{
  "day": "2026-10-22",
  "files": [
    {
      "bytes": 529,
      "consumers": [],
      "count": 1,
      "format": "text",
      "path": "LICENSE-DATA",
      "sha256": "59e8a385fef775ac2440ca2910d7dc2cee67d1d25f8cf3586f1795d0cb714830",
      "window": null
    },
    {
      "bytes": 247,
      "consumers": [
        "feeds.offseq.com",
        "atom"
      ],
      "count": 1,
      "format": "json",
      "path": "history.json",
      "sha256": "d80eeb4d816c9954633703c228c254b39a60a7e1e5e2db9a1048de3ebaa77f7a",
      "window": "90d"
    },
    {
      "bytes": 0,
      "consumers": [
        "siem",
        "enrichment"
      ],
      "count": 0,
      "format": "txt",
      "path": "latest/anonymizers-7d.txt",
      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
      "window": "7d"
    },
    {
      "bytes": 503234,
      "consumers": [
        "splunk",
        "sentinel",
        "elastic"
      ],
      "count": 3115,
      "format": "csv",
      "path": "latest/attackers-7d.csv",
      "sha256": "2052725055ad7037c385b76c34472b3f1565b195e31d5d4cadc2fe3cd89e7592",
      "window": "7d"
    },
    {
      "bytes": 503234,
      "consumers": [
        "opencti"
      ],
      "count": 3115,
      "format": "csv",
      "path": "latest/attackers-ipv4-7d.csv",
      "sha256": "2052725055ad7037c385b76c34472b3f1565b195e31d5d4cadc2fe3cd89e7592",
      "window": "7d"
    },
    {
      "bytes": 109773,
      "consumers": [
        "crowdsec"
      ],
      "count": 3115,
      "format": "crowdsec-csv",
      "path": "latest/crowdsec/mirage-7d.csv",
      "sha256": "8ccf1c2c6f081edba7b3d9516135b8be741de0ae3a91ce23fe0c0df8157722a9",
      "window": "7d"
    },
    {
      "bytes": 1261,
      "consumers": [
        "siem",
        "vuln-mgmt"
      ],
      "count": 17,
      "format": "csv",
      "path": "latest/cves-7d.csv",
      "sha256": "2ab43af2ab16b035f012e9b4528d5052a8717ece64c7459334c18dbfe704485c",
      "window": "7d"
    },
    {
      "bytes": 125773,
      "consumers": [
        "defender-for-endpoint"
      ],
      "count": 500,
      "format": "defender-csv",
      "path": "latest/defender/defender-top500.csv",
      "sha256": "3a681d9c724aa470c8545e7d51579af1fd18b4bc1a278b9e0b5822912f104de5",
      "window": "7d"
    },
    {
      "bytes": 0,
      "consumers": [
        "dns-rpz",
        "edl",
        "siem"
      ],
      "count": 0,
      "format": "txt",
      "path": "latest/domains-7d.txt",
      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
      "window": "7d"
    },
    {
      "bytes": 9671,
      "consumers": [
        "ja4plus",
        "zeek",
        "suricata"
      ],
      "count": 142,
      "format": "csv",
      "path": "latest/fingerprints.csv",
      "sha256": "fe58088a171801217afb53812cecb6e16d29f43c24e86111227ce1ff2aee0dd5",
      "window": null
    },
    {
      "bytes": 130,
      "consumers": [
        "edr",
        "siem"
      ],
      "count": 2,
      "format": "txt",
      "path": "latest/hashes-sha256-30d.txt",
      "sha256": "633eea5a94b3c1010abfc2ef2160910c212b7b801f2dd0f99257d3aa9e4ac1e9",
      "window": "30d"
    },
    {
      "bytes": 253,
      "consumers": [
        "zeek",
        "siem"
      ],
      "count": 4,
      "format": "csv",
      "path": "latest/hassh.csv",
      "sha256": "857cf63f15785cf6c4d2b2ff9b59e2ea31850b5f67239800781571c4fe35fd0d",
      "window": null
    },
    {
      "bytes": 94589,
      "consumers": [
        "ipset",
        "iptables"
      ],
      "count": 3115,
      "format": "ipset-restore",
      "path": "latest/ipset/mirage.ipset",
      "sha256": "f806663dd7a7a7d7c5138a0a674275d1eba166924f35d9bf151ad19e1f11dc1b",
      "window": "7d"
    },
    {
      "bytes": 22299,
      "consumers": [
        "pfsense",
