102.220.160.39

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
    "emulator_response_len": 32,
    "bytes_in": 1159,
    "payload_entropy": 4.842670561517844,
    "port_category": "well_known",
    "org": "VPS Dedicated LLC",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 197769,
    "country": "SI",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 195,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "pat-0392",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "pat-0392",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0392",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "libssh banner",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0392",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "dec625322d24e501bad0f7810e09d98f",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014l\ufffd\u0002^q!\ufffd\u000b\ufffd\ufffd\ufffdDW{\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
    "request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014l\ufffd\u0002^q!\ufffd\u000b\ufffd\ufffd\ufffdDW{\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie",
    "payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014l\ufffd\u0002^q!\ufffd\u000b\ufffd\ufffd\ufffdDW{\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
    "evidence": {
        "request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014l\ufffd\u0002^q!\ufffd\u000b\ufffd\ufffd\ufffdDW{\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie",
        "payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014l\ufffd\u0002^q!\ufffd\u000b\ufffd\ufffd\ufffdDW{\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "ff4e7a8440d26df74bb0d0d82fc67404f8591632",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014l\ufffd\u0002^q!\ufffd\u000b\ufffd\ufffd\ufffdDW{\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
        "payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014l\ufffd\u0002^q!\ufffd\u000b\ufffd\ufffd\ufffdDW{\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nll\ufffd^q!\ufffd\ufffd\ufffd\ufffdDW{\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 40,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "pat-0392",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "pat-0392",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014l\ufffd\u0002^q!\ufffd\u000b\ufffd\ufffd\ufffdDW{\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
            "payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014l\ufffd\u0002^q!\ufffd\u000b\ufffd\ufffd\ufffdDW{\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nll\ufffd^q!\ufffd\ufffd\ufffd\ufffdDW{\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
    "emulator_response_len": 39,
    "bytes_in": 1159,
    "payload_entropy": 4.82959483543051,
    "port_category": "well_known",
    "org": "VPS Dedicated LLC",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 197769,
    "country": "SI",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 195,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "pat-0392",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "pat-0392",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0392",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "libssh banner",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0392",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "59b6012bbc6b078ba9b3bf241431034a",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\ufffd8\\:\ufffd\bdD\ufffd\ufffd[,\ufffd\u000ex\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
    "request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\ufffd8\\:\ufffd\bdD\ufffd\ufffd[,\ufffd\u000ex\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie",
    "payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\ufffd8\\:\ufffd\bdD\ufffd\ufffd[,\ufffd\u000ex\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
    "evidence": {
        "request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\ufffd8\\:\ufffd\bdD\ufffd\ufffd[,\ufffd\u000ex\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie",
        "payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\ufffd8\\:\ufffd\bdD\ufffd\ufffd[,\ufffd\u000ex\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6500694ba9b25a5052717ed1cf91f03f3b0821fc",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\ufffd8\\:\ufffd\bdD\ufffd\ufffd[,\ufffd\u000ex\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
        "payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\ufffd8\\:\ufffd\bdD\ufffd\ufffd[,\ufffd\u000ex\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nl\ufffd\ufffd8\\:\ufffddD\ufffd\ufffd[,\ufffdxhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 40,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "pat-0392",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "pat-0392",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\ufffd8\\:\ufffd\bdD\ufffd\ufffd[,\ufffd\u000ex\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
            "payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\ufffd8\\:\ufffd\bdD\ufffd\ufffd[,\ufffd\u000ex\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nl\ufffd\ufffd8\\:\ufffddD\ufffd\ufffd[,\ufffdxhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
    "emulator_response_len": 32,
    "bytes_in": 1159,
    "payload_entropy": 4.834958035514633,
    "port_category": "well_known",
    "org": "VPS Dedicated LLC",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 197769,
    "country": "SI",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 195,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "pat-0392",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "pat-0392",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0392",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "libssh banner",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0392",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "877ec255a8178cbdbd7bb749965b3238",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdF\ufffdJ\ufffd5\ufffdX\ufffd\ufffds\ufffd\u0019PG\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
    "request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdF\ufffdJ\ufffd5\ufffdX\ufffd\ufffds\ufffd\u0019PG\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie",
    "payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdF\ufffdJ\ufffd5\ufffdX\ufffd\ufffds\ufffd\u0019PG\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
    "evidence": {
        "request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdF\ufffdJ\ufffd5\ufffdX\ufffd\ufffds\ufffd\u0019PG\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie",
        "payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdF\ufffdJ\ufffd5\ufffdX\ufffd\ufffds\ufffd\u0019PG\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c22649199f02199633d8950473ace41b2b18e65e",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdF\ufffdJ\ufffd5\ufffdX\ufffd\ufffds\ufffd\u0019PG\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
        "payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdF\ufffdJ\ufffd5\ufffdX\ufffd\ufffds\ufffd\u0019PG\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nl\ufffdF\ufffdJ\ufffd5\ufffdX\ufffd\ufffds\ufffdPG\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 40,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "pat-0392",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "pat-0392",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdF\ufffdJ\ufffd5\ufffdX\ufffd\ufffds\ufffd\u0019PG\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
            "payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdF\ufffdJ\ufffd5\ufffdX\ufffd\ufffds\ufffd\u0019PG\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nl\ufffdF\ufffdJ\ufffd5\ufffdX\ufffd\ufffds\ufffdPG\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205341502049434d0d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2036300d0a0d0a3c68746d6c3e3c626f64793e53415020496e7465726e657420436f6d6d756e69636174696f6e204d616e616765723c",
    "emulator_response_len": 141,
    "bytes_in": 110,
    "payload_entropy": 5.227278209543821,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "sap-icm",
    "app_proto": "sap-icm",
    "asn": 197769,
    "country": "SI",
    "dst_port": 8000,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 38,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 38,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "04ada829cf80285c4a0f515b998f0122f0ce49cc",
    "event_fingerprint": "40ac2e001fc92fc4c26729171b1b914e26c42c6a",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "matched_pattern_names": [
        "Cred Basic auth spray",
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy"
    ],
    "pattern_ids": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 38,
