{
  "node": "argus",
  "role": "mirror",
  "generated_at": "2026-09-03T18:00:08.231787Z",
  "unique_ips": 25,
  "threats": [
    {
      "ip": "35.234.249.87",
      "first_seen": "2026-09-03T13:59:41-04:00",
      "last_seen": "2026-09-03T13:59:42-04:00",
      "scenarios": [
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-09-03T13:59:42-04:00"
        },
        {
          "name": "mgmt-path-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-09-03T13:59:42-04:00"
        },
        {
          "name": "crowdsecurity/http-probing",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-09-03T13:59:41-04:00"
        },
        {
          "name": "crowdsecurity/http-sensitive-files",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-09-03T13:59:41-04:00"
        }
      ],
      "source": [
        "Argus"
      ],
      "confidence": {
        "score": 0.54,
        "label": "low"
      },
      "severity": {
        "level": "low",
        "score": 1,
        "mitre_tactics": [
          "Reconnaissance",
          "Unknown"
        ],
        "mitre_techniques": [
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "35.188.91.58",
      "first_seen": "2026-09-03T13:55:05-04:00",
      "last_seen": "2026-09-03T13:55:06-04:00",
      "scenarios": [
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-09-03T13:55:06-04:00"
        },
        {
          "name": "mgmt-path-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-09-03T13:55:06-04:00"
        },
        {
          "name": "crowdsecurity/http-sensitive-files",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-09-03T13:55:05-04:00"
        }
      ],
      "source": [
        "Argus"
      ],
      "confidence": {
        "score": 0.58,
        "label": "low"
      },
      "severity": {
        "level": "low",
        "score": 1,
        "mitre_tactics": [
          "Reconnaissance",
          "Unknown"
        ],
        "mitre_techniques": [
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "34.64.170.139",
      "first_seen": "2026-09-03T13:48:40-04:00",
      "last_seen": "2026-09-03T13:48:41-04:00",
      "scenarios": [
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-09-03T13:48:41-04:00"
        },
        {
          "name": "mgmt-path-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-09-03T13:48:41-04:00"
        },
        {
          "name": "crowdsecurity/http-probing",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-09-03T13:48:40-04:00"
        },
        {
          "name": "crowdsecurity/http-sensitive-files",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-09-03T13:48:40-04:00"
        }
      ],
      "source": [
        "Argus"
      ],
      "confidence": {
        "score": 0.54,
        "label": "low"
      },
      "severity": {
        "level": "low",
        "score": 1,
        "mitre_tactics": [
          "Reconnaissance",
          "Unknown"
        ],
        "mitre_techniques": [
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "193.32.204.199",
      "first_seen": "2026-09-03T13:48:24-04:00",
      "last_seen": "2026-09-03T13:48:30-04:00",
      "scenarios": [
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-09-03T13:48:30-04:00"
        },
        {
          "name": "mgmt-path-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-09-03T13:48:28-04:00"
        },
        {
          "name": "crowdsecurity/http-sensitive-files",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-09-03T13:48:24-04:00"
        }
      ],
      "source": [
        "Ares"
      ],
      "confidence": {
        "score": 0.58,
        "label": "low"
      },
      "severity": {
        "level": "low",
        "score": 1,
        "mitre_tactics": [
          "Reconnaissance",
          "Unknown"
        ],
        "mitre_techniques": [
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "185.213.175.37",
      "first_seen": "2026-09-03T13:29:31-04:00",
      "last_seen": "2026-09-03T13:29:34-04:00",
      "scenarios": [
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-09-03T13:29:34-04:00"
        },
        {
          "name": "crowdsecurity/http-bad-user-agent",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-09-03T13:29:32-04:00"
        },
        {
          "name": "crowdsecurity/http-sensitive-files",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-09-03T13:29:31-04:00"
        }
      ],
      "source": [
        "Hermes"
      ],
      "confidence": {
        "score": 0.49,
        "label": "low"
      },
      "severity": {
        "level": "low",
        "score": 1,
        "mitre_tactics": [
          "Reconnaissance",
          "Unknown"
        ],
        "mitre_techniques": [
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "64.226.65.160",
      "first_seen": "2026-09-03T13:06:26-04:00",
      "last_seen": "2026-09-03T13:06:34-04:00",
      "scenarios": [
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-09-03T13:06:34-04:00"
        },
        {
          "name": "crowdsecurity/http-probing",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-09-03T13:06:26-04:00"
        }
