# Downloads Directory

This directory contains ransomware intelligence data downloaded from AWS S3 buckets for sharing and analysis.

## Directory Structure

```
downloads/
├── README.md                    # This file
├── YYYY-MM-DD/                 # Date-based folders
│   ├── README.md               # Description of files for this date
│   ├── YYYY-MM-DD_complete.zip # Complete archive with all formats
│   ├── YYYY-MM-DD_combined.json # Structured JSON data
│   ├── YYYY-MM-DD_report.md    # LLM-friendly markdown report
│   └── YYYY-MM-DD_data.csv     # CSV export for spreadsheets
└── ...
```

## File Types

### Complete ZIP Archive (`YYYY-MM-DD_complete.zip`)
- **Best for**: Sharing via email, OneDrive, or general distribution
- **Contains**: All formats (JSON, Markdown, CSV) plus a README
- **Use case**: When you want everything in one convenient package

### Markdown Report (`YYYY-MM-DD_report.md`)
- **Best for**: LLM analysis (ChatGPT, Claude, etc.)
- **Contains**: Human-readable narrative format with summaries and article details
- **Use case**: Copy-paste into AI tools for analysis

### CSV Data (`YYYY-MM-DD_data.csv`)
- **Best for**: Spreadsheet analysis (Excel, Google Sheets)
- **Contains**: Tabular data with columns for title, URL, author, relevance score, etc.
- **Use case**: Data analysis, filtering, and visualization

### JSON Data (`YYYY-MM-DD_combined.json`)
- **Best for**: Programmatic analysis and custom tools
- **Contains**: Structured data with metadata and full article details
- **Use case**: Building custom analysis tools or importing into databases

## How to Download Data

### Using GitHub Actions (Automated)
1. Go to your repository's Actions tab
2. Select "Download Daily Data to Repository"
3. Click "Run workflow"
4. Configure the inputs:
   - **Target Date**: Specify a date (YYYY-MM-DD) or leave empty for yesterday
   - **Download Format**: Choose what to download (all, zip_only, markdown_only, etc.)
5. Wait for the workflow to complete
6. Files will be committed to the repository automatically

### Using AWS CLI (Manual)
```bash
# Download all files for a specific date
aws s3 sync s3://ransom-analysis-combined/YYYY-MM-DD/ ./downloads/YYYY-MM-DD/

# Download just the ZIP file
aws s3 cp s3://ransom-analysis-combined/YYYY-MM-DD/YYYY-MM-DD_complete.zip ./
```

## Sharing Files

### Via GitHub
- **Direct file links**: `https://github.com/username/repo/blob/main/downloads/2024-12-15/2024-12-15_report.md`
- **Folder links**: `https://github.com/username/repo/tree/main/downloads/2024-12-15`
- **Download repository**: Use the "Code" → "Download ZIP" button

### Via OneDrive/Email
1. Download the `YYYY-MM-DD_complete.zip` file
2. Upload to OneDrive or attach to email
3. Share the link or send the attachment

## Data Sources

All data comes from the AWS S3 combined bucket (`ransom-analysis-combined`) and represents processed ransomware intelligence from public sources including:
- Security vendor blogs
- News articles
- Public incident reports
- Threat intelligence feeds

## Usage Guidelines

- **Defensive research only**: This data is for defensive cybersecurity research
- **Public sources only**: All data comes from publicly available sources
- **Respect terms of service**: Use data in accordance with source website terms
- **No malware samples**: This pipeline does not collect malware binaries or sensitive data

## Questions or Issues

If you have questions about the data or need help with downloads, please:
1. Check the GitHub Actions workflow logs
2. Review the individual date README files
3. Open an issue in the repository
