get_sightings
Field sightings: CVEs a named sensor network recorded in the last 7 or 30 days, most sighting days first. A field sighting is a day on which Shadowserver honeypots (cited by VulnCheck KEV and published as daily lists by CIRCL Vulnerability-Lookup) or VulnCheck canary sensors recorded traffic aimed at the CVE. Each row carries first and last sighting day, days sighted in the last 7 and 30, the sensors, and per-sensor detail including a 30-day presence strip. Presence per day, without volume; a sighting stays apart from the exploitation claims and from CISA KEV. Filters: window (7|30, default 7), kev (0|1), limit (1..500).
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| kev | No | Restrict to CVEs outside (0) or inside (1) CISA KEV | |
| limit | No | 1..500 (default 100) | |
| window | No | Sighting window in days (default 7) |