{
  "cisa-kev": {
    "publisher": "CISA",
    "url": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",
    "adapter_type": "kev",
    "enabled": true,
    "rights": "CC0 1.0; third-party linked material retains its own terms",
    "collection": {
      "last_attempt": "2026-10-22T18:57:47+00:00",
      "last_success": "2026-10-22T18:57:47+00:00",
      "state": "ok",
      "input_count": 1754,
      "source_digest": "ef8fffede5c472001da046c7751beb2a3242458896d0ce08da52b30968b8b56b"
    }
  },
  "cert-cc": {
    "publisher": "CERT/CC",
    "url": "https://www.kb.cert.org/vuls/atomfeed/",
    "adapter_type": "atom",
    "enabled": false,
    "rights": "Endpoint verified. Automated ingestion disabled pending appropriate reuse permission; SEI terms restrict reformatting.",
    "collection": {
      "state": "disabled-rights-review",
      "last_attempt": "2026-10-22T18:57:47+00:00"
    }
  },
  "ms-volt": {
    "publisher": "Microsoft Threat Intelligence",
    "url": "https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/",
    "adapter_type": "article",
    "enabled": true,
    "rights": "Copyright Microsoft; source link and original editorial annotation only.",
    "collection": {
      "last_attempt": "2026-10-22T18:57:47+00:00",
      "last_success": "2026-10-22T18:57:47+00:00",
      "state": "ok",
      "input_count": 1,
      "source_digest": "5330424e70e518584db2bc875b557e17a24b6e8dd7912e541a76f0fc62fa70df"
    }
  },
  "ms-destructive": {
    "publisher": "Microsoft Security",
    "url": "https://www.microsoft.com/en-us/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/",
    "adapter_type": "article",
    "enabled": true,
    "rights": "Copyright Microsoft; source link and original editorial annotation only.",
    "collection": {
      "last_attempt": "2026-10-22T18:57:47+00:00",
      "last_success": "2026-10-22T18:57:47+00:00",
      "state": "ok",
      "input_count": 1,
      "source_digest": "c3dd977fa5cfc5830204bdf255dc7d26217ed6000a8aa84ef02ae0c527bc710d"
    }
  },
  "ms-human-operated-ransomware-2020": {
    "publisher": "Microsoft Security",
    "url": "https://www.microsoft.com/en-us/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/",
    "adapter_type": "reviewed-article",
    "enabled": true,
    "rights": "Original editorial annotation and brief evidence reference only; full publisher article is not redistributed.",
    "collection": {
      "last_attempt": "2026-10-22T19:50:55+00:00",
      "last_success": "2026-10-22T19:50:55+00:00",
      "state": "ok",
      "input_count": 1,
      "source_digest": "39341fccf4f9caf0ef555d7245597bee37ebbdb038719c5ba031521777a2b3cc"
    }
  },
  "ms-storm-2949-cloud-breach-2026": {
    "publisher": "Microsoft Defender Security Research Team",
    "url": "https://www.microsoft.com/en-us/security/blog/2026/05/18/storm-2949-turned-compromised-identity-into-cloud-wide-breach/",
    "adapter_type": "reviewed-article",
    "enabled": true,
    "rights": "Original editorial annotation and brief evidence reference only; full publisher article is not redistributed.",
    "collection": {
      "last_attempt": "2026-10-22T19:50:55+00:00",
      "last_success": "2026-10-22T19:50:55+00:00",
      "state": "ok",
      "input_count": 1,
      "source_digest": "45ca7f6de9f52211272274943041456f86a5153b34759c194cc469ef6145dcf1"
    }
  },
  "eset-industroyer2-caddywiper-2022": {
    "publisher": "ESET Research / WeLiveSecurity",
    "url": "https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/",
    "adapter_type": "reviewed-article",
    "enabled": true,
    "rights": "Original editorial annotation and brief evidence reference only; full publisher article is not redistributed.",
    "collection": {
      "last_attempt": "2026-10-22T19:51:52+00:00",
      "last_success": "2026-10-22T19:51:52+00:00",
      "state": "ok",
      "input_count": 1,
      "source_digest": "4a945d9759d7c49667f12522f43c458d40507c79ff79d0c877293a4a9d9b5eb2"
    }
  },
  "mandiant-russian-targeting-log-gaps-2021": {
    "publisher": "Mandiant / Google Cloud",
    "url": "https://cloud.google.com/blog/topics/threat-intelligence/russian-targeting-gov-business",
    "adapter_type": "reviewed-article",
    "enabled": true,
    "rights": "Original editorial annotation and brief evidence reference only; full publisher article is not redistributed.",
    "collection": {
      "last_attempt": "2026-10-22T19:50:55+00:00",
      "last_success": "2026-10-22T19:50:55+00:00",
      "state": "ok",
      "input_count": 1,
      "source_digest": "74dd45a169d97fc25b625a3c2bfa5507ee43323f1f6b22b1d40e277f551e634b"
    }
  },
  "mandiant-unc3886-esxi-logging-2023": {
    "publisher": "Mandiant / Google Cloud",
    "url": "https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass",
    "adapter_type": "reviewed-article",
    "enabled": true,
    "rights": "Original editorial annotation and brief evidence reference only; full publisher article is not redistributed.",
    "collection": {
      "last_attempt": "2026-10-22T19:50:55+00:00",
      "last_success": "2026-10-22T19:50:55+00:00",
      "state": "ok",
      "input_count": 1,
      "source_digest": "cc0abb4e2b66552b30ff9d9bcf2539d0a0ed3074cad1f95140747204ad5b30ff"
    }
  },
  "ms-security-rss": {
    "publisher": "Microsoft Security Blog",
    "url": "https://www.microsoft.com/en-us/security/blog/feed/",
    "adapter_type": "rss",
    "enabled": true,
    "rights": "Original publisher RSS used for candidate discovery. No full articles are republished; publication requires exact-source review and an original annotation.",
    "collection": {
      "last_attempt": "2026-10-22T20:09:08+00:00",
      "last_success": "2026-10-22T20:09:08+00:00",
      "state": "ok",
      "input_count": 10,
      "source_digest": "5624c0fcc3d9b4ee5553ad4033266880fc26ffbd2fc112df92a0acadde513782"
    }
  }
}