        "opnsense",
        "fortigate",
        "palo-alto",
        "crowdsec",
        "ipset"
      ],
      "count": 1566,
      "format": "txt",
      "path": "latest/ipv4-1d.txt",
      "sha256": "d44c6e87e1709e7ea34778481476002b514a6bfd82b93036150d77a35f5e7775",
      "window": "1d"
    },
    {
      "bytes": 147589,
      "consumers": [
        "pfsense",
        "opnsense",
        "fortigate",
        "palo-alto",
        "crowdsec",
        "ipset"
      ],
      "count": 10369,
      "format": "txt",
      "path": "latest/ipv4-30d.txt",
      "sha256": "2e5e115100224293937991dc0471769346215f16c81887a61281752309fda444",
      "window": "30d"
    },
    {
      "bytes": 53674,
      "consumers": [
        "aws-waf"
      ],
      "count": 3115,
      "format": "txt",
      "path": "latest/ipv4-7d-cidr32.txt",
      "sha256": "926fa00d03c7436f5b2310c3a2f8fbf1e274cb9713164bd4fa7ea8ebad017c3f",
      "window": "7d"
    },
    {
      "bytes": 44329,
      "consumers": [
        "pfsense",
        "opnsense",
        "fortigate",
        "palo-alto",
        "crowdsec",
        "ipset"
      ],
      "count": 3115,
      "format": "txt",
      "path": "latest/ipv4-7d.txt",
      "sha256": "ce7a68e97f3c7101696375093281c86ec400e0aaf04b43959a5a5a5422bbd973",
      "window": "7d"
    },
    {
      "bytes": 0,
      "consumers": [
        "siem",
        "change-review"
      ],
      "count": 0,
      "format": "txt",
      "path": "latest/ipv4-added-1d.txt",
      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
      "window": "1d"
    },
    {
      "bytes": 0,
      "consumers": [
        "siem",
        "change-review"
      ],
      "count": 0,
      "format": "txt",
      "path": "latest/ipv4-removed-1d.txt",
      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
      "window": "1d"
    },
    {
      "bytes": 44329,
      "consumers": [
        "pfsense",
        "opnsense",
        "fortigate",
        "palo-alto",
        "crowdsec",
        "ipset"
      ],
      "count": 3115,
      "format": "txt",
      "path": "latest/ipv4-top10k.txt",
      "sha256": "ce7a68e97f3c7101696375093281c86ec400e0aaf04b43959a5a5a5422bbd973",
      "window": "7d"
    },
    {
      "bytes": 14078,
      "consumers": [
        "pfsense",
        "opnsense",
        "fortigate",
        "palo-alto",
        "crowdsec",
        "ipset"
      ],
      "count": 1000,
      "format": "txt",
      "path": "latest/ipv4-top1k.txt",
      "sha256": "58d2a3443a6a2953d3b3c152af4b0ae0af4ba0bbf7d16644dea298c472cc3c08",
      "window": "7d"
    },
    {
      "bytes": 0,
      "consumers": [
        "pfsense",
        "opnsense",
        "fortigate",
        "palo-alto",
        "crowdsec",
        "ipset"
      ],
      "count": 0,
      "format": "txt",
      "path": "latest/ipv6-7d.txt",
      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
      "window": "7d"
    },
    {
      "bytes": 53583,
      "consumers": [
        "allowlist"
      ],
      "count": 3719,
      "format": "txt",
      "path": "latest/known-scanners-ipv4.txt",
      "sha256": "f6c41aff63f4d1f51f740de97f34fb76ac1e99cd55d110e85beda97248341e40",
      "window": null
    },
    {
      "bytes": 333,
      "consumers": [
        "allowlist"
      ],
      "count": 17,
      "format": "txt",
      "path": "latest/known-scanners-ipv6.txt",
      "sha256": "6a0d9c7813417bc592b621625f172f2c6107e5ee78ffe33e5c3030bd5f4b1e0f",
      "window": null
    },
    {
      "bytes": 487432,
      "consumers": [
        "mikrotik"
      ],
      "count": 3115,
      "format": "routeros-script",
      "path": "latest/mikrotik/mirage-7d.rsc",
      "sha256": "4f559e4e397fa76bd8729cb0761b4edfcf8fcf019d85ed30fe652c82719923b1",
      "window": "7d"
    },
    {
      "bytes": 48146,
