Open data
Data guide
Everything you need to pull the tracker into your own tooling: what each feed contains, what the fields mean, how fresh it is, and how to use the indicators safely.
Base URL for every file
https://raw.githubusercontent.com/sohankanna/india-threat-tracker/main/data/Vulnerability feed updated
20 Oct 2026, 1:22 pm IST
Campaign and actor sources last checked
20 Oct 2026
Feeds
Every JSON feed is an object with feed, generated_at and items, validated against its schema on every change. New fields are only ever added; existing fields keep their meaning.
- watchlist.json (opens in a new tab)KEV entries that are India-relevant (high or medium) and added in the last 24 months or ransomware-linked495 records · Twice daily
- exploited-cve.json (opens in a new tab)Every CISA KEV entry, with EPSS and an India-relevance tier1748 records · Twice daily
- smishing-apk.json (opens in a new tab)Fake-APK and smishing campaigns7 records · As reporting appears
- apt-campaigns.json (opens in a new tab)State-nexus actors targeting India4 records · As reporting appears
- iocs.csv (opens in a new tab)Defanged campaign indicators with provenance per row (also iocs.txt)7 records · With campaign changes
- assessment.json (opens in a new tab)The monthly ranked analyst assessmentMonthly
- relevance-overrides.json (opens in a new tab)Hand-reviewed India-relevance decisions the pipeline applies and never overwritesWhen reviewed
Field reference
| Field | Meaning |
|---|---|
| cve, vendor, product, name, description | From the CISA KEV catalog. |
| date_added | When CISA added the entry to KEV (YYYY-MM-DD). |
| due_date | CISA’s remediation deadline for US federal agencies. Most are already past; a reference, not your deadline. |
| required_action | CISA’s required action, verbatim. |
| known_ransomware | true when CISA lists known ransomware use. |
| epss | FIRST EPSS probability of exploitation in the next 30 days, 0–1. null means no score, never a low score. |
| epss_percentile | How that score ranks among all scored CVEs, 0–1. |
| epss_date | The FIRST model date the score was taken from. |
| india_relevance | high, medium or global. See the labels below. |
| relevance_match | The keyword that set the tier (for example fortinet), or manual review. |
| _manual_relevance, relevance_reason | Present when the tier was set by an editorial override, with the reason. |
| watchlist | Whether the entry meets the watchlist rule. |
| Field | Meaning |
|---|---|
| status | active, law-enforcement or historical. Describes the reporting, never whether infrastructure is live. |
| attribution | Who the source attributes the activity to, as reported. |
| confidence | The tracker’s rating of the evidence: high, medium or low. |
| first_seen | When the activity was first reported (YYYY or YYYY-MM where that is all that is known). |
| last_verified | When a person last checked the cited source. |
| attack | MITRE ATT&CK techniques mapped by the tracker from the reported behaviour, checked against MITRE’s data. |
| key_findings, recommended_actions | Drawn from the cited sources. |
| iocs | Indicators for investigation: domains, urls, sha256, package_names, telegram_bots. Defanged. |
| infrastructure | Context only: abused platforms, hosting providers, C2 technology. Never block these. |
| Field | Meaning |
|---|---|
| indicator | The defanged indicator. |
| type | domains, urls, sha256, package_names or telegram_bots. |
| campaign_id, campaign | The campaign it was reported in (see smishing-apk.json). |
| confidence | The tracker’s rating of that campaign’s evidence. |
| source, source_url | The report the indicator comes from. |
| source_checked | When a person last checked that report. |
| status | Always “as reported; not re-validated; last seen not tracked”. |
apt-campaigns.json follows the same pattern, with reported attribution (suspected_origin, attribution_note, mitre_group) kept separate from the tracker’s confidence. Full definitions are in the JSON schemas(opens in a new tab).
Labels
- India relevance
- A transparent keyword rule over vendor and product. High for internet-facing edge, VPN, identity and enterprise-server products Indian organisations run; medium for ubiquitous software that is not an India-specific signal; global for everything else. Triage, not proof you are exposed. Editors can override a tier; the pipeline never overwrites that decision.
- Watchlist
- Relevance high or medium, and added to KEV in the last 24 months or ransomware-linked.
- Status
- Describes the public reporting, never whether infrastructure is live.
active(Ongoing): Still appearing in recent public reporting. It does not mean every listed indicator or server is live.law-enforcement(Police action): Known mainly from an arrest or seizure. That network was disrupted; allegations are not yet proven in court, and the wider scam ecosystem continues.historical(Historical): No new reporting in the last 12 months. Kept for reference and detection engineering.
- Confidence
- The tracker’s rating of the evidence, shown separately from any attribution.
high: Corroborated by named primary research or a concrete, verifiable event.medium: Credible single-source reporting, not independently corroborated here.low: Plausible but thin. Tracked and flagged as such.
- Timestamps
generated_atis when a feed was rebuilt;last_verifiedis when a person checked the source; indicator last-seen is not tracked, so nothing here implies an indicator is still active.
Using indicators safely
Use the exports, not the raw campaign JSON. iocs.csv and iocs.txt contain indicators only. Infrastructure context (GitHub, Firebase, hosting providers) is excluded, and CI fails if it ever leaks in.
Indicators are defanged. example[.]com and hxxps:// are deliberate. Re-fang only for a blocklist you control, and on purpose.
They are as reported, not re-validated. A listed domain may since have been taken down or re-registered. Alert on indicators before you block them.
Check freshness first. If generated_at in watchlist.json is more than 36 hours old, the update job may have failed. Treat the data as stale.
Keep the provenance. Keep the campaign, source, confidence and source_checked columns when you import, so an analyst can see why an indicator is there.
Examples
curl + jq: high-relevance watchlist entries with EPSS of 50% or more
curl -s https://raw.githubusercontent.com/sohankanna/india-threat-tracker/main/data/watchlist.json \
| jq '.items[] | select(.india_relevance=="high" and .epss!=null and .epss>=0.5)
| {cve, vendor, product, epss, epss_date}'Python: the tested example client (standard library only)
python examples/consume_feeds.py health python examples/consume_feeds.py watchlist --relevance high --min-epss 0.5 python examples/consume_feeds.py iocs --type sha256
PowerShell
$raw = "https://raw.githubusercontent.com/sohankanna/india-threat-tracker/main/data"
(Invoke-RestMethod "$raw/watchlist.json").items |
Where-Object { $_.india_relevance -eq "high" -and $_.known_ransomware } |
Select-Object cve, vendor, product, epss, due_date
Invoke-RestMethod "$raw/iocs.csv" | ConvertFrom-Csv | Where-Object type -eq "sha256"Splunk: save iocs.csv as a lookup table file, then
| inputlookup india_tracker_iocs.csv | table indicator type campaign confidence source_checked
The same guide lives in the repository as DATA-GUIDE.md(opens in a new tab); scoring rules are in the methodology(opens in a new tab). Data is CC BY 4.0: use it, and credit Sohan Kanna.