{"id":"43db04d6-dc47-4650-91d6-13f6f529f0a2","type":"DATASET","name":"CIRCL - Operational Statistics","slug":"circl-operational-statistics","description":"The operational statistics cover the activities related to the incident response activities of CIRCL especially in regards to the reporting (e.g. incident reports, request for analysis or support during computer security incident) and notifications (e.g. take-down notification, notification about vulnerability) from/to third parties. The statistics exclude automatic structured notifications and information exchange happening via threat intelligence platforms such as the CIRCL MISP information sharing platform or any other automatic exchange setup with partners. In this section some statistics are presented about incidents handled by CIRCL between 2011 and 2017. During this time frame the attackers evolved, forcing CIRCL to adapt its internal procedures. Although the reporting to CIRCL is not mandatory, the reporting behaviour of constituents has changed. On one hand, the reputation of CIRCL increased, thereby increasing the amount of reporting to CIRCL. On the other hand, due to the trainings such as Introduction to incident response, forensic analysis and many others offered by CIRCL, have helped local organisations build up their own incident response capacities thereby reducing the number of reported incidents. This makes comparing the statistics of successive years challenging. Tickets are no indicators for the overall workload as there are some tickets that are very resource intensive whereas others are quickly solved. Nevertheless, the workload for the overall triage of the tickets is increasing and showing an increase in diversity when it comes to attacker practices.","free_access_class":"FREE_NO_AUTH","auth_type":"NONE","homepage_url":null,"docs_url":null,"repo_url":"https://www.circl.lu/assets/images/statistics/data.json","status":"ACTIVE","verification_state":"VERIFIED","tags":["crime-justice","digital"],"logo_url":"https://www.google.com/s2/favicons?sz=64&domain=circl.lu","primary_source_url":"https://www.circl.lu/assets/images/statistics/data.json","extraction_confidence":"0.16","created_at":"2026-06-24T18:56:17.350Z","updated_at":"2026-10-12T20:48:45.766Z","last_verified_at":"2026-10-12T20:46:39.102Z","deprecated_at":null,"ranking_score":36,"last_ranked_at":"2026-10-10T19:50:04.442Z","last_seen_at":null,"last_validated_at":null,"last_uptime_at":"2026-10-10T09:15:15.372Z","search_vector":"'-2017':298B,655B '2011':92B,297B,449B,654B '2017':94B,451B 'a':656B 'about':401B,443B 'activ':9B,15B,250B 'activities':366B,372B 'activity':607B 'adapt':105B,462B 'although':109B,466B 'amount':135B,492B 'an':583B,700B 'analysi':29B,155B,258B 'analysis':386B,512B,615B 'and':393B,412B,450B,513B,581B,618B,662B,668B,679B 'any':429B 'are':441B,547B,556B,560B,566B,644B,697B 'as':421B,506B,554B,609B,699B 'attack':100B,234B,303B 'attacker':591B,660B 'attackers':457B 'automat':52B,74B,273B 'automatic':409B,431B,630B 'behaviour':119B,304B,476B,661B 'between':448B 'build':166B,523B 'built':326B,683B 'by':446B,517B 'capac':172B,331B 'capacities':529B 'capacity':688B 'case':353B,710B 'center':244B,601B 'challeng':188B 'challenging':545B 'chang':123B 'changed':480B 'circl':1A,17B,66B,90B,103B,113B,130B,139B,161B,239B,282B,306B,318B,358A,374B,423B,447B,460B,470B,487B,496B,518B,596B,639B,663B,675B 'come':232B 'comes':589B 'compar':182B 'comparing':539B 'comparison':337B 'comparisons':694B 'complic':332B 'complicating':689B 'comput':33B,241B 'computer':390B,598B 'constitu':121B,312B 'constituent':669B 'constituents':478B 'count':339B 'counts':696B 'cover':7B,246B,364B 'covering':603B 'crime':355C 'crime-justic':354C 'dataset':290B,647B 'digit':357C 'divers':229B 'diversity':586B 'down':398B,622B 'due':144B,316B,501B,673B 'during':389B,452B,658B 'e.g':24B,38B,381B,395B 'especi':18B 'especially':375B 'evolv':101B,310B 'evolved':458B,667B 'exchang':57B,75B,269B,275B 'exchange':414B,432B 'exchanged':626B 'exchanges':632B 'exclud':51B,288B 'exclude':408B 'excluded':645B 'for':385B,550B,572B,614B,653B 'forc':102B 