        "novelty": 15,
        "risk_score": 46
    },
    "named_classification_skipped": false,
    "service_name": "sap-icm",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "5d6974d3c1b54b5d91e087ba7d3a20e5",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 8000,
        "service": "sap-icm",
        "service_name": "sap-icm",
        "risk_score": 46
    },
    "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic bWVkaWE6cGFzc3dvcmQ=\r\n",
    "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic bWVkaWE6cGFzc3dvcmQ=\r\n",
    "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic bWVkaWE6cGFzc3dvcmQ=",
    "evidence": {
        "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic bWVkaWE6cGFzc3dvcmQ=\r\n",
        "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic bWVkaWE6cGFzc3dvcmQ=",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f87eb463b2aa6c2c5ebd15b479719ed358fa2727",
    "protocol_details": {
        "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic bWVkaWE6cGFzc3dvcmQ=",
        "port": 8000,
        "service": "sap-icm",
        "service_label_fr": "SAP ICM"
    },
    "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic bWVkaWE6cGFzc3dvcmQ=",
    "attack_vector": "http flood \u00b7 via SAP ICM:8000 \u00b7 (tentative d'exploit)",
    "target_port_label": "8000 \u00b7 SAP ICM",
    "emulator_service": "sap-icm",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via SAP ICM",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 38,
            "novelty": 15,
            "risk_score": 46
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "sap-icm",
        "service_label_fr": "SAP ICM",
        "dst_port": 8000,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-sap-icm",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic bWVkaWE6cGFzc3dvcmQ=",
            "port": 8000,
            "service": "sap-icm",
            "service_label_fr": "SAP ICM"
        },
        "attack_vector": "http flood \u00b7 via SAP ICM:8000 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic bWVkaWE6cGFzc3dvcmQ=",
        "target_port_label": "8000 \u00b7 SAP ICM",
        "emulator_service": "sap-icm",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "sap_icm",
        "service_banner": "honeypot-sap-icm",
        "service_os": "linux",
        "dst_port": "8000"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_sap_web_probe",
        "sap_icm_emulated",
        "sap_icm_payload"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205341502049434d0d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2036300d0a0d0a3c68746d6c3e3c626f64793e53415020496e7465726e657420436f6d6d756e69636174696f6e204d616e616765723c",
    "emulator_response_len": 141,
    "bytes_in": 110,
    "payload_entropy": 5.118054138746524,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "sap-icm",
    "app_proto": "sap-icm",
    "asn": 197769,
    "country": "SI",
    "dst_port": 8000,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 38,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 38,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "04ada829cf80285c4a0f515b998f0122f0ce49cc",
    "event_fingerprint": "40ac2e001fc92fc4c26729171b1b914e26c42c6a",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "matched_pattern_names": [
        "Cred Basic auth spray",
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy"
    ],
    "pattern_ids": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 38,
        "novelty": 15,
        "risk_score": 46
    },
    "named_classification_skipped": false,
    "service_name": "sap-icm",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "da436ceeb6aab051ec19032f3a711544",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 8000,
        "service": "sap-icm",
        "service_name": "sap-icm",
        "risk_score": 46
    },
    "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic bmFnaW9zOmFiY0AxMjM0\r\n",
    "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic bmFnaW9zOmFiY0AxMjM0\r\n",
    "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic bmFnaW9zOmFiY0AxMjM0",
    "evidence": {
        "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic bmFnaW9zOmFiY0AxMjM0\r\n",
        "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic bmFnaW9zOmFiY0AxMjM0",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "8f728e47523d75927654754a99c4b72c3668824c",
    "protocol_details": {
        "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic bmFnaW9zOmFiY0AxMjM0",
        "port": 8000,
        "service": "sap-icm",
        "service_label_fr": "SAP ICM"
    },
    "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic bmFnaW9zOmFiY0AxMjM0",
    "attack_vector": "http flood \u00b7 via SAP ICM:8000 \u00b7 (tentative d'exploit)",
    "target_port_label": "8000 \u00b7 SAP ICM",
    "emulator_service": "sap-icm",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via SAP ICM",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 38,
            "novelty": 15,
            "risk_score": 46
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "sap-icm",
        "service_label_fr": "SAP ICM",
        "dst_port": 8000,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-sap-icm",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic bmFnaW9zOmFiY0AxMjM0",
            "port": 8000,
            "service": "sap-icm",
            "service_label_fr": "SAP ICM"
        },
        "attack_vector": "http flood \u00b7 via SAP ICM:8000 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic bmFnaW9zOmFiY0AxMjM0",
        "target_port_label": "8000 \u00b7 SAP ICM",
        "emulator_service": "sap-icm",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "sap_icm",
        "service_banner": "honeypot-sap-icm",
        "service_os": "linux",
        "dst_port": "8000"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_sap_web_probe",
        "sap_icm_emulated",
        "sap_icm_payload"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a205341502049434d0d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2036300d0a0d0a3c68746d6c3e3c626f64793e53415020496e7465726e657420436f6d6d756e69636174696f6e204d616e616765723c",
    "emulator_response_len": 141,
    "bytes_in": 114,
    "payload_entropy": 5.270353642502828,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "sap-icm",
    "app_proto": "sap-icm",
    "asn": 197769,
    "country": "SI",
    "dst_port": 8000,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 38,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 38,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "04ada829cf80285c4a0f515b998f0122f0ce49cc",
    "event_fingerprint": "40ac2e001fc92fc4c26729171b1b914e26c42c6a",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "matched_pattern_names": [
        "Cred Basic auth spray",
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy"
    ],
    "pattern_ids": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 38,
        "novelty": 15,
        "risk_score": 46
    },
    "named_classification_skipped": false,
    "service_name": "sap-icm",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "4dc8a4cfe4ee5f7f94df9eeb7023f2b8",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 8000,
        "service": "sap-icm",
        "service_name": "sap-icm",
        "risk_score": 46
    },
    "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic d3d3OmFkcmlhbjE0MDQ4OQ==\r\n",
    "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic d3d3OmFkcmlhbjE0MDQ4OQ==\r\n",
    "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic d3d3OmFkcmlhbjE0MDQ4OQ==",
    "evidence": {
        "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic d3d3OmFkcmlhbjE0MDQ4OQ==\r\n",
        "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic d3d3OmFkcmlhbjE0MDQ4OQ==",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d6e47299e9175d5c5e14d0e2471bac1ee61da20f",
    "protocol_details": {
        "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic d3d3OmFkcmlhbjE0MDQ4OQ==",
        "port": 8000,
        "service": "sap-icm",
        "service_label_fr": "SAP ICM"
    },
    "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic d3d3OmFkcmlhbjE0MDQ4OQ==",
    "attack_vector": "http flood \u00b7 via SAP ICM:8000 \u00b7 (tentative d'exploit)",
    "target_port_label": "8000 \u00b7 SAP ICM",
    "emulator_service": "sap-icm",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via SAP ICM",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 38,
            "novelty": 15,
            "risk_score": 46
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "sap-icm",
        "service_label_fr": "SAP ICM",
        "dst_port": 8000,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-sap-icm",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic d3d3OmFkcmlhbjE0MDQ4OQ==",