      ],
      "source": [
        "Argus"
      ],
      "confidence": {
        "score": 0.52,
        "label": "low"
      },
      "severity": {
        "level": "low",
        "score": 1,
        "mitre_tactics": [
          "Reconnaissance",
          "Unknown"
        ],
        "mitre_techniques": [
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "45.148.10.120",
      "first_seen": "2026-09-03T13:03:20-04:00",
      "last_seen": "2026-09-03T13:03:20-04:00",
      "scenarios": [
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-09-03T13:03:20-04:00"
        }
      ],
      "source": [
        "Triton"
      ],
      "confidence": {
        "score": 0.6,
        "label": "low"
      },
      "severity": {
        "level": "low",
        "score": 1,
        "mitre_tactics": [
          "Reconnaissance"
        ],
        "mitre_techniques": [
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "195.178.110.132",
      "first_seen": "2026-09-03T13:01:05-04:00",
      "last_seen": "2026-09-03T13:01:11-04:00",
      "scenarios": [
        {
          "name": "webshell-high-confidence",
          "category": "post-exploitation",
          "base_score": 0.95,
          "count": 1,
          "last_seen": "2026-09-03T13:01:11-04:00"
        },
        {
          "name": "webshell-probe",
          "category": "post-exploitation",
          "base_score": 0.95,
          "count": 1,
          "last_seen": "2026-09-03T13:01:05-04:00"
        }
      ],
      "source": [
        "Triton"
      ],
      "confidence": {
        "score": 1.0,
        "label": "high"
      },
      "severity": {
        "level": "critical",
        "score": 9,
        "mitre_tactics": [
          "Command and Control / Persistence"
        ],
        "mitre_techniques": [
          "T1059",
          "T1105"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "144.172.93.238",
      "first_seen": "2026-09-03T12:31:19-04:00",
      "last_seen": "2026-09-03T12:31:24-04:00",
      "scenarios": [
        {
          "name": "webshell-high-confidence",
          "category": "post-exploitation",
          "base_score": 0.95,
          "count": 1,
          "last_seen": "2026-09-03T12:31:24-04:00"
        },
        {
          "name": "mgmt-path-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-09-03T12:31:23-04:00"
        },
        {
          "name": "wp-sensitive-paths",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-09-03T12:31:23-04:00"
        },
        {
          "name": "wordpress-probe",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-09-03T12:31:23-04:00"
        },
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-09-03T12:31:22-04:00"
        },
        {
          "name": "crowdsecurity/http-probing",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-09-03T12:31:19-04:00"
        },
        {
          "name": "crowdsecurity/http-sensitive-files",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-09-03T12:31:19-04:00"
        }
      ],
      "source": [
        "Ares"
      ],
      "confidence": {
        "score": 0.9,
        "label": "high"
      },
      "severity": {
        "level": "critical",
        "score": 9,
        "mitre_tactics": [
          "Command and Control / Persistence",
          "Initial Access",
          "Reconnaissance",
          "Unknown"
        ],
        "mitre_techniques": [
          "T1059",
          "T1105",
          "T1190",
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "193.47.62.167",
      "first_seen": "2026-09-03T12:12:48-04:00",
      "last_seen": "2026-09-03T12:12:48-04:00",
      "scenarios": [
        {
          "name": "wp-sensitive-paths",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-09-03T12:12:48-04:00"
        }
      ],
      "source": [
        "Argus"
      ],
      "confidence": {
        "score": 0.88,
        "label": "high"
      },
      "severity": {
        "level": "high",
        "score": 7,
        "mitre_tactics": [
          "Initial Access"
        ],
        "mitre_techniques": [
          "T1190"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "136.108.26.202",
      "first_seen": "2026-09-03T11:31:57-04:00",
      "last_seen": "2026-09-03T11:31:58-04:00",
      "scenarios": [
        {
          "name": "wp-sensitive-paths",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-09-03T11:31:58-04:00"
        },
        {
          "name": "wordpress-probe",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-09-03T11:31:58-04:00"
        },
        {
          "name": "crowdsecurity/http-probing",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-09-03T11:31:57-04:00"
        }
      ],
      "source": [
        "Iris"
      ],
      "confidence": {
        "score": 0.78,
        "label": "medium"
      },
      "severity": {
        "level": "high",
        "score": 7,
        "mitre_tactics": [
          "Initial Access",
          "Unknown"
        ],
        "mitre_techniques": [
          "T1190"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "34.74.120.252",
      "first_seen": "2026-09-03T11:27:46-04:00",
