{
  "attack": [
    {
      "events": 1749355,
      "ips": 3033,
      "name": "Brute Force",
      "technique": "T1110"
    },
    {
      "events": 74062,
      "ips": 2002,
      "name": "Exploit Public-Facing Application",
      "technique": "T1190"
    },
    {
      "events": 59633,
      "ips": 738,
      "name": "VNC",
      "technique": "T1021.005"
    },
    {
      "events": 15198,
      "ips": 487,
      "name": "Active Scanning",
      "technique": "T1595"
    },
    {
      "events": 5814,
      "ips": 444,
      "name": "Network Service Discovery",
      "technique": "T1046"
    },
    {
      "events": 422,
      "ips": 398,
      "name": "Exploitation of Remote Services",
      "technique": "T1210"
    },
    {
      "events": 0,
      "ips": 395,
      "name": "Remote Desktop Protocol",
      "technique": "T1021.001"
    },
    {
      "events": 31,
      "ips": 362,
      "name": "Valid Accounts",
      "technique": "T1078"
    },
    {
      "events": 0,
      "ips": 331,
      "name": "Email Collection",
      "technique": "T1114"
    },
    {
      "events": 2553,
      "ips": 331,
      "name": "Vulnerability Scanning",
      "technique": "T1595.002"
    },
    {
      "events": 92,
      "ips": 193,
      "name": "Mail Protocols",
      "technique": "T1071.003"
    },
    {
      "events": 0,
      "ips": 193,
      "name": "Data Destruction",
      "technique": "T1485"
    },
    {
      "events": 0,
      "ips": 193,
      "name": "Data Encrypted for Impact",
      "technique": "T1486"
    },
    {
      "events": 114,
      "ips": 111,
      "name": "Forced Authentication",
      "technique": "T1187"
    },
    {
      "events": 234,
      "ips": 106,
      "name": "Reflection Amplification",
      "technique": "T1498.002"
    },
    {
      "events": 96878,
      "ips": 97,
      "name": "Financial Theft",
      "technique": "T1657"
    },
    {
      "events": 0,
      "ips": 91,
      "name": "Modify Parameter",
      "technique": "T0836"
    },
    {
      "events": 233,
      "ips": 91,
      "name": "Remote System Discovery",
      "technique": "T0846"
    },
    {
      "events": 4,
      "ips": 91,
      "name": "Unauthorized Command Message",
      "technique": "T0855"
    },
    {
      "events": 0,
      "ips": 85,
      "name": "SMB/Windows Admin Shares",
      "technique": "T1021.002"
    },
    {
      "events": 37,
      "ips": 80,
      "name": "Network Sniffing",
      "technique": "T1040"
    },
    {
      "events": 644,
      "ips": 70,
      "name": "Command and Scripting Interpreter",
      "technique": "T1059"
    },
    {
      "events": 0,
      "ips": 48,
      "name": "Software",
      "technique": "T1592.002"
    },
    {
      "events": 0,
      "ips": 44,
      "name": "Unix Shell",
      "technique": "T1059.004"
    },
    {
      "events": 0,
      "ips": 40,
      "name": "Remote System Information Discovery",
      "technique": "T0888"
    },
    {
      "events": 202,
      "ips": 36,
      "name": "Credentials In Files",
      "technique": "T1552.001"
    },
    {
      "events": 1782,
      "ips": 20,
      "name": "Unsecured Credentials",
      "technique": "T1552"
    },
    {
      "events": 0,
      "ips": 18,
      "name": "Phishing",
      "technique": "T1566"
    },
    {
      "events": 127,
      "ips": 17,
      "name": "Ingress Tool Transfer",
      "technique": "T1105"
    },
    {
      "events": 115,
      "ips": 12,
      "name": "Gather Victim Host Information",
      "technique": "T1592"
    },
    {
      "events": 24,
      "ips": 4,
      "name": "Proxy",
      "technique": "T1090"
    },
    {
      "events": 0,
      "ips": 4,
      "name": "External Remote Services",
      "technique": "T1133"
    },
    {
      "events": 0,
      "ips": 4,