            "port": 8000,
            "service": "sap-icm",
            "service_label_fr": "SAP ICM"
        },
        "attack_vector": "http flood \u00b7 via SAP ICM:8000 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic d3d3OmFkcmlhbjE0MDQ4OQ==",
        "target_port_label": "8000 \u00b7 SAP ICM",
        "emulator_service": "sap-icm",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "sap_icm",
        "service_banner": "honeypot-sap-icm",
        "service_os": "linux",
        "dst_port": "8000"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_sap_web_probe",
        "sap_icm_emulated",
        "sap_icm_payload"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "39:80",
    "http_ua_hash": null,
    "http_host_hash": "a4e43627b26c17b2036ba11f0b42fd77523b561f",
    "http_target_hash": "a4e43627b26c17b2036ba11f0b42fd77523b561f",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 106,
    "payload_entropy": 5.0459021205458505,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 197769,
    "country": "SI",
    "dst_port": 8090,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 6.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
    "event_fingerprint": "3c9d528c291c68232b657ab46f77af01a4a6677c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "2bb97fe2c646b3c7ffb991afb7ebb741",
        "path_pattern_hash": "6d7ab931061a1536afc76452310da337"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 8090,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n",
    "method": "CONNECT",
    "path": "102.220.160.39:80",
    "request_line": "CONNECT 102.220.160.39:80 HTTP\/1.1",
    "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n",
    "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=",
    "evidence": {
        "method": "CONNECT",
        "path": "102.220.160.39:80",
        "request_line": "CONNECT 102.220.160.39:80 HTTP\/1.1",
        "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n",
        "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 40
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "11bb1181800af4be0fd7ce13a4127d2956fbbef6",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "102.220.160.39:80",
        "request_line": "CONNECT 102.220.160.39:80 HTTP\/1.1",
        "port": 8090,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.39:80",
    "target_port_label": "8090 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8090,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "102.220.160.39:80",
            "request_line": "CONNECT 102.220.160.39:80 HTTP\/1.1",
            "port": 8090,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.39:80",
        "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=",
        "target_port_label": "8090 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8090"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua",
        "net_web_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
    "emulator_response_len": 144,
    "bytes_in": 110,
    "payload_entropy": 5.209686678328099,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "hdfs-namenode",
    "app_proto": "hdfs-namenode",
    "asn": 197769,
    "country": "SI",
    "dst_port": 8020,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
    "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "matched_pattern_names": [
        "Cred Basic auth spray",
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy"
    ],
    "pattern_ids": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 46
    },
    "named_classification_skipped": false,
    "service_name": "hdfs-namenode",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "79289f5da74bf74f7f655ca2ed4b6765",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 8020,
        "service": "hdfs-namenode",
        "service_name": "hdfs-namenode",
        "risk_score": 46
    },
    "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic cm9vdDpzeXNhZG03NQ==\r\n",
    "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic cm9vdDpzeXNhZG03NQ==\r\n",
    "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic cm9vdDpzeXNhZG03NQ==",
    "evidence": {
        "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic cm9vdDpzeXNhZG03NQ==\r\n",
        "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic cm9vdDpzeXNhZG03NQ==",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "20776b48df3e941006e3bb6a3703bebe69795460",
    "protocol_details": {
        "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic cm9vdDpzeXNhZG03NQ==",
        "port": 8020,
        "service": "hdfs-namenode",
        "service_label_fr": "HDFS NAMENODE"
    },
    "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic cm9vdDpzeXNhZG03NQ==",
    "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
    "target_port_label": "8020 \u00b7 HDFS NAMENODE",
    "emulator_service": "hdfs-namenode",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 46
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "hdfs-namenode",
        "service_label_fr": "HDFS NAMENODE",
        "dst_port": 8020,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-hdfs-namenode",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic cm9vdDpzeXNhZG03NQ==",
            "port": 8020,
            "service": "hdfs-namenode",
            "service_label_fr": "HDFS NAMENODE"
        },
        "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic cm9vdDpzeXNhZG03NQ==",
        "target_port_label": "8020 \u00b7 HDFS NAMENODE",
        "emulator_service": "hdfs-namenode",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "hdfs_namenode",
        "service_banner": "honeypot-hdfs-namenode",
        "service_os": "linux",
        "dst_port": "8020"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "hdfs_namenode_emulated",
        "hdfs_namenode_payload",
        "net_hdfs_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
    "emulator_response_len": 144,
    "bytes_in": 110,
    "payload_entropy": 5.143231732290761,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "hdfs-namenode",
    "app_proto": "hdfs-namenode",
    "asn": 197769,
    "country": "SI",
    "dst_port": 8020,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
    "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "matched_pattern_names": [
        "Cred Basic auth spray",
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy"
    ],
    "pattern_ids": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 46
    },
    "named_classification_skipped": false,
    "service_name": "hdfs-namenode",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "0f56b37ecc0513548f03a88f4555babb",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 8020,
        "service": "hdfs-namenode",
        "service_name": "hdfs-namenode",
        "risk_score": 46
    },
    "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=\r\n",
    "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=\r\n",
    "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=",
    "evidence": {
        "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=\r\n",
        "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "0ae27cb499820e1012330aace6a5911902e7a2db",
    "protocol_details": {
        "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=",
        "port": 8020,
        "service": "hdfs-namenode",
        "service_label_fr": "HDFS NAMENODE"
    },
    "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=",
    "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
    "target_port_label": "8020 \u00b7 HDFS NAMENODE",
    "emulator_service": "hdfs-namenode",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 46
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "hdfs-namenode",
        "service_label_fr": "HDFS NAMENODE",
        "dst_port": 8020,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-hdfs-namenode",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=",
            "port": 8020,
            "service": "hdfs-namenode",
            "service_label_fr": "HDFS NAMENODE"
        },
        "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=",
        "target_port_label": "8020 \u00b7 HDFS NAMENODE",
        "emulator_service": "hdfs-namenode",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "hdfs_namenode",
        "service_banner": "honeypot-hdfs-namenode",
        "service_os": "linux",
        "dst_port": "8020"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "hdfs_namenode_emulated",
        "hdfs_namenode_payload",
        "net_hdfs_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
    "emulator_response_len": 144,
    "bytes_in": 108,
    "payload_entropy": 5.05545179935166,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "hdfs-namenode",
    "app_proto": "hdfs-namenode",