      "last_seen": "2026-09-03T11:27:46-04:00",
      "scenarios": [
        {
          "name": "wordpress-probe",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-09-03T11:27:46-04:00"
        },
        {
          "name": "wp-sensitive-paths",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-09-03T11:27:46-04:00"
        }
      ],
      "source": [
        "Zephyrus"
      ],
      "confidence": {
        "score": 0.9,
        "label": "high"
      },
      "severity": {
        "level": "high",
        "score": 7,
        "mitre_tactics": [
          "Initial Access"
        ],
        "mitre_techniques": [
          "T1190"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "93.123.109.95",
      "first_seen": "2026-09-02T20:00:27-04:00",
      "last_seen": "2026-09-03T11:06:38-04:00",
      "scenarios": [
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-09-03T11:06:38-04:00"
        },
        {
          "name": "crowdsecurity/http-sensitive-files",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-09-02T20:00:27-04:00"
        }
      ],
      "source": [
        "Argus"
      ],
      "confidence": {
        "score": 0.52,
        "label": "low"
      },
      "severity": {
        "level": "low",
        "score": 1,
        "mitre_tactics": [
          "Reconnaissance",
          "Unknown"
        ],
        "mitre_techniques": [
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "195.178.110.50",
      "first_seen": "2026-09-03T10:49:40-04:00",
      "last_seen": "2026-09-03T10:49:40-04:00",
      "scenarios": [
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-09-03T10:49:40-04:00"
        }
      ],
      "source": [
        "Triton"
      ],
      "confidence": {
        "score": 0.6,
        "label": "low"
      },
      "severity": {
        "level": "low",
        "score": 1,
        "mitre_tactics": [
          "Reconnaissance"
        ],
        "mitre_techniques": [
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "130.12.182.254",
      "first_seen": "2026-09-03T09:47:26-04:00",
      "last_seen": "2026-09-03T09:47:26-04:00",
      "scenarios": [
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-09-03T09:47:26-04:00"
        }
      ],
      "source": [
        "Argus"
      ],
      "confidence": {
        "score": 0.6,
        "label": "low"
      },
      "severity": {
        "level": "low",
        "score": 1,
        "mitre_tactics": [
          "Reconnaissance"
        ],
        "mitre_techniques": [
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "164.92.107.174",
      "first_seen": "2026-09-03T09:45:35-04:00",
      "last_seen": "2026-09-03T09:45:37-04:00",
      "scenarios": [
        {
          "name": "crowdsecurity/jira_cve-2021-26086",
          "category": "cve-exploit",
          "base_score": 0.9,
          "count": 1,
          "last_seen": "2026-09-03T09:45:37-04:00"
        },
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-09-03T09:45:35-04:00"
        }
      ],
      "source": [
        "Argus"
      ],
      "confidence": {
        "score": 0.89,
        "label": "high"
      },
      "severity": {
        "level": "critical",
        "score": 9,
        "mitre_tactics": [
          "Initial Access",
          "Reconnaissance"
        ],
        "mitre_techniques": [
          "T1190",
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "159.89.12.166",
      "first_seen": "2026-09-03T09:45:25-04:00",
      "last_seen": "2026-09-03T09:45:25-04:00",
      "scenarios": [
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-09-03T09:45:25-04:00"
        }
      ],
      "source": [
        "Argus"
      ],
      "confidence": {
        "score": 0.6,
        "label": "low"
      },
      "severity": {
        "level": "low",
        "score": 1,
        "mitre_tactics": [
          "Reconnaissance"
        ],
        "mitre_techniques": [
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "130.12.180.117",
      "first_seen": "2026-09-03T09:43:59-04:00",
      "last_seen": "2026-09-03T09:44:01-04:00",
      "scenarios": [
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-09-03T09:44:01-04:00"
        },
        {
          "name": "mgmt-path-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-09-03T09:44:01-04:00"
        },
        {
          "name": "crowdsecurity/http-sensitive-files",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-09-03T09:43:59-04:00"
        }
      ],
      "source": [
        "Argus"
      ],
      "confidence": {
        "score": 0.58,
        "label": "low"
      },
      "severity": {
        "level": "low",
        "score": 1,
        "mitre_tactics": [
          "Reconnaissance",
          "Unknown"
        ],
        "mitre_techniques": [
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "34.142.1.2",
      "first_seen": "2026-09-03T09:12:09-04:00",
      "last_seen": "2026-09-03T09:12:10-04:00",
      "scenarios": [
        {
          "name": "mgmt-path-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-09-03T09:12:10-04:00"
        },
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-09-03T09:12:10-04:00"