'forcing':459B 'forens':154B 'forensic':511B 'frame':98B,455B 'from':595B 'from/to':46B,403B 'given':348B,705B 'grow':320B 'growing':677B 'hand':126B,143B,483B,500B 'handl':88B,294B 'handled':445B 'handling':651B 'happen':58B 'happening':415B 'has':479B 'have':519B 'help':163B 'helped':520B 'imperfect':344B,701B 'in':376B,436B,585B 'incid':13B,25B,35B,87B,152B,170B,179B,242B,248B,254B,293B,329B 'incident':370B,382B,392B,509B,527B,599B,605B,611B,650B,686B 'incident-handl':292B 'incident-handling':649B 'incident-respons':247B,328B 'incident-response':604B,685B 'incidents':444B,536B 'includ':281B 'including':638B 'increas':131B,133B,223B,227B 'increase':584B 'increased':488B 'increasing':490B,580B 'indic':192B 'indicators':549B 'inform':56B,68B 'information':413B,425B 'intellig':61B,279B 'intelligence':418B,636B 'intens':206B,351B 'intensity':708B 'intensive':563B 'intern':107B,308B 'internal':464B,665B 'introduct':150B 'introduction':507B 'is':471B,579B 'it':588B 'its':463B 'justic':356C 'local':164B,327B,521B,684B 'luxembourg':245B,602B 'make':181B 'makes':538B 'mandatori':116B 'mandatory':473B 'mani':157B 'many':514B 'measur':345B 'measure':702B 'misp':67B,284B,424B,641B 'nevertheless':212B,569B 'no':548B 'not':472B 'note':341B 'noted':698B 'notic':268B 'notices':625B 'notif':37B,42B,43B,54B,262B 'notification':399B,400B 'notifications':394B,411B,619B 'number':176B,533B 'of':373B,477B,486B,493B,534B,542B,576B,703B 'offer':159B 'offered':516B 'on':481B,497B,692B 'one':125B,482B 'oper':2A,5B,236B 'operational':359A,362B,593B 'or':387B,428B,616B,623B 'organis':165B 'organisations':522B 'other':158B,208B,430B,499B 'others':515B,565B 'overal':195B,217B 'overall':552B,574B 'own':526B 'parti':48B,272B 'parties':405B,629B 'partner':78B 'partners':435B 'pattern':314B 'patterns':671B 'per':352B,709B 'period':300B,657B 'platform':62B,70B,280B,286B,427B,643B 'platforms':419B,637B 'practic':235B 'practices':592B 'present':85B,291B 'presented':442B 'presents':648B 'procedur':108B,309B 'procedures':465B,666B 'programm':324B 'programmes':681B 'quick':210B 'quickly':567B 'reduc':174B 'reducing':531B 'regard':20B 'regards':377B 'relat':10B 'related':367B 'report':23B,26B,111B,118B,137B,178B,253B,255B,313B 'reported':535B 'reporting':380B,468B,475B,494B,610B,670B 'reports':383B,612B 'reput':128B,321B 'reputation':485B,678B 'request':27B,256B,384B 'requests':613B 'resourc':205B,350B 'resource':562B,707B 'respons':14B,153B,171B,243B,249B,330B 'response':371B,510B,528B,600B,606B,687B 's':640B,664B,676B 'section':81B,438B 'secur':34B 'security':391B 'setup':76B,433B 'share':69B,285B 'sharing':426B,642B 'shift':315B 'shifted':672B 'show':225B 'showing':582B 'solv':211B 'solved':568B 'some':439B,557B 'statist':3A,6B,50B,83B,184B,237B,295B 'statistics':360A,363B,407B,440B,541B,594B,652B 'structur':53B,274B 'structured':410B,631B 'success':186B 'successive':543B 'such':420B,505B,608B 'support':31B,260B,388B,617B 'take':40B,264B,397B,621B 'take-down':39B,263B,396B,620B 'that':559B,682B 'the':361B,365B,369B,379B,406B,422B,456B,467B,474B,484B,491B,498B,503B,532B,540B,551B,570B,573B,577B,597B,646B 'their':525B 'there':555B 'therebi':132B,173B 'thereby':489B,530B 'third':47B,271B,404B,628B 'this':437B,453B,537B 'threat':60B,278B,417B,635B 'threat-intellig':277B 'threat-intelligence':634B 'ticket':189B,201B,221B,338B,695B 'tickets':546B,558B,578B 'time':97B,454B 'to':368B,378B,461B,469B,495B,502B,508B,590B,674B 'train':147B,323B 'training':680B 'trainings':504B 'triag':218B 'triage':575B 'up':524B 'vari':349B 'varying':706B 'very':561B 'via':59B,276B,416B,633B 'vulner':45B,267B 'vulnerability':402B,624B 'when':587B 'wherea':207B 'whereas':564B 'which':659B 'with':434B,627B 'workload':196B,214B,347B,553B,571B,704B 'year':187B,334B,336B,691B,693B 'year-on-year':333B,690B 'years':544B","popularity_score":"0.0000","maintenance_score":"0.5000","institution_id":null,"institution_type":null,"country_code":"LU","official_confidence":null,"proof_summary":null,"source_seed_url":null,"is_public_sector":true,"published_at":"2026-06-24T18:56:17.350Z","geographic_scope":"NATIONAL","name_en":null,"description_en":"Operational