      "name": "Protocol Tunneling",
      "technique": "T1572"
    },
    {
      "events": 0,
      "ips": 2,
      "name": "Point & Tag Identification",
      "technique": "T0861"
    },
    {
      "events": 0,
      "ips": 2,
      "name": "Exploitation for Credential Access",
      "technique": "T1212"
    },
    {
      "events": 7,
      "ips": 2,
      "name": "Server Software Component",
      "technique": "T1505"
    },
    {
      "events": 16,
      "ips": 2,
      "name": "Web Shell",
      "technique": "T1505.003"
    },
    {
      "events": 0,
      "ips": 1,
      "name": "Manipulation of Control",
      "technique": "T0831"
    },
    {
      "events": 0,
      "ips": 1,
      "name": "File and Directory Discovery",
      "technique": "T1083"
    },
    {
      "events": 0,
      "ips": 1,
      "name": "SSH Authorized Keys",
      "technique": "T1098.004"
    },
    {
      "events": 7,
      "ips": 1,
      "name": "Email Addresses",
      "technique": "T1589.002"
    }
  ],
  "countries": [
    {
      "country": "US",
      "ips": 1229
    },
    {
      "country": "BR",
      "ips": 300
    },
    {
      "country": "DE",
      "ips": 183
    },
    {
      "country": "CN",
      "ips": 172
    },
    {
      "country": "SG",
      "ips": 164
    },
    {
      "country": "IR",
      "ips": 154
    },
    {
      "country": "BE",
      "ips": 83
    },
    {
      "country": "NL",
      "ips": 83
    },
    {
      "country": "GB",
      "ips": 70
    },
    {
      "country": "JP",
      "ips": 63
    },
    {
      "country": "KR",
      "ips": 62
    },
    {
      "country": "RU",
      "ips": 41
    },
    {
      "country": "HK",
      "ips": 35
    },
    {
      "country": "VN",
      "ips": 33
    },
    {
      "country": "BG",
      "ips": 31
    },
    {
      "country": "ZA",
      "ips": 30
    },
    {
      "country": "IN",
      "ips": 24
    },
    {
      "country": "FI",
      "ips": 22
    },
    {
      "country": "UA",
      "ips": 21
    },
    {
      "country": "FR",
      "ips": 20
    }
  ],
  "observed": {
    "asns": 747,
    "countries": 102,
    "credential_pairs": 128261,
    "cves": 9,
    "events": 2067948,
    "hashes": 0,
    "ips": 8250,
    "urls": 3
  },
  "published": {
    "active_24h": 1566,
    "anonymizers": 0,
    "asns": 393,
    "countries": 74,
    "cves": 17,
    "fingerprints": 146,
    "hashes": 2,
    "ips": 3115,
    "ips_30d": 10369,
    "scanners": 3736,
    "urls": 2
  },
  "services": [
    {
      "ips": 1875,
      "service": "http"
    },
    {
      "ips": 738,
      "service": "vnc"
    },
    {
      "ips": 395,
      "service": "rdp"
    },
    {
      "ips": 245,
      "service": "mysql"
    },
    {
      "ips": 224,
      "service": "postgres"
    },
    {
      "ips": 194,
      "service": "mongodb"
    },
    {
      "ips": 193,
      "service": "smtp"
    },
    {
      "ips": 186,
      "service": "ftp"
    },
    {
      "ips": 160,
      "service": "redis"
    },
    {
      "ips": 148,
      "service": "imap"
    },
    {
      "ips": 132,
      "service": "mssql"
    },
    {
      "ips": 120,
      "service": "sip"
    },
    {
      "ips": 114,
      "service": "smb"
    },
    {
      "ips": 109,
      "service": "pop3"
    },
    {
      "ips": 91,
      "service": "modbus"
    },
    {
      "ips": 86,
      "service": "rsync"
    },
    {
      "ips": 83,
      "service": "ssh"
    },
    {
      "ips": 80,
      "service": "memcached"
    },
    {
      "ips": 80,
      "service": "mqtt"
    },
    {
      "ips": 37,
      "service": "telnet"
    },
    {
      "ips": 30,
      "service": "ntp"
    },
    {
      "ips": 22,
      "service": "snmp"
    },
    {
      "ips": 14,
      "service": "tftp"
    }
  ]
}