      "scenarios": [
        {
          "name": "webshell-high-confidence",
          "category": "post-exploitation",
          "base_score": 0.95,
          "count": 1,
          "last_seen": "2026-10-12T12:53:19-04:00"
        },
        {
          "name": "webshell-probe",
          "category": "post-exploitation",
          "base_score": 0.95,
          "count": 1,
          "last_seen": "2026-10-12T12:53:18-04:00"
        },
        {
          "name": "wp-sensitive-paths",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-10-12T12:53:11-04:00"
        }
      ],
      "source": [
        "Triton"
      ],
      "confidence": {
        "score": 1.0,
        "label": "high"
      },
      "severity": {
        "level": "critical",
        "score": 9,
        "mitre_tactics": [
          "Command and Control / Persistence",
          "Initial Access"
        ],
        "mitre_techniques": [
          "T1059",
          "T1105",
          "T1190"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "34.75.233.29",
      "first_seen": "2026-10-12T11:40:48-04:00",
      "last_seen": "2026-10-12T11:40:49-04:00",
      "scenarios": [
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-10-12T11:40:49-04:00"
        },
        {
          "name": "mgmt-path-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-10-12T11:40:49-04:00"
        },
        {
          "name": "crowdsecurity/http-cve-2021-41773",
          "category": "cve-exploit",
          "base_score": 0.9,
          "count": 1,
          "last_seen": "2026-10-12T11:40:49-04:00"
        },
        {
          "name": "crowdsecurity/http-bad-user-agent",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-10-12T11:40:48-04:00"
        },
        {
          "name": "crowdsecurity/http-path-traversal-probing",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-10-12T11:40:48-04:00"
        },
        {
          "name": "crowdsecurity/http-crawl-non_statics",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-10-12T11:40:48-04:00"
        },
        {
          "name": "crowdsecurity/http-probing",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-10-12T11:40:48-04:00"
        }
      ],
      "source": [
        "Triton"
      ],
      "confidence": {
        "score": 0.71,
        "label": "medium"
      },
      "severity": {
        "level": "critical",
        "score": 9,
        "mitre_tactics": [
          "Initial Access",
          "Reconnaissance",
          "Unknown"
        ],
        "mitre_techniques": [
          "T1190",
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "35.205.88.64",
      "first_seen": "2026-10-12T11:35:51-04:00",
      "last_seen": "2026-10-12T11:35:57-04:00",
      "scenarios": [
        {
          "name": "wp-sensitive-paths",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-10-12T11:35:57-04:00"
        },
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-10-12T11:35:57-04:00"
        },
        {
          "name": "mgmt-path-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-10-12T11:35:57-04:00"
        },
        {
          "name": "crowdsecurity/http-crawl-non_statics",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-10-12T11:35:51-04:00"
        }
      ],
      "source": [
        "Triton"
      ],
      "confidence": {
        "score": 0.78,
        "label": "medium"
      },
      "severity": {
        "level": "high",
        "score": 7,
        "mitre_tactics": [
          "Initial Access",
          "Reconnaissance",
          "Unknown"
        ],
        "mitre_techniques": [
          "T1190",
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "94.154.43.164",
      "first_seen": "2026-10-12T11:21:22-04:00",
      "last_seen": "2026-10-12T11:21:22-04:00",
      "scenarios": [
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-10-12T11:21:22-04:00"
        }
      ],
      "source": [
        "Triton"
      ],
      "confidence": {
        "score": 0.6,
        "label": "low"
      },
      "severity": {
        "level": "low",
        "score": 1,
        "mitre_tactics": [
          "Reconnaissance"
        ],
        "mitre_techniques": [
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "66.132.224.249",
      "first_seen": "2026-10-12T11:15:52-04:00",
      "last_seen": "2026-10-12T11:15:52-04:00",
      "scenarios": [
        {
          "name": "crowdsecurity/http-bad-user-agent",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-10-12T11:15:52-04:00"
        }
      ],
      "source": [
        "Vault"
      ],
      "confidence": {
        "score": 0.3,
        "label": "low"
      },
      "severity": {
        "level": "low",
        "score": 1,
        "mitre_tactics": [
          "Unknown"
        ],
        "mitre_techniques": []
      },
      "scope": "fleet"
    },
    {
      "ip": "34.143.226.250",
      "first_seen": "2026-10-12T10:31:33-04:00",
      "last_seen": "2026-10-12T10:31:36-04:00",
      "scenarios": [
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-10-12T10:31:36-04:00"
        },
        {
          "name": "mgmt-path-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-10-12T10:31:35-04:00"
        },
        {
          "name": "crowdsecurity/http-admin-interface-probing",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-10-12T10:31:34-04:00"
        },
        {
          "name": "crowdsecurity/http-crawl-non_statics",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-10-12T10:31:33-04:00"
        },
        {
          "name": "crowdsecurity/http-path-traversal-probing",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-10-12T10:31:33-04:00"
        },
        {
          "name": "crowdsecurity/http-sensitive-files",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-10-12T10:31:33-04:00"
        },
        {
          "name": "crowdsecurity/http-bad-user-agent",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-10-12T10:31:33-04:00"
        },
        {
          "name": "crowdsecurity/http-probing",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-10-12T10:31:33-04:00"
        }
      ],