    "asn": 197769,
    "country": "SI",
    "dst_port": 8020,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
    "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "matched_pattern_names": [
        "Cred Basic auth spray",
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy"
    ],
    "pattern_ids": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 46
    },
    "named_classification_skipped": false,
    "service_name": "hdfs-namenode",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "51242867d9c5388c861a18707c3d3387",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 8020,
        "service": "hdfs-namenode",
        "service_name": "hdfs-namenode",
        "risk_score": 46
    },
    "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=\r\n\r\n",
    "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=\r\n\r\n",
    "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=",
    "evidence": {
        "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=\r\n\r\n",
        "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "af13cb6cbf48f31a53d8b7e3a4168f2b47c3be89",
    "protocol_details": {
        "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=",
        "port": 8020,
        "service": "hdfs-namenode",
        "service_label_fr": "HDFS NAMENODE"
    },
    "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=",
    "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
    "target_port_label": "8020 \u00b7 HDFS NAMENODE",
    "emulator_service": "hdfs-namenode",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 46
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "hdfs-namenode",
        "service_label_fr": "HDFS NAMENODE",
        "dst_port": 8020,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-hdfs-namenode",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=",
            "port": 8020,
            "service": "hdfs-namenode",
            "service_label_fr": "HDFS NAMENODE"
        },
        "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic MTIzNDU6MTIzNDU=",
        "target_port_label": "8020 \u00b7 HDFS NAMENODE",
        "emulator_service": "hdfs-namenode",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "hdfs_namenode",
        "service_banner": "honeypot-hdfs-namenode",
        "service_os": "linux",
        "dst_port": "8020"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "hdfs_namenode_emulated",
        "hdfs_namenode_payload",
        "net_hdfs_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
    "emulator_response_len": 144,
    "bytes_in": 126,
    "payload_entropy": 5.398319880342044,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "hdfs-namenode",
    "app_proto": "hdfs-namenode",
    "asn": 197769,
    "country": "SI",
    "dst_port": 8020,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
    "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "matched_pattern_names": [
        "Cred Basic auth spray",
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy"
    ],
    "pattern_ids": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 46
    },
    "named_classification_skipped": false,
    "service_name": "hdfs-namenode",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "caaa3f50f58d8f1b1fb9c3e5b63467ae",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 8020,
        "service": "hdfs-namenode",
        "service_name": "hdfs-namenode",
        "risk_score": 46
    },
    "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic YTFnZW5ldmlldmU6ZWxhc3RpY3NlYXJjaA==\r\n",
    "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic YTFnZW5ldmlldmU6ZWxhc3RpY3NlYXJjaA==\r\n",
    "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic YTFnZW5ldmlldmU6ZWxhc3RpY3NlYXJjaA==",
    "evidence": {
        "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic YTFnZW5ldmlldmU6ZWxhc3RpY3NlYXJjaA==\r\n",
        "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic YTFnZW5ldmlldmU6ZWxhc3RpY3NlYXJjaA==",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "1039b8a6c4e624e56cfaacd0e68fd6daafd2264c",
    "protocol_details": {
        "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic YTFnZW5ldmlldmU6ZWxhc3RpY3NlYXJjaA==",
        "port": 8020,
        "service": "hdfs-namenode",
        "service_label_fr": "HDFS NAMENODE"
    },
    "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic YTFnZW5ldmlldmU6ZWxhc3RpY3NlYXJjaA==",
    "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
    "target_port_label": "8020 \u00b7 HDFS NAMENODE",
    "emulator_service": "hdfs-namenode",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 46
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "hdfs-namenode",
        "service_label_fr": "HDFS NAMENODE",
        "dst_port": 8020,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-hdfs-namenode",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic YTFnZW5ldmlldmU6ZWxhc3RpY3NlYXJjaA==",
            "port": 8020,
            "service": "hdfs-namenode",
            "service_label_fr": "HDFS NAMENODE"
        },
        "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic YTFnZW5ldmlldmU6ZWxhc3RpY3NlYXJjaA==",
        "target_port_label": "8020 \u00b7 HDFS NAMENODE",
        "emulator_service": "hdfs-namenode",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "hdfs_namenode",
        "service_banner": "honeypot-hdfs-namenode",
        "service_os": "linux",
        "dst_port": "8020"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "hdfs_namenode_emulated",
        "hdfs_namenode_payload",
        "net_hdfs_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
    "emulator_response_len": 144,
    "bytes_in": 36,
    "payload_entropy": 4.062305474194333,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "hdfs-namenode",
    "app_proto": "hdfs-namenode",
    "asn": 197769,
    "country": "SI",
    "dst_port": 8020,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 46,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
    "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "matched_pattern_names": [
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy"
    ],
    "pattern_ids": [
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 46
    },
    "named_classification_skipped": false,
    "service_name": "hdfs-namenode",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "342d13eaf6d0e3e225266162f496c064",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 8020,
        "service": "hdfs-namenode",
        "service_name": "hdfs-namenode",
        "risk_score": 46
    },
    "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\n",
    "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\n",
    "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0",
    "evidence": {
        "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\n",
        "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "298073334c47916b472f2e1f141f4866645c20b0",
    "protocol_details": {
        "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0",
        "port": 8020,
        "service": "hdfs-namenode",
        "service_label_fr": "HDFS NAMENODE"
    },
    "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0",
    "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
    "target_port_label": "8020 \u00b7 HDFS NAMENODE",
    "emulator_service": "hdfs-namenode",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 46
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "hdfs-namenode",
        "service_label_fr": "HDFS NAMENODE",
        "dst_port": 8020,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-hdfs-namenode",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0",
            "port": 8020,
            "service": "hdfs-namenode",
            "service_label_fr": "HDFS NAMENODE"
        },
        "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0",
        "target_port_label": "8020 \u00b7 HDFS NAMENODE",
        "emulator_service": "hdfs-namenode",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "hdfs_namenode",
        "service_banner": "honeypot-hdfs-namenode",
        "service_os": "linux",
        "dst_port": "8020"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "hdfs_namenode_emulated",
        "hdfs_namenode_payload",
        "net_hdfs_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
    "emulator_response_len": 144,
    "bytes_in": 106,
    "payload_entropy": 5.223777148586162,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "hdfs-namenode",
    "app_proto": "hdfs-namenode",
    "asn": 197769,
    "country": "SI",
    "dst_port": 8020,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
    "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "matched_pattern_names": [
        "Cred Basic auth spray",
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy"
