Adversary
Watching a machine and watching an opponent are not the same job. A disk filling up does not change its behaviour because you noticed; an adversary does. So this view is organised around the actor rather than the request, and it keeps what was observed strictly apart from what has been inferred.
A rising share means new tooling or a new wordlist is circulating. That is the opposition changing – nothing here changed.
Indiscriminate scanning does not revisit. A source that comes back after a block expired has chosen to, which is the clearest separation available between background noise and something deliberate.
Blocking an address costs an opponent almost nothing to defeat – addresses are rented by the hour. Behaviour is far more expensive to change, so the durable detection is the pattern, not the indicator. The block is a speed bump; the record of what they did is the part worth keeping.
Directly measured or received. If this is wrong, the instrumentation is broken.
Calculated from observations. Arithmetic – correct if its inputs are.
A judgement drawn from the above. May be wrong, and carries a confidence.
Verified independently, or actioned and recorded.
The common failure in this kind of reporting is presenting a judgement as a fact. "A request arrived for /.env" is observable. "This is hostile" is a claim about intent, which a log line cannot show and which can be wrong. Keeping the two apart is what makes the rest auditable.