      "consumers": [
        "nftables"
      ],
      "count": 3115,
      "format": "nftables",
      "path": "latest/nft/mirage.nft",
      "sha256": "325c7060e10a82377af2c6e8e851769854997e8e1868101b239a604fc122d3fa",
      "window": "7d"
    },
    {
      "bytes": 1044,
      "consumers": [
        "password-policy"
      ],
      "count": 100,
      "format": "txt",
      "path": "latest/passwords-top100.txt",
      "sha256": "b525cd1335fbea8dde6f5c0fb8a4b4807f16afc1a0586646c5c0000382d010c7",
      "window": null
    },
    {
      "bytes": 9772,
      "consumers": [
        "hunting"
      ],
      "count": 442,
      "format": "txt",
      "path": "latest/paths-7d.txt",
      "sha256": "b034b8f221e076a1e8330f77f83bd0b6325a19c608fc5a3cdd39059e07d5756a",
      "window": "7d"
    },
    {
      "bytes": 80391,
      "consumers": [
        "elastic",
        "splunk",
        "jq"
      ],
      "count": 3119,
      "format": "ndjson+gzip",
      "path": "latest/records-7d.ndjson.gz",
      "sha256": "2adb512d540541d9281219a05a03070c3841dabfda3f58799f03c26339f946db",
      "window": "7d"
    },
    {
      "bytes": 7215607,
      "consumers": [
        "opencti",
        "sentinel",
        "misp",
        "taxii-import"
      ],
      "count": 13419,
      "format": "stix-2.1",
      "path": "latest/stix/mirage.json",
      "sha256": "62ea4626cecc674e618cd9c222cc762a018e805cd3f7ff42e3be3602cb780371",
      "window": "7d"
    },
    {
      "bytes": 42,
      "consumers": [
        "suricata"
      ],
      "count": 1,
      "format": "suricata-iprep-categories",
      "path": "latest/suricata/categories.txt",
      "sha256": "11f6626ca9d306bb8d1a6c49cb4c2749dbe1451ea5070dcc44a0904189177202",
      "window": null
    },
    {
      "bytes": 44329,
      "consumers": [
        "suricata"
      ],
      "count": 3115,
      "format": "suricata-dataset",
      "path": "latest/suricata/datasets/ips.lst",
      "sha256": "ce7a68e97f3c7101696375093281c86ec400e0aaf04b43959a5a5a5422bbd973",
      "window": "7d"
    },
    {
      "bytes": 3487,
      "consumers": [
        "suricata"
      ],
      "count": 51,
      "format": "suricata-dataset",
      "path": "latest/suricata/datasets/paths.lst",
      "sha256": "68fd54d09291d84e5c1ac144c386562d19f303d4b0206558725cf2cff5ce4a7b",
      "window": "7d"
    },
    {
      "bytes": 130,
      "consumers": [
        "suricata"
      ],
      "count": 2,
      "format": "suricata-dataset",
      "path": "latest/suricata/datasets/sha256.lst",
      "sha256": "633eea5a94b3c1010abfc2ef2160910c212b7b801f2dd0f99257d3aa9e4ac1e9",
      "window": "30d"
    },
    {
      "bytes": 141,
      "consumers": [
        "suricata"
      ],
      "count": 5,
      "format": "suricata-dataset",
      "path": "latest/suricata/datasets/uas.lst",
      "sha256": "ca49dd4439683805896deac786a811662539be807635d2850de512f48c69be15",
      "window": "7d"
    },
    {
      "bytes": 59911,
      "consumers": [
        "suricata"
      ],
      "count": 3115,
      "format": "suricata-iprep",
      "path": "latest/suricata/mirage-iprep.list",
      "sha256": "f0591aa562ecb5628b36a08a0fca1a160435addbe3ec09d37292b0f8d88f6e72",
      "window": "7d"
    },
    {
      "bytes": 942,
      "consumers": [
        "suricata"
      ],
      "count": 4,
      "format": "suricata-rules",
      "path": "latest/suricata/mirage.rules",
      "sha256": "121af2714861f95ea1749cf357d90f88dbe01a7b8c4cdef59c37047f2a331cfe",
      "window": null
    },
    {
      "bytes": 54,
      "consumers": [
        "proxy",
        "edl",
        "siem"
      ],
      "count": 2,
      "format": "txt",
      "path": "latest/urls-7d.txt",
      "sha256": "6f215e06e8883e5a14d9ab4efa2e7b2d11ddc0cbfb93b9152e03a615b8bad13a",
      "window": "7d"
    },