    ],
    "pattern_ids": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 46
    },
    "named_classification_skipped": false,
    "service_name": "hdfs-namenode",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "5fa1c0671dad0bee506e45c75bba3499",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 8020,
        "service": "hdfs-namenode",
        "service_name": "hdfs-namenode",
        "risk_score": 46
    },
    "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic cm9vdDpzYW5nYXJl\r\n",
    "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic cm9vdDpzYW5nYXJl\r\n",
    "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic cm9vdDpzYW5nYXJl",
    "evidence": {
        "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic cm9vdDpzYW5nYXJl\r\n",
        "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic cm9vdDpzYW5nYXJl",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "2a29d3fd3f7cf4914363e109fb2d842174d6df2d",
    "protocol_details": {
        "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic cm9vdDpzYW5nYXJl",
        "port": 8020,
        "service": "hdfs-namenode",
        "service_label_fr": "HDFS NAMENODE"
    },
    "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic cm9vdDpzYW5nYXJl",
    "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
    "target_port_label": "8020 \u00b7 HDFS NAMENODE",
    "emulator_service": "hdfs-namenode",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 46
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "hdfs-namenode",
        "service_label_fr": "HDFS NAMENODE",
        "dst_port": 8020,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-hdfs-namenode",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic cm9vdDpzYW5nYXJl",
            "port": 8020,
            "service": "hdfs-namenode",
            "service_label_fr": "HDFS NAMENODE"
        },
        "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic cm9vdDpzYW5nYXJl",
        "target_port_label": "8020 \u00b7 HDFS NAMENODE",
        "emulator_service": "hdfs-namenode",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "hdfs_namenode",
        "service_banner": "honeypot-hdfs-namenode",
        "service_os": "linux",
        "dst_port": "8020"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "hdfs_namenode_emulated",
        "hdfs_namenode_payload",
        "net_hdfs_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
    "emulator_response_len": 144,
    "bytes_in": 108,
    "payload_entropy": 5.19299580835419,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "hdfs-namenode",
    "app_proto": "hdfs-namenode",
    "asn": 197769,
    "country": "SI",
    "dst_port": 8020,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
    "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "matched_pattern_names": [
        "Cred Basic auth spray",
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy"
    ],
    "pattern_ids": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 46
    },
    "named_classification_skipped": false,
    "service_name": "hdfs-namenode",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "38fe3e4cb62e1177fd7771174737aa1b",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 8020,
        "service": "hdfs-namenode",
        "service_name": "hdfs-namenode",
        "risk_score": 46
    },
    "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic ZGVwbG95OmFzZGY=\r\n\r\n",
    "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic ZGVwbG95OmFzZGY=\r\n\r\n",
    "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic ZGVwbG95OmFzZGY=",
    "evidence": {
        "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic ZGVwbG95OmFzZGY=\r\n\r\n",
        "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic ZGVwbG95OmFzZGY=",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "bfcb909dd0a737369146b0369ce4df8de21d116f",
    "protocol_details": {
        "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic ZGVwbG95OmFzZGY=",
        "port": 8020,
        "service": "hdfs-namenode",
        "service_label_fr": "HDFS NAMENODE"
    },
    "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic ZGVwbG95OmFzZGY=",
    "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
    "target_port_label": "8020 \u00b7 HDFS NAMENODE",
    "emulator_service": "hdfs-namenode",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 46
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "hdfs-namenode",
        "service_label_fr": "HDFS NAMENODE",
        "dst_port": 8020,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-hdfs-namenode",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic ZGVwbG95OmFzZGY=",
            "port": 8020,
            "service": "hdfs-namenode",
            "service_label_fr": "HDFS NAMENODE"
        },
        "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic ZGVwbG95OmFzZGY=",
        "target_port_label": "8020 \u00b7 HDFS NAMENODE",
        "emulator_service": "hdfs-namenode",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "hdfs_namenode",
        "service_banner": "honeypot-hdfs-namenode",
        "service_os": "linux",
        "dst_port": "8020"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "hdfs_namenode_emulated",
        "hdfs_namenode_payload",
        "net_hdfs_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
    "emulator_response_len": 144,
    "bytes_in": 36,
    "payload_entropy": 4.062305474194333,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "hdfs-namenode",
    "app_proto": "hdfs-namenode",
    "asn": 197769,
    "country": "SI",
    "dst_port": 8020,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 46,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
    "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "matched_pattern_names": [
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy"
    ],
    "pattern_ids": [
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 46
    },
    "named_classification_skipped": false,
    "service_name": "hdfs-namenode",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "342d13eaf6d0e3e225266162f496c064",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 8020,
        "service": "hdfs-namenode",
        "service_name": "hdfs-namenode",
        "risk_score": 46
    },
    "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\n",
    "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\n",
    "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0",
    "evidence": {
        "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\n",
        "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "298073334c47916b472f2e1f141f4866645c20b0",
    "protocol_details": {
        "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0",
        "port": 8020,
        "service": "hdfs-namenode",
        "service_label_fr": "HDFS NAMENODE"
    },
    "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0",
    "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
    "target_port_label": "8020 \u00b7 HDFS NAMENODE",
    "emulator_service": "hdfs-namenode",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 46
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "hdfs-namenode",
        "service_label_fr": "HDFS NAMENODE",
        "dst_port": 8020,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-hdfs-namenode",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0",
            "port": 8020,
            "service": "hdfs-namenode",
            "service_label_fr": "HDFS NAMENODE"
        },
        "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0",
        "target_port_label": "8020 \u00b7 HDFS NAMENODE",
        "emulator_service": "hdfs-namenode",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "hdfs_namenode",
        "service_banner": "honeypot-hdfs-namenode",
        "service_os": "linux",
        "dst_port": "8020"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "hdfs_namenode_emulated",
        "hdfs_namenode_payload",
        "net_hdfs_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
    "emulator_response_len": 144,
    "bytes_in": 110,
    "payload_entropy": 5.138394741603129,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "hdfs-namenode",
    "app_proto": "hdfs-namenode",
    "asn": 197769,
    "country": "SI",
    "dst_port": 8020,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
    "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "matched_pattern_names": [
        "Cred Basic auth spray",
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy"
    ],
    "pattern_ids": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 46
    },
    "named_classification_skipped": false,
    "service_name": "hdfs-namenode",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e6037d03642a2c9c403abbaeb6d90231",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 8020,