statistics from CIRCL, the Computer Incident Response Center Luxembourg, covering incident-response activity such as reporting (incident reports, requests for analysis or support) and notifications (take-down or vulnerability notices) exchanged with third parties. Automatic structured exchanges via threat-intelligence platforms, including CIRCL's MISP sharing platform, are excluded. The dataset presents incident-handling statistics for 2011-2017, a period during which attacker behaviour and CIRCL's internal procedures evolved, and constituent reporting patterns shifted due to CIRCL's growing reputation and training programmes that built local incident-response capacity, complicating year-on-year comparisons. Ticket counts are noted as an imperfect measure of workload given varying resource intensity per case.}}}}}}}}}}}}}}}}}}","native_lang":"en","access_level":"direct","formats":["JSON"],"capability_tier":"sample","trust_score":36.44230769230769,"merged_into_entry_id":null,"identity_key":"DATASET|https://www.circl.lu/assets/images/statistics/data.json|circl - operational statistics","upstream_ref":null,"content_changed_at":null,"title_qualifier":null,"access":{"level":"direct","primary":{"kind":"download","label":"Download JSON","method":"GET","url":"https://www.circl.lu/assets/images/statistics/data.json","format":"JSON","source":"distribution","runnable":true},"actions":[{"kind":"download","label":"Download JSON","method":"GET","url":"https://www.circl.lu/assets/images/statistics/data.json","format":"JSON","source":"distribution","runnable":true}],"formats":["JSON"]},"maturity":{"entry_id":"43db04d6-dc47-4650-91d6-13f6f529f0a2","granularity":"entry","granularity_label":"One unit = one catalog entry. A PROXY for the SCOPE.md §4 ladder, which governs source families, not entries: a family with 400 entries moves this reading 400 times as much as a family with one. Never compare or combine with the source_family reading.","level":"profiled","level_index":3,"level_label":"Profiled","meaning":"Schema, dimensions and licence understood","counts_as_coverage":false,"blocked_by":null,"rungs":[{"level":"discovered","level_index":1,"label":"Discovered","meaning":"Source and metadata recorded","evidence":"membership of the named population the ladder is taken over","counts_as_coverage":false,"met":true,"reached":true,"criterion":"TRUE"},{"level":"verified","level_index":2,"label":"Verified","meaning":"Access tested successfully","evidence":"entries.verification_state = 'VERIFIED'","counts_as_coverage":false,"met":true,"reached":true,"criterion":"entries.verification_state = 'VERIFIED'"},{"level":"profiled","level_index":3,"label":"Profiled","meaning":"Schema, dimensions and licence understood","evidence":"a data profile with at least one field (entry_data_profiles.field_count > 0)","counts_as_coverage":false,"met":true,"reached":true,"criterion":"EXISTS (SELECT 1 FROM entry_data_profiles p WHERE p.entry_id = entries.id AND COALESCE(p.field_count, 0) > 0)"},{"level":"executable","level_index":4,"label":"Executable","meaning":"Queries run through Commodity","evidence":"entries.capability_tier = 'live' — today's proxy for \"queryable through us\"","counts_as_coverage":true,"met":false,"reached":false,"criterion":"entries.capability_tier = 'live'"},{"level":"joinable","level_index":5,"label":"Joinable","meaning":"Canonical identifiers and concepts mapped","evidence":"a field link to a canonical identifier whose sampled VALUES match its format","counts_as_coverage":true,"met":false,"reached":false,"criterion":"EXISTS (SELECT 1 FROM entry_field_links efl WHERE efl.entry_id = entries.id AND efl.identifier_id IS NOT NULL AND efl.value_status = 'match')"},{"level":"reproducible","level_index":6,"label":"Reproducible","meaning":"Snapshots and transformation evidence retained","evidence":"at least one retained evidence manifest (migration 078)","counts_as_coverage":true,"met":false,"reached":false,"criterion":"EXISTS (SELECT 1 FROM evidence_manifests em WHERE em.entry_id = entries.id)"},{"level":"guaranteed","level_index":7,"label":"Guaranteed","meaning":"Monitored