diff --git a/app.py b/app.py
index c0fd9e4..dd38041 100644
--- a/app.py
+++ b/app.py
@@ -72,9 +72,9 @@ def handle_crowdsec():
         # Group by IP
         ip_groups = {}
         for alert in alerts:
-            ip = alert.get("Source", {}).get("IP", "unknown")
-            country = alert.get("Source", {}).get("Cn", "")
-            scenario = alert.get("Scenario", "unknown")
+            ip = alert.get("source", {}).get("ip", "unknown")
+            country = alert.get("source", {}).get("cn", "")
+            scenario = alert.get("scenario", "unknown")
             
             if ip not in ip_groups:
                 ip_groups[ip] = {"country": country, "scenarios": set()}