        "service": "hdfs-namenode",
        "service_name": "hdfs-namenode",
        "risk_score": 46
    },
    "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==\r\n",
    "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==\r\n",
    "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==",
    "evidence": {
        "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==\r\n",
        "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "bbd1ee53e4d640068b9718617974c3200ca660a5",
    "protocol_details": {
        "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==",
        "port": 8020,
        "service": "hdfs-namenode",
        "service_label_fr": "HDFS NAMENODE"
    },
    "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==",
    "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
    "target_port_label": "8020 \u00b7 HDFS NAMENODE",
    "emulator_service": "hdfs-namenode",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 46
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "hdfs-namenode",
        "service_label_fr": "HDFS NAMENODE",
        "dst_port": 8020,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-hdfs-namenode",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==",
            "port": 8020,
            "service": "hdfs-namenode",
            "service_label_fr": "HDFS NAMENODE"
        },
        "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==",
        "target_port_label": "8020 \u00b7 HDFS NAMENODE",
        "emulator_service": "hdfs-namenode",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "hdfs_namenode",
        "service_banner": "honeypot-hdfs-namenode",
        "service_os": "linux",
        "dst_port": "8020"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "hdfs_namenode_emulated",
        "hdfs_namenode_payload",
        "net_hdfs_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
    "emulator_response_len": 144,
    "bytes_in": 108,
    "payload_entropy": 5.19299580835419,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "hdfs-namenode",
    "app_proto": "hdfs-namenode",
    "asn": 197769,
    "country": "SI",
    "dst_port": 8020,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
    "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "matched_pattern_names": [
        "Cred Basic auth spray",
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy"
    ],
    "pattern_ids": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 46
    },
    "named_classification_skipped": false,
    "service_name": "hdfs-namenode",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "38fe3e4cb62e1177fd7771174737aa1b",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 8020,
        "service": "hdfs-namenode",
        "service_name": "hdfs-namenode",
        "risk_score": 46
    },
    "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic ZGVwbG95OmFzZGY=\r\n\r\n",
    "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic ZGVwbG95OmFzZGY=\r\n\r\n",
    "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic ZGVwbG95OmFzZGY=",
    "evidence": {
        "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic ZGVwbG95OmFzZGY=\r\n\r\n",
        "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic ZGVwbG95OmFzZGY=",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "bfcb909dd0a737369146b0369ce4df8de21d116f",
    "protocol_details": {
        "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic ZGVwbG95OmFzZGY=",
        "port": 8020,
        "service": "hdfs-namenode",
        "service_label_fr": "HDFS NAMENODE"
    },
    "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic ZGVwbG95OmFzZGY=",
    "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
    "target_port_label": "8020 \u00b7 HDFS NAMENODE",
    "emulator_service": "hdfs-namenode",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 46
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "hdfs-namenode",
        "service_label_fr": "HDFS NAMENODE",
        "dst_port": 8020,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-hdfs-namenode",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic ZGVwbG95OmFzZGY=",
            "port": 8020,
            "service": "hdfs-namenode",
            "service_label_fr": "HDFS NAMENODE"
        },
        "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic ZGVwbG95OmFzZGY=",
        "target_port_label": "8020 \u00b7 HDFS NAMENODE",
        "emulator_service": "hdfs-namenode",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "hdfs_namenode",
        "service_banner": "honeypot-hdfs-namenode",
        "service_os": "linux",
        "dst_port": "8020"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "hdfs_namenode_emulated",
        "hdfs_namenode_payload",
        "net_hdfs_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
    "emulator_response_len": 144,
    "bytes_in": 36,
    "payload_entropy": 4.062305474194333,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "hdfs-namenode",
    "app_proto": "hdfs-namenode",
    "asn": 197769,
    "country": "SI",
    "dst_port": 8020,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 46,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
    "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "matched_pattern_names": [
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy"
    ],
    "pattern_ids": [
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 46
    },
    "named_classification_skipped": false,
    "service_name": "hdfs-namenode",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "342d13eaf6d0e3e225266162f496c064",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 8020,
        "service": "hdfs-namenode",
        "service_name": "hdfs-namenode",
        "risk_score": 46
    },
    "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\n",
    "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\n",
    "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0",
    "evidence": {
        "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\n",
        "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "298073334c47916b472f2e1f141f4866645c20b0",
    "protocol_details": {
        "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0",
        "port": 8020,
        "service": "hdfs-namenode",
        "service_label_fr": "HDFS NAMENODE"
    },
    "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0",
    "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
    "target_port_label": "8020 \u00b7 HDFS NAMENODE",
    "emulator_service": "hdfs-namenode",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 46
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "hdfs-namenode",
        "service_label_fr": "HDFS NAMENODE",
        "dst_port": 8020,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-hdfs-namenode",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0",
            "port": 8020,
            "service": "hdfs-namenode",
            "service_label_fr": "HDFS NAMENODE"
        },
        "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0",
        "target_port_label": "8020 \u00b7 HDFS NAMENODE",
        "emulator_service": "hdfs-namenode",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "hdfs_namenode",
        "service_banner": "honeypot-hdfs-namenode",
        "service_os": "linux",
        "dst_port": "8020"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "hdfs_namenode_emulated",
        "hdfs_namenode_payload",
        "net_hdfs_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
    "emulator_response_len": 144,
    "bytes_in": 110,
    "payload_entropy": 5.138394741603129,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "hdfs-namenode",
    "app_proto": "hdfs-namenode",
    "asn": 197769,
    "country": "SI",
    "dst_port": 8020,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
    "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "matched_pattern_names": [
        "Cred Basic auth spray",
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy"
    ],
    "pattern_ids": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 46
    },
    "named_classification_skipped": false,
    "service_name": "hdfs-namenode",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e6037d03642a2c9c403abbaeb6d90231",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 8020,
        "service": "hdfs-namenode",
        "service_name": "hdfs-namenode",
        "risk_score": 46
    },
    "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==\r\n",
    "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==\r\n",
    "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==",
    "evidence": {
        "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==\r\n",