against an operational reliability target","evidence":"an active reliability target with a named monitor (migration 096)","counts_as_coverage":true,"met":false,"reached":false,"criterion":"EXISTS (SELECT 1 FROM entry_reliability_targets rt WHERE rt.entry_id = entries.id AND rt.is_active = true)"}],"officialness":{"basis":"catalog_inherited","label":"Inherited from the upstream catalog: this item came from a trusted official government catalog, and that provenance — not per-item proof — is the warrant. Its own proof score is below 80 or it matched no registered institution (apps/worker/src/connectors/catalog/qualify-store.ts).","proof_confidence":null,"proven_threshold":80,"institution_id":null,"definition":"CASE WHEN COALESCE(entries.is_public_sector, false) IS NOT TRUE THEN 'not_official' WHEN COALESCE(entries.official_confidence, 0) >= 80 AND entries.institution_id IS NOT NULL THEN 'per_item_proven' ELSE 'catalog_inherited' END"},"source_family":{"key":"www.circl.lu","label":"One unit = one source family, approximated by the serving host of the entry's primary source URL (e.g. bdl.stat.gov.pl). A COMPUTED stand-in for the curated families of SCOPE.md §5, which no table holds yet. A family sits at the highest level any of its entries has reached, because a family is integrated to the depth of its deepest working integration. Never compare or combine with the entry reading."},"generated_at":"2026-10-12T22:48:43.617Z"},"api_details":null,"dataset_details":{"id":"467f09d0-b220-46c2-b5d9-088c16579385","entry_id":"43db04d6-dc47-4650-91d6-13f6f529f0a2","upstream_issued":"2018-01-04T16:45:26.344Z","upstream_modified":null,"themes":["TECH","JUST"],"update_frequency":null,"temporal_start":null,"temporal_end":null,"spatial_coverage":null,"landing_page":null,"license_id":null,"license_raw":null,"has_documentation":false,"has_data_dictionary":false,"has_versioning":false,"source_portal":null,"source_portal_url":null,"created_at":"2026-06-24T18:56:17.515Z","updated_at":"2026-10-07T04:31:11.296Z","publisher":"Computer Incident Response Center Luxembourg","publisher_url":null,"distributions":[{"id":"2a28f1ff-53e1-4af8-bf7f-e5d2455b8c97","dataset_details_id":"467f09d0-b220-46c2-b5d9-088c16579385","title":"CIRCL operational statistics","description":null,"access_url":"https://www.circl.lu/assets/images/statistics/data.json","download_url":null,"media_type":null,"format":null,"byte_size":null,"license_id":null,"license_raw":null,"last_checked_at":"2026-10-12T20:46:37.736Z","is_available":true,"last_http_status":200,"created_at":"2026-06-24T18:56:17.831Z","updated_at":"2026-10-12T20:46:37.736Z"}],"license":null},"license":null,"reuse":{"license_id":null,"license_name":null,"license_url":null,"commercial_use":{"status":"unknown","value":null},"redistribution":{"status":"unknown","value":null},"attribution_required":{"status":"unknown","value":null},"share_alike":{"status":"unknown","value":null},"personal_data_warning":{"status":"unknown","value":null},"cache_and_mirror":{"status":"unknown","value":null},"undetermined":["commercial_use","redistribution","attribution_required","share_alike","personal_data_warning","cache_and_mirror"],"basis":"unverified","confidence":0.1,"confidence_tier":"low","source_text":null,"source_url":null,"reviewed_at":null},"license_raw":null,"latest_check":{"id":"5967fd68-6afd-479c-85c2-b69b9a3e93c1","entry_id":"43db04d6-dc47-4650-91d6-13f6f529f0a2","status":"VERIFIED","last_checked_at":"2026-10-12T20:46:38.891Z","p50_latency_ms":2167,"p95_latency_ms":null,"last_error":null,"consecutive_failures":0,"created_at":"2026-06-24T18:57:36.356Z","updated_at":"2026-10-12T20:46:38.891Z","consecutive_successes":42,"probe_url":"https://www.circl.lu/assets/images/statistics/data.json","probe_method":"GET","probe_http_status":200,"probe_content_type":"application/json","probe_succeeded_at":"2026-10-12T20:46:38.891Z"},"data_profile":{"id":"4e36c294-dd32-4a46-9507-e036e69a0535","entry_id":"43db04d6-dc47-4650-91d6-13f6f529f0a2","profile_source":"distribution","profile_kind":"dataset","dataset_id":null,"fields":[{"name":"ticketNum","type":"text","label":null,"description":null,"description_en":"Unique identifier of the incident report ticket."