      "source": [
        "Iris"
      ],
      "confidence": {
        "score": 0.53,
        "label": "low"
      },
      "severity": {
        "level": "low",
        "score": 1,
        "mitre_tactics": [
          "Reconnaissance",
          "Unknown"
        ],
        "mitre_techniques": [
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "34.11.157.117",
      "first_seen": "2026-10-12T10:26:07-04:00",
      "last_seen": "2026-10-12T10:26:14-04:00",
      "scenarios": [
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-10-12T10:26:14-04:00"
        },
        {
          "name": "crowdsecurity/http-cve-2021-41773",
          "category": "cve-exploit",
          "base_score": 0.9,
          "count": 1,
          "last_seen": "2026-10-12T10:26:14-04:00"
        },
        {
          "name": "mgmt-path-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-10-12T10:26:13-04:00"
        },
        {
          "name": "crowdsecurity/http-path-traversal-probing",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-10-12T10:26:10-04:00"
        },
        {
          "name": "crowdsecurity/http-bad-user-agent",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-10-12T10:26:08-04:00"
        },
        {
          "name": "crowdsecurity/http-probing",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-10-12T10:26:08-04:00"
        },
        {
          "name": "crowdsecurity/http-crawl-non_statics",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-10-12T10:26:07-04:00"
        }
      ],
      "source": [
        "Triton"
      ],
      "confidence": {
        "score": 0.71,
        "label": "medium"
      },
      "severity": {
        "level": "critical",
        "score": 9,
        "mitre_tactics": [
          "Initial Access",
          "Reconnaissance",
          "Unknown"
        ],
        "mitre_techniques": [
          "T1190",
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "34.95.254.20",
      "first_seen": "2026-10-12T10:19:40-04:00",
      "last_seen": "2026-10-12T10:19:46-04:00",
      "scenarios": [
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-10-12T10:19:46-04:00"
        },
        {
          "name": "mgmt-path-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-10-12T10:19:46-04:00"
        },
        {
          "name": "crowdsecurity/http-cve-2021-41773",
          "category": "cve-exploit",
          "base_score": 0.9,
          "count": 1,
          "last_seen": "2026-10-12T10:19:45-04:00"
        },
        {
          "name": "crowdsecurity/http-admin-interface-probing",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-10-12T10:19:41-04:00"
        },
        {
          "name": "crowdsecurity/http-crawl-non_statics",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-10-12T10:19:40-04:00"
        },
        {
          "name": "crowdsecurity/http-sensitive-files",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-10-12T10:19:40-04:00"
        },
        {
          "name": "crowdsecurity/http-bad-user-agent",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-10-12T10:19:40-04:00"
        },
        {
          "name": "crowdsecurity/http-path-traversal-probing",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-10-12T10:19:40-04:00"
        },
        {
          "name": "crowdsecurity/http-probing",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-10-12T10:19:40-04:00"
        }
      ],
      "source": [
        "Iris"
      ],
      "confidence": {
        "score": 0.73,
        "label": "medium"
      },
      "severity": {
        "level": "critical",
        "score": 9,
        "mitre_tactics": [
          "Initial Access",
          "Reconnaissance",
          "Unknown"
        ],
        "mitre_techniques": [
          "T1190",
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "35.252.97.57",
      "first_seen": "2026-10-12T10:17:35-04:00",
      "last_seen": "2026-10-12T10:17:36-04:00",
      "scenarios": [
        {
          "name": "wp-sensitive-paths",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-10-12T10:17:36-04:00"
        },
        {
          "name": "wordpress-probe",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-10-12T10:17:35-04:00"
        }
      ],
      "source": [
        "Zephyrus"
      ],
      "confidence": {
        "score": 0.9,
        "label": "high"
      },
      "severity": {
        "level": "high",
        "score": 7,
        "mitre_tactics": [
          "Initial Access"
        ],
        "mitre_techniques": [
          "T1190"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "34.67.29.95",
      "first_seen": "2026-10-12T09:32:31-04:00",
      "last_seen": "2026-10-12T09:32:31-04:00",
      "scenarios": [
        {
          "name": "wp-sensitive-paths",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-10-12T09:32:31-04:00"
        },
        {
          "name": "wordpress-probe",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-10-12T09:32:31-04:00"
        }
      ],
      "source": [
        "Zephyrus"
      ],
      "confidence": {
        "score": 0.9,
        "label": "high"
      },
      "severity": {
        "level": "high",
        "score": 7,
        "mitre_tactics": [
          "Initial Access"
        ],
        "mitre_techniques": [
          "T1190"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "136.107.37.87",
      "first_seen": "2026-10-12T09:11:53-04:00",
      "last_seen": "2026-10-12T09:11:54-04:00",
      "scenarios": [
        {
          "name": "wp-sensitive-paths",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-10-12T09:11:54-04:00"
        },
        {
          "name": "wordpress-probe",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-10-12T09:11:53-04:00"
        }
      ],
      "source": [
        "Zephyrus"
      ],
      "confidence": {
        "score": 0.9,
        "label": "high"
      },
      "severity": {
        "level": "high",
        "score": 7,
        "mitre_tactics": [
          "Initial Access"
        ],
        "mitre_techniques": [
          "T1190"
        ]
      },
      "scope": "fleet"
    }
  ]
}