        "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "bbd1ee53e4d640068b9718617974c3200ca660a5",
    "protocol_details": {
        "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==",
        "port": 8020,
        "service": "hdfs-namenode",
        "service_label_fr": "HDFS NAMENODE"
    },
    "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==",
    "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
    "target_port_label": "8020 \u00b7 HDFS NAMENODE",
    "emulator_service": "hdfs-namenode",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 46
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "hdfs-namenode",
        "service_label_fr": "HDFS NAMENODE",
        "dst_port": 8020,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-hdfs-namenode",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==",
            "port": 8020,
            "service": "hdfs-namenode",
            "service_label_fr": "HDFS NAMENODE"
        },
        "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic MTIzNDU2OjEyMzQ1Ng==",
        "target_port_label": "8020 \u00b7 HDFS NAMENODE",
        "emulator_service": "hdfs-namenode",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "hdfs_namenode",
        "service_banner": "honeypot-hdfs-namenode",
        "service_os": "linux",
        "dst_port": "8020"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "hdfs_namenode_emulated",
        "hdfs_namenode_payload",
        "net_hdfs_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2037330d0a0d0a7b2270726f746f636f6c223a226f72672e6170616368652e6861646f6f702e686466732e70726f746f636f6c2e436c69656e7450726f746f63",
    "emulator_response_len": 144,
    "bytes_in": 36,
    "payload_entropy": 4.062305474194333,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "hdfs-namenode",
    "app_proto": "hdfs-namenode",
    "asn": 197769,
    "country": "SI",
    "dst_port": 8020,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 46,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "a3f0406cb9859f918547e7d9724ae04de9b35cbf",
    "event_fingerprint": "f86f2f8585eddb17139e72dd9eb2eb48cccd1028",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "matched_pattern_names": [
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy"
    ],
    "pattern_ids": [
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 46
    },
    "named_classification_skipped": false,
    "service_name": "hdfs-namenode",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "342d13eaf6d0e3e225266162f496c064",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 8020,
        "service": "hdfs-namenode",
        "service_name": "hdfs-namenode",
        "risk_score": 46
    },
    "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\n",
    "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\n",
    "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0",
    "evidence": {
        "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\n",
        "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "298073334c47916b472f2e1f141f4866645c20b0",
    "protocol_details": {
        "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0",
        "port": 8020,
        "service": "hdfs-namenode",
        "service_label_fr": "HDFS NAMENODE"
    },
    "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0",
    "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
    "target_port_label": "8020 \u00b7 HDFS NAMENODE",
    "emulator_service": "hdfs-namenode",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HDFS NAMENODE",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 46
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "hdfs-namenode",
        "service_label_fr": "HDFS NAMENODE",
        "dst_port": 8020,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-hdfs-namenode",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0",
            "port": 8020,
            "service": "hdfs-namenode",
            "service_label_fr": "HDFS NAMENODE"
        },
        "attack_vector": "http flood \u00b7 via HDFS NAMENODE:8020 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0",
        "target_port_label": "8020 \u00b7 HDFS NAMENODE",
        "emulator_service": "hdfs-namenode",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "hdfs_namenode",
        "service_banner": "honeypot-hdfs-namenode",
        "service_os": "linux",
        "dst_port": "8020"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "hdfs_namenode_emulated",
        "hdfs_namenode_payload",
        "net_hdfs_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "0500",
    "emulator_response_len": 2,
    "bytes_in": 4,
    "payload_entropy": 1.5,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 197769,
    "country": "SI",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "426dec8df888ffa63f455322a8a4f2110dbd3010",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 8
    },
    "service_name": "socks5",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8",
        "path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 45
    },
    "payload_preview": "\u0005\u0002\u0000\u0002",
    "request_sample": "\u0005\u0002\u0000\u0002",
    "payload_snippet": "\u0005\u0002\u0000\u0002",
    "evidence": {
        "request_sample": "\u0005\u0002\u0000\u0002",
        "payload_snippet": "\u0005\u0002\u0000\u0002",
        "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "network_service_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "20f660764e133838b1f3c3a1f8264509dfee0592",
    "protocol_details": {
        "payload_preview": "\u0005\u0002\u0000\u0002",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0005\u0002\u0000\u0002",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "socks5"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_socks5_probe",
        "socks5_emulated",
        "socks5_handshake"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053",
    "emulator_response_len": 147,
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "39:80",
    "http_ua_hash": null,
    "http_host_hash": "a4e43627b26c17b2036ba11f0b42fd77523b561f",
    "http_target_hash": "a4e43627b26c17b2036ba11f0b42fd77523b561f",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 126,
    "payload_entropy": 5.262966833417494,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 197769,
    "country": "SI",
    "dst_port": 9080,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7",
    "event_fingerprint": "e5fc4a01d7feb7cff5e101e91ae7190711dab77f",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "9ad57b311f1e98546ab998710bc8e2f7",
        "path_pattern_hash": "6d7ab931061a1536afc76452310da337"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 9080,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic Y2lzY286RFZkbUVVOHVzZklZRWlZRDl0eHlY\r\n",
    "method": "CONNECT",
    "path": "102.220.160.39:80",
    "request_line": "CONNECT 102.220.160.39:80 HTTP\/1.1",
    "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic Y2lzY286RFZkbUVVOHVzZklZRWlZRDl0eHlY\r\n",
    "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic Y2lzY286RFZkbUVVOHVzZklZRWlZRDl0eHlY",
    "evidence": {
        "method": "CONNECT",
        "path": "102.220.160.39:80",
        "request_line": "CONNECT 102.220.160.39:80 HTTP\/1.1",
        "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic Y2lzY286RFZkbUVVOHVzZklZRWlZRDl0eHlY\r\n",
        "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic Y2lzY286RFZkbUVVOHVzZklZRWlZRDl0eHlY",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 40,
        "correlation_boost": 8
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "fae4273716ac62060610f340ca607eebe6f1cdb2",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "102.220.160.39:80",
        "request_line": "CONNECT 102.220.160.39:80 HTTP\/1.1",
        "port": 9080,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic Y2lzY286RFZkbUVVOHVzZklZRWlZRDl0eHlY",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.39:80",
    "target_port_label": "9080 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 40,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9080,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "102.220.160.39:80",
            "request_line": "CONNECT 102.220.160.39:80 HTTP\/1.1",
            "port": 9080,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.39:80",
        "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic Y2lzY286RFZkbUVVOHVzZklZRWlZRDl0eHlY",
        "target_port_label": "9080 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "socks5"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua",
        "net_web_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "0500",
    "emulator_response_len": 2,
    "bytes_in": 4,
    "payload_entropy": 1.5,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 197769,
