Understand threats.
Stay ready to act.

The server fetches sources daily at 05:00, 13:00 and 23:00 Europe/Berlin (daylight saving time handled automatically). An open view checks every five minutes. Publication time, retrieval time and source health are treated separately. Failed sources retain their last successful data and are labelled degraded or stale. Sources without a successful fetch for 24 hours are excluded from the metrics. The native map checks the current SANS ISC top-IP list hourly. The API does not specify an observation window; the fetch time is not an event timestamp. The embedded Telekom Sicherheitstacho live map updates continuously after you start it. Its timestamp is visible in the original view; measurement, transport and processing may introduce delays.

Counts represent source reports, not individual attacks. CISA KEV records known exploitation; its entry date is not an attack timestamp. CERT-Bund and Microsoft MSRC include security advisories and updates. Microsoft reports do not confirm active exploitation; dates show the publication or revision timestamp supplied by the Microsoft feed. Attack reports and topic filters use automated keyword matching and may be incomplete or inaccurate. Multiple sources may report the same issue. A report does not establish that your company is affected. Cards add plain-language summaries, possible business consequences and suggested checks. Reviewed German CISA summaries are labelled and used only while the original description remains unchanged; other interpretation is automated by report and vulnerability type. Product names extracted from RSS titles are not complete lists of affected versions. The CVE filter uses IDs mentioned in retrieved report data, which may include related vulnerabilities. Missing CVE information does not establish that no vulnerability exists. CVSS base scores (3.x / 4.0) come from Microsoft CVRF or CVE Program records. The highest product-variant score is used; CNA ratings take precedence over ADP contributions. Versions are not directly equivalent. Scores are cached, with provider and retrieval time in details. Missing scores are unknown. The 9.x / 8.x / 7.x filters use the highest available value per report. In the wild means documented known exploitation in CISA KEV, not proof of an attack happening right now. Ratings are attributed to their source; no CVSS or customer-specific risk scores are invented. Check recommendations against current vendor guidance and your environment.

Reports are fetched on the server. Search and filters stay in your browser; sharing includes them in the link sent to recipients. The hourly statistics load their data from ITCST. The live map connects to Deutsche Telekom Security GmbH only after you click Start live map, sharing your IP address and technical browser data. Close map removes the embedded view. The optional FortiGuard link opens Fortinet’s website. No internal customer incidents are processed.