Datasets you can query right now
Public feeds on vulnerabilities, threats and world events, kept as tables in Opteryx. Look at any of them live with no sign-in, then query them with SQL in Studio for free.
Security
Security datasets
Vulnerability and threat-intelligence feeds — NVD, CISA KEV, EPSS, Exploit-DB and MITRE ATT&CK, CWE and CAPEC — plus views that join them.
- NVD vulnerabilities (CVEs)Every CVE published in the US National Vulnerability Database: severity, CVSS v3 and v4 scores and vectors, the affected vendor and product, weakness (CWE) IDs and references.demo.security.nvd_vulnerabilities
- CISA Known Exploited Vulnerabilities (KEV)The US Cybersecurity and Infrastructure Security Agency's catalog of vulnerabilities known to be exploited in the wild, with the date each was added, the remediation due date and whether it has been used in ransomware campaigns.demo.security.cisa_kev
- EPSS exploit prediction scoresThe Exploit Prediction Scoring System's daily estimate, for each CVE, of the probability it will be exploited in the next 30 days, with its percentile against all scored CVEs.demo.security.epss
- Exploit-DB public exploitsThe Exploit Database's archive of public exploits and proof-of-concept code: what each targets, its type and platform, when it was published, whether it is verified, and the CVEs it covers.demo.security.exploit_db
- MITRE ATT&CK objectsThe MITRE ATT&CK knowledge base flattened to one row per object — tactics, techniques and sub-techniques, threat groups, software, campaigns and mitigations — with names, platforms, aliases and links.demo.security.attack_objects
- CAPEC attack patternsMITRE's Common Attack Pattern Enumeration and Classification: the known ways attackers exploit weaknesses, with each pattern's abstraction level, likelihood of attack and typical severity.demo.security.capec_patterns
- CWE software weaknessesMITRE's Common Weakness Enumeration: the catalog of software and hardware weakness types that CVEs are classified against, with abstraction level, status and likelihood of exploit.demo.security.cwe_weaknesses
- CVE risk signalsOne row per CVE joining its NVD record with EPSS, the CISA KEV catalog and Exploit-DB: CVSS and EPSS scores, whether and when it entered KEV, ransomware use, the first public exploit, and how long each took after publication.demo.security.cve_risk_signals
- Exploited vulnerabilities with CVSSThe CVEs in the CISA KEV catalog, with their NVD publication date, CVSS score and CVSS vector.demo.security.exploited_vulnerabilities
- Weaknesses by vendor and yearCVE counts by vendor, weakness (CWE) and year of publication, with how many of those CVEs are known to be exploited.demo.security.vendor_weaknesses
- Vulnerabilities per weekEvery CVE with the week it was published, its vendor and its CVSS score — shaped for counting and charting disclosure volume over time.demo.security.vulnerabilities_per_week
- CAPEC patterns to ATT&CK techniquesLinks from CAPEC attack patterns to the MITRE ATT&CK techniques they map to, including mappings inherited from a parent pattern (capec_hops counts how far up the mapping came from).demo.security.pattern_techniques
- ATT&CK techniques by threat groupWhich MITRE ATT&CK threat groups are known to use which techniques, with group aliases and links, and whether the link came through a sub-technique.demo.security.technique_groups
- CWE weaknesses to CAPEC patternsLinks from CWE weaknesses to the CAPEC attack patterns that exploit them, including links inherited from a parent weakness (cwe_hops), with each pattern's likelihood and severity.demo.security.weakness_patterns
- Security knowledge graph edgesThe relationships between ATT&CK, CWE and CAPEC objects as one edge list — source, relation, destination — ready for graph queries and traversal.demo.security.security_graph_edges
Geopolitics
Geopolitics datasets
Daily roll-ups of the GDELT event stream, and a reference table of the world's countries.
- Countries of the worldA reference table of countries and territories: ISO 3166 codes, common and official names, capital, region and subregion, area, borders, top-level domain, coordinates and flag.demo.geopolitics.countries
- GDELT events by country, dailyDaily totals from the GDELT event stream by the country where events took place: number of events, the articles reporting them, and summed tone. Country codes are FIPS 10-4 (UK is the United Kingdom, CH is China).demo.geopolitics.gdelt_daily_country
- GDELT events by initiating country, dailyDaily GDELT event totals by the country of the actor who initiated each event (Actor1): events, articles and summed tone. Country codes are CAMEO three-letter codes such as USA and GBR.demo.geopolitics.gdelt_daily_actor1
- GDELT events by target country, dailyDaily GDELT event totals by the country of the actor on the receiving end of each event (Actor2): events, articles and summed tone. Country codes are CAMEO three-letter codes such as USA and GBR.demo.geopolitics.gdelt_daily_actor2
- GDELT events between pairs of countries, dailyDaily GDELT event totals for each pair of countries — the initiating actor's and the target's — with summed Goldstein scale (how cooperative or conflictual) and tone.demo.geopolitics.gdelt_daily_actor_pair
- GDELT events by cooperation and conflict, dailyDaily GDELT event totals by CAMEO quad class — 1 verbal cooperation, 2 material cooperation, 3 verbal conflict, 4 material conflict — with articles and summed Goldstein scale.demo.geopolitics.gdelt_daily_quad_class
- GDELT events by type, dailyDaily GDELT event totals by CAMEO root event code — the top-level kind of event, from 01 (make public statement) to 20 (use unconventional mass violence) — with the number of articles reporting them.demo.geopolitics.gdelt_daily_topic
- GDELT coverage by update batchHow much each GDELT update batch — published every 15 minutes — added: the number of events and of articles reporting them.demo.geopolitics.gdelt_coverage_by_batch