},{"name":"action","type":"text","label":null,"description":null,"description_en":"Coded action or status type applied to the ticket."},{"name":"comment","type":"text","label":null,"description":null,"description_en":"Free-text note or label describing the ticket action."},{"name":"date","type":"datetime","label":null,"description":null,"description_en":"Timestamp when the ticket action was recorded."}],"field_count":4,"sample_records":[{"date":"2010-11-02 07:58:22","action":"2","comment":"COMMUNENET","ticketNum":"32dbfc2863fb0b731abbcfb5c7ac5e7f"},{"date":"2010-11-02 07:58:23","action":"1","comment":"open","ticketNum":"32dbfc2863fb0b731abbcfb5c7ac5e7f"},{"date":"2010-11-02 09:09:06","action":"2","comment":"COMMUNENET","ticketNum":"af255610b344e1151cb25987e84e9e79"},{"date":"2010-11-02 09:09:08","action":"4","comment":"open","ticketNum":"af255610b344e1151cb25987e84e9e79"},{"date":"2010-11-02 09:22:04","action":"1","comment":"open","ticketNum":"c83bc835a0e4b37a08a400d8118c7c4f"}],"record_count":null,"data_size_bytes":"7605847","dataset_count":null,"query_examples":[{"url":"https://www.circl.lu/assets/images/statistics/data.json","curl":"curl -sL 'https://www.circl.lu/assets/images/statistics/data.json' -o data.json","label":"Download distribution","method":"GET","description":"Full json file download — the schema shown was inferred from the file's first records."},{"url":"https://www.circl.lu/assets/images/statistics/data.json","curl":"curl -sL 'https://www.circl.lu/assets/images/statistics/data.json' -H 'Range: bytes=0-4095'","label":"Preview first bytes","method":"GET","description":"First 4 KB of the file (servers honoring Range requests)."}],"status":"ok","error_message":null,"profiled_at":"2026-10-07T04:31:11.100Z","run_id":"9d151e6d-748f-472f-a226-63f3b3ead831","created_at":"2026-06-24T20:03:12.187Z","updated_at":"2026-10-07T04:31:11.100Z","license_raw":null,"license_id":null,"consecutive_failure_count":0,"last_error_at":null,"last_error_message":null,"previewable":true,"personal_data":{"status":"none","basis":"no_person_column_cited","grain":"none","allowed":true,"columns":{"direct_identifiers":[],"family_names":[],"given_names":[],"attributes":[],"unresolved_names":[],"measures":[],"entity_identifiers":[]},"publication":null,"publication_evidence":null,"notice":"personal data: no cited column names a natural person (the cited columns are all this reads)"}},"datasets":[],"limits":[],"manifest":{"answer_sha256":"6b4027221b864fd217b2b9ea3d64c5a8b1346034d6f089da729a0d8de3a375cb","answer_sha256_rule":"sha256 (hex, UTF-8) of JSON.stringify(this body) after deleting the keys listed in manifest.stamped_keys from manifest, and deleting manifest itself if it is then empty. The hash was computed before the stamp existed, so no field of the stamp is inside it.","stamped_keys":["answer_sha256","answer_sha256_rule","stamped_keys","row_count","row_count_basis","live","live_basis","created_at","created_at_basis","durable_citation"],"row_count":20,"row_count_basis":"Objects that are elements of a JSON array anywhere in this body, excluding manifest. Not a claim about which collection is the answer. Largest single collection: maturity.rungs[] (7 rows).","live":true,"live_basis":"This body was produced by executing the request.","created_at":"2026-10-12T22:48:43.639Z","created_at_basis":"When this response body was assembled, deliberately OUTSIDE the hashed bytes so the same answer hashes identically on every request. Not the upstream read time — that is provenance[].retrieved_at. A zone-cached replay carries the assembly time, not your receipt time.","durable_citation":"This manifest is produced at response time and is NOT stored. A durable, replayable citation is persisted only on an explicit cite: GET /api/v1/entries/{id-or-slug}/evidence, or the MCP cite_query tool. Both are entry-scoped, because evidence_manifests is entry-shaped; a domain answer spanning several sources has no single entry and cannot be persisted through that path."}}