        },
        {
          "name": "crowdsecurity/http-probing",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-09-03T09:12:09-04:00"
        },
        {
          "name": "crowdsecurity/http-sensitive-files",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-09-03T09:12:09-04:00"
        }
      ],
      "source": [
        "Iris"
      ],
      "confidence": {
        "score": 0.54,
        "label": "low"
      },
      "severity": {
        "level": "low",
        "score": 1,
        "mitre_tactics": [
          "Reconnaissance",
          "Unknown"
        ],
        "mitre_techniques": [
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "54.39.196.7",
      "first_seen": "2026-09-03T09:11:24-04:00",
      "last_seen": "2026-09-03T09:11:24-04:00",
      "scenarios": [
        {
          "name": "wp-sensitive-paths",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-09-03T09:11:24-04:00"
        }
      ],
      "source": [
        "Iris"
      ],
      "confidence": {
        "score": 0.88,
        "label": "high"
      },
      "severity": {
        "level": "high",
        "score": 7,
        "mitre_tactics": [
          "Initial Access"
        ],
        "mitre_techniques": [
          "T1190"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "67.205.41.31",
      "first_seen": "2026-09-03T08:47:11-04:00",
      "last_seen": "2026-09-03T08:47:11-04:00",
      "scenarios": [
        {
          "name": "mgmt-path-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-09-03T08:47:11-04:00"
        },
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-09-03T08:47:11-04:00"
        }
      ],
      "source": [
        "Triton"
      ],
      "confidence": {
        "score": 0.6,
        "label": "low"
      },
      "severity": {
        "level": "low",
        "score": 1,
        "mitre_tactics": [
          "Reconnaissance"
        ],
        "mitre_techniques": [
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "44.244.15.50",
      "first_seen": "2026-09-03T08:20:11-04:00",
      "last_seen": "2026-09-03T08:20:11-04:00",
      "scenarios": [
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-09-03T08:20:11-04:00"
        }
      ],
      "source": [
        "Triton"
      ],
      "confidence": {
        "score": 0.6,
        "label": "low"
      },
      "severity": {
        "level": "low",
        "score": 1,
        "mitre_tactics": [
          "Reconnaissance"
        ],
        "mitre_techniques": [
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "34.243.225.172",
      "first_seen": "2026-09-03T07:24:59-04:00",
      "last_seen": "2026-09-03T07:24:59-04:00",
      "scenarios": [
        {
          "name": "crowdsecurity/http-probing",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-09-03T07:24:59-04:00"
        },
        {
          "name": "crowdsecurity/http-sensitive-files",
          "category": "other",
          "base_score": 0.4,
          "count": 1,
          "last_seen": "2026-09-03T07:24:59-04:00"
        },
        {
          "name": "suspicious-probe",
          "category": "reconnaissance",
          "base_score": 0.6,
          "count": 1,
          "last_seen": "2026-09-03T07:24:59-04:00"
        }
      ],
      "source": [
        "Zephyrus"
      ],
      "confidence": {
        "score": 0.49,
        "label": "low"
      },
      "severity": {
        "level": "low",
        "score": 1,
        "mitre_tactics": [
          "Reconnaissance",
          "Unknown"
        ],
        "mitre_techniques": [
          "T1595"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "34.150.232.228",
      "first_seen": "2026-09-03T07:04:50-04:00",
      "last_seen": "2026-09-03T07:04:50-04:00",
      "scenarios": [
        {
          "name": "wp-sensitive-paths",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-09-03T07:04:50-04:00"
        },
        {
          "name": "wordpress-probe",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-09-03T07:04:50-04:00"
        }
      ],
      "source": [
        "Triton"
      ],
      "confidence": {
        "score": 0.9,
        "label": "high"
      },
      "severity": {
        "level": "high",
        "score": 7,
        "mitre_tactics": [
          "Initial Access"
        ],
        "mitre_techniques": [
          "T1190"
        ]
      },
      "scope": "fleet"
    },
    {
      "ip": "178.128.248.8",
      "first_seen": "2026-09-03T07:01:31-04:00",
      "last_seen": "2026-09-03T07:01:31-04:00",
      "scenarios": [
        {
          "name": "wp-sensitive-paths",
          "category": "web-exploitation",
          "base_score": 0.85,
          "count": 1,
          "last_seen": "2026-09-03T07:01:31-04:00"
        }
      ],
      "source": [
        "Triton"
      ],
      "confidence": {
        "score": 0.88,
        "label": "high"
      },
      "severity": {
        "level": "high",
        "score": 7,
        "mitre_tactics": [
          "Initial Access"
        ],
        "mitre_techniques": [
          "T1190"
        ]
      },
      "scope": "fleet"
    }
  ]
}