    {
      "bytes": 103,
      "consumers": [
        "hunting"
      ],
      "count": 5,
      "format": "txt",
      "path": "latest/user-agents-7d.txt",
      "sha256": "a1b1846fe23a55d5673130d222fc6838f63666cf860ba5dffe18978aaec6d251",
      "window": "7d"
    },
    {
      "bytes": 307060,
      "consumers": [
        "zeek"
      ],
      "count": 3124,
      "format": "zeek-intel",
      "path": "latest/zeek/mirage.intel",
      "sha256": "a6a66c06eda28e41ea4cd54494ed35b48f8000bcea76fc0d59cefd7b9539839f",
      "window": "7d"
    },
    {
      "bytes": 719881,
      "consumers": [
        "misp"
      ],
      "count": 3145,
      "format": "misp-event",
      "path": "misp/187f5eda-df4c-5b15-b9b4-6766498e604d.json",
      "sha256": "9f3fec403db1d49f56927084184e56be99ee787aaa545169d3d772f1c3fe4170",
      "window": "7d"
    },
    {
      "bytes": 220150,
      "consumers": [
        "misp"
      ],
      "count": 3145,
      "format": "misp-hashes",
      "path": "misp/hashes.csv",
      "sha256": "e4a3a973fdabc9495674be4664f8a8d90982249c78ad1aee776045a71d8073a8",
      "window": null
    },
    {
      "bytes": 293,
      "consumers": [
        "misp"
      ],
      "count": 1,
      "format": "misp-manifest",
      "path": "misp/manifest.json",
      "sha256": "6fcd718268a5fcaeed673d9aa36fb8e8a9d29d8808fdcee8c8d6e3eb0f8f4978",
      "window": null
    },
    {
      "bytes": 45643,
      "consumers": [
        "social"
      ],
      "count": 1,
      "format": "png",
      "path": "og-github.png",
      "sha256": "3a42663f9dd924bb803fa31f23a5ea5b5fb839c6131f7d0b1be08fb230012ba4",
      "window": null
    },
    {
      "bytes": 45305,
      "consumers": [
        "social"
      ],
      "count": 1,
      "format": "png",
      "path": "og.png",
      "sha256": "b60bac69b1a061cc0e4665ff20c51adebf8803212800d57a2d697a69518c8b15",
      "window": null
    },
    {
      "bytes": 2969,
      "consumers": [
        "jsonschema"
      ],
      "count": 1,
      "format": "json-schema",
      "path": "schema/record.schema.json",
      "sha256": "91b242ca601420a2f0bc02fe446511c28ae2f557ee89e7672056d10fb7531c09",
      "window": null
    },
    {
      "bytes": 7583,
      "consumers": [
        "feeds.offseq.com"
      ],
      "count": 1,
      "format": "json",
      "path": "stats.json",
      "sha256": "53168a798e79795c3e135bc0dc49a301b0e599b7663344651087aab6842c6c02",
      "window": null
    }
  ],
  "generated": "2026-10-23T20:18:52Z",
  "license": {
    "code": "MIT",
    "data": "CC-BY-4.0"
  },
  "mirrors": [
    "https://feeds.offseq.com/mirage-feed/",
    "https://raw.githubusercontent.com/offseq/mirage-feed/data/"
  ],
  "name": "mirage-feed",
  "policy": {
    "delay_hours": 24,
    "ipv6_prefix": 64,
    "min_networks": 2,
    "min_sensors": 3,
    "ttl_days": 7
  },
  "publisher": "OffSeq",
  "schema_version": "1.1",
  "stats": {
    "attack": [
      {
        "events": 1749355,
        "ips": 3033,
        "name": "Brute Force",
        "technique": "T1110"
      },
      {
        "events": 74062,
        "ips": 2002,
        "name": "Exploit Public-Facing Application",
        "technique": "T1190"
      },
      {
        "events": 59633,
        "ips": 738,
        "name": "VNC",
        "technique": "T1021.005"
      },
      {
        "events": 15198,
        "ips": 487,
        "name": "Active Scanning",
        "technique": "T1595"
      },
      {
        "events": 5814,
        "ips": 444,
        "name": "Network Service Discovery",
        "technique": "T1046"
      },
      {
        "events": 422,
        "ips": 398,
        "name": "Exploitation of Remote Services",
        "technique": "T1210"
      },
      {
        "events": 0,
        "ips": 395,
        "name": "Remote Desktop Protocol",
        "technique": "T1021.001"
      },
      {
        "events": 31,
        "ips": 362,
        "name": "Valid Accounts",
        "technique": "T1078"
      },
      {
        "events": 0,
        "ips": 331,
        "name": "Email Collection",
        "technique": "T1114"
      },
      {
        "events": 2553,
        "ips": 331,
        "name": "Vulnerability Scanning",
        "technique": "T1595.002"
      },
      {
        "events": 92,
        "ips": 193,
        "name": "Mail Protocols",
        "technique": "T1071.003"
      },
      {
        "events": 0,
        "ips": 193,
        "name": "Data Destruction",
        "technique": "T1485"
      },
      {
        "events": 0,
        "ips": 193,
        "name": "Data Encrypted for Impact",
        "technique": "T1486"
      },
      {
        "events": 114,
        "ips": 111,
        "name": "Forced Authentication",
        "technique": "T1187"
      },
      {
        "events": 234,
        "ips": 106,
        "name": "Reflection Amplification",
        "technique": "T1498.002"
      },
      {
        "events": 96878,
        "ips": 97,
        "name": "Financial Theft",
        "technique": "T1657"
      },
      {
        "events": 0,
        "ips": 91,
        "name": "Modify Parameter",
        "technique": "T0836"
      },
      {
        "events": 233,
        "ips": 91,
        "name": "Remote System Discovery",
        "technique": "T0846"
      },
      {
        "events": 4,
        "ips": 91,
        "name": "Unauthorized Command Message",
        "technique": "T0855"
      },
      {
        "events": 0,
        "ips": 85,
        "name": "SMB/Windows Admin Shares",
        "technique": "T1021.002"
      },
      {
        "events": 37,
        "ips": 80,
        "name": "Network Sniffing",
        "technique": "T1040"
      },
      {
        "events": 644,
        "ips": 70,
        "name": "Command and Scripting Interpreter",
        "technique": "T1059"
      },
      {
        "events": 0,
        "ips": 48,
        "name": "Software",
        "technique": "T1592.002"
      },
      {
        "events": 0,
        "ips": 44,
        "name": "Unix Shell",
        "technique": "T1059.004"
      },
      {
        "events": 0,
        "ips": 40,
        "name": "Remote System Information Discovery",
        "technique": "T0888"
      },
      {
        "events": 202,
        "ips": 36,
        "name": "Credentials In Files",
        "technique": "T1552.001"
      },
      {
        "events": 1782,
        "ips": 20,
        "name": "Unsecured Credentials",
        "technique": "T1552"
      },
      {
        "events": 0,
        "ips": 18,
        "name": "Phishing",
        "technique": "T1566"
      },
      {
        "events": 127,
        "ips": 17,
        "name": "Ingress Tool Transfer",
        "technique": "T1105"
      },
      {
        "events": 115,
        "ips": 12,
        "name": "Gather Victim Host Information",
        "technique": "T1592"
      },
      {
        "events": 24,
        "ips": 4,
        "name": "Proxy",
        "technique": "T1090"
      },
      {
        "events": 0,
        "ips": 4,
        "name": "External Remote Services",
        "technique": "T1133"
      },
      {
        "events": 0,
        "ips": 4,
        "name": "Protocol Tunneling",
        "technique": "T1572"
      },
      {
        "events": 0,
        "ips": 2,
        "name": "Point & Tag Identification",
        "technique": "T0861"
      },
      {
        "events": 0,
        "ips": 2,
        "name": "Exploitation for Credential Access",
        "technique": "T1212"
      },
      {
        "events": 7,
        "ips": 2,
        "name": "Server Software Component",
        "technique": "T1505"
      },
      {
        "events": 16,
        "ips": 2,
        "name": "Web Shell",
        "technique": "T1505.003"
      },
      {
        "events": 0,
        "ips": 1,
        "name": "Manipulation of Control",
        "technique": "T0831"
      },
      {
        "events": 0,
        "ips": 1,
        "name": "File and Directory Discovery",
        "technique": "T1083"
      },
      {
        "events": 0,
        "ips": 1,
        "name": "SSH Authorized Keys",
        "technique": "T1098.004"
      },
      {
        "events": 7,
        "ips": 1,
        "name": "Email Addresses",
        "technique": "T1589.002"
      }
    ],
    "countries": [
      {
        "country": "US",
        "ips": 1229
      },
      {
        "country": "BR",
        "ips": 300
      },
      {
        "country": "DE",
        "ips": 183
      },
      {
        "country": "CN",
        "ips": 172
      },
      {
        "country": "SG",
        "ips": 164
      },
      {
        "country": "IR",
        "ips": 154
      },
      {
        "country": "BE",
        "ips": 83
      },
      {
        "country": "NL",
        "ips": 83
      },
      {
        "country": "GB",
        "ips": 70
      },
      {
        "country": "JP",
        "ips": 63
      },
      {
        "country": "KR",
        "ips": 62
      },
      {
        "country": "RU",
        "ips": 41
      },
      {
        "country": "HK",
        "ips": 35
      },
      {
        "country": "VN",
        "ips": 33
      },
      {
        "country": "BG",
        "ips": 31
      },
      {
        "country": "ZA",
        "ips": 30
      },
      {
        "country": "IN",
        "ips": 24
      },
      {
        "country": "FI",
        "ips": 22
      },
      {
        "country": "UA",
        "ips": 21
      },
      {
        "country": "FR",
        "ips": 20
      }
    ],
    "observed": {
      "asns": 747,
      "countries": 102,
      "credential_pairs": 128261,
      "cves": 9,
      "events": 2067948,
      "hashes": 0,
      "ips": 8250,
      "urls": 3
    },
    "published": {
      "active_24h": 1566,
      "anonymizers": 0,
      "asns": 393,
      "countries": 74,
      "cves": 17,
      "fingerprints": 146,
      "hashes": 2,
      "ips": 3115,
      "ips_30d": 10369,
      "scanners": 3736,
      "urls": 2
    },
    "services": [
      {
        "ips": 1875,
        "service": "http"
      },
      {
        "ips": 738,
        "service": "vnc"
      },
      {
        "ips": 395,
        "service": "rdp"
      },
      {
        "ips": 245,
        "service": "mysql"
      },
      {
        "ips": 224,
        "service": "postgres"
      },
      {
        "ips": 194,
        "service": "mongodb"
      },
      {
        "ips": 193,
        "service": "smtp"
      },
      {
        "ips": 186,
        "service": "ftp"
      },
      {
        "ips": 160,
        "service": "redis"
      },
      {
        "ips": 148,
        "service": "imap"
      },
      {
        "ips": 132,
        "service": "mssql"
      },
      {
        "ips": 120,
        "service": "sip"
      },
      {
        "ips": 114,
        "service": "smb"
      },
      {
        "ips": 109,
        "service": "pop3"
      },
      {
        "ips": 91,
        "service": "modbus"
      },
      {
        "ips": 86,
        "service": "rsync"
      },
      {
        "ips": 83,
        "service": "ssh"
      },
      {
        "ips": 80,
        "service": "memcached"
      },
      {
        "ips": 80,
        "service": "mqtt"
      },
      {
        "ips": 37,
        "service": "telnet"
      },
      {
        "ips": 30,
        "service": "ntp"
      },
      {
        "ips": 22,
        "service": "snmp"
      },
      {
        "ips": 14,
        "service": "tftp"
      }
    ]
  },
  "tlp": "TLP:CLEAR"
}