    "country": "SI",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "426dec8df888ffa63f455322a8a4f2110dbd3010",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 8
    },
    "service_name": "socks5",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8",
        "path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 45
    },
    "payload_preview": "\u0005\u0002\u0000\u0002",
    "request_sample": "\u0005\u0002\u0000\u0002",
    "payload_snippet": "\u0005\u0002\u0000\u0002",
    "evidence": {
        "request_sample": "\u0005\u0002\u0000\u0002",
        "payload_snippet": "\u0005\u0002\u0000\u0002",
        "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "network_service_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "20f660764e133838b1f3c3a1f8264509dfee0592",
    "protocol_details": {
        "payload_preview": "\u0005\u0002\u0000\u0002",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0005\u0002\u0000\u0002",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "socks5"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_socks5_probe",
        "socks5_emulated",
        "socks5_handshake"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053",
    "emulator_response_len": 147,
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "39:80",
    "http_ua_hash": null,
    "http_host_hash": "a4e43627b26c17b2036ba11f0b42fd77523b561f",
    "http_target_hash": "a4e43627b26c17b2036ba11f0b42fd77523b561f",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 110,
    "payload_entropy": 5.179462206948011,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 197769,
    "country": "SI",
    "dst_port": 9080,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7",
    "event_fingerprint": "e5fc4a01d7feb7cff5e101e91ae7190711dab77f",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "afe72b600cca20026036070276e8d2ed",
        "path_pattern_hash": "6d7ab931061a1536afc76452310da337"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 9080,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic cm9vdDp0ZXN0MTIzNDU=\r\n",
    "method": "CONNECT",
    "path": "102.220.160.39:80",
    "request_line": "CONNECT 102.220.160.39:80 HTTP\/1.1",
    "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic cm9vdDp0ZXN0MTIzNDU=\r\n",
    "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic cm9vdDp0ZXN0MTIzNDU=",
    "evidence": {
        "method": "CONNECT",
        "path": "102.220.160.39:80",
        "request_line": "CONNECT 102.220.160.39:80 HTTP\/1.1",
        "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic cm9vdDp0ZXN0MTIzNDU=\r\n",
        "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic cm9vdDp0ZXN0MTIzNDU=",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 40,
        "correlation_boost": 8
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "11a06edb79cf54c17af1cde7195f9a39854cdfa8",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "102.220.160.39:80",
        "request_line": "CONNECT 102.220.160.39:80 HTTP\/1.1",
        "port": 9080,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic cm9vdDp0ZXN0MTIzNDU=",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.39:80",
    "target_port_label": "9080 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 40,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9080,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "102.220.160.39:80",
            "request_line": "CONNECT 102.220.160.39:80 HTTP\/1.1",
            "port": 9080,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.39:80",
        "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic cm9vdDp0ZXN0MTIzNDU=",
        "target_port_label": "9080 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "socks5"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua",
        "net_web_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "0500",
    "emulator_response_len": 2,
    "bytes_in": 4,
    "payload_entropy": 1.5,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 197769,
    "country": "SI",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "426dec8df888ffa63f455322a8a4f2110dbd3010",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 8
    },
    "service_name": "socks5",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8",
        "path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 45
    },
    "payload_preview": "\u0005\u0002\u0000\u0002",
    "request_sample": "\u0005\u0002\u0000\u0002",
    "payload_snippet": "\u0005\u0002\u0000\u0002",
    "evidence": {
        "request_sample": "\u0005\u0002\u0000\u0002",
        "payload_snippet": "\u0005\u0002\u0000\u0002",
        "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "network_service_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "20f660764e133838b1f3c3a1f8264509dfee0592",
    "protocol_details": {
        "payload_preview": "\u0005\u0002\u0000\u0002",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0005\u0002\u0000\u0002",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "socks5"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_socks5_probe",
        "socks5_emulated",
        "socks5_handshake"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "0500",
    "emulator_response_len": 2,
    "bytes_in": 4,
    "payload_entropy": 1.5,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 197769,
    "country": "SI",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "426dec8df888ffa63f455322a8a4f2110dbd3010",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 8
    },
    "service_name": "socks5",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8",
        "path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 45
    },
    "payload_preview": "\u0005\u0002\u0000\u0002",
    "request_sample": "\u0005\u0002\u0000\u0002",
    "payload_snippet": "\u0005\u0002\u0000\u0002",
    "evidence": {
        "request_sample": "\u0005\u0002\u0000\u0002",
        "payload_snippet": "\u0005\u0002\u0000\u0002",
        "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "network_service_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "20f660764e133838b1f3c3a1f8264509dfee0592",
    "protocol_details": {
        "payload_preview": "\u0005\u0002\u0000\u0002",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0005\u0002\u0000\u0002",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "socks5"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_socks5_probe",
        "socks5_emulated",
        "socks5_handshake"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053",
    "emulator_response_len": 147,
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "39:80",
    "http_ua_hash": null,
    "http_host_hash": "a4e43627b26c17b2036ba11f0b42fd77523b561f",
    "http_target_hash": "a4e43627b26c17b2036ba11f0b42fd77523b561f",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 106,
    "payload_entropy": 5.160051794792168,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 197769,
    "country": "SI",
    "dst_port": 9080,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7",
    "event_fingerprint": "e5fc4a01d7feb7cff5e101e91ae7190711dab77f",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "22c4a7a7166faf7e9eccca0d569df1ad",
        "path_pattern_hash": "6d7ab931061a1536afc76452310da337"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 9080,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic cm9vdDpjdnhpdg==\r\n",
    "method": "CONNECT",
    "path": "102.220.160.39:80",
    "request_line": "CONNECT 102.220.160.39:80 HTTP\/1.1",
    "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic cm9vdDpjdnhpdg==\r\n",
    "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic cm9vdDpjdnhpdg==",
    "evidence": {
        "method": "CONNECT",
        "path": "102.220.160.39:80",
        "request_line": "CONNECT 102.220.160.39:80 HTTP\/1.1",
        "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic cm9vdDpjdnhpdg==\r\n",
        "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic cm9vdDpjdnhpdg==",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 40,
        "correlation_boost": 8
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "92a6734e5bd95e86451cb28d0ffc564496ee78c2",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "102.220.160.39:80",
        "request_line": "CONNECT 102.220.160.39:80 HTTP\/1.1",
        "port": 9080,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic cm9vdDpjdnhpdg==",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.39:80",
    "target_port_label": "9080 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 40,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9080,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "102.220.160.39:80",
            "request_line": "CONNECT 102.220.160.39:80 HTTP\/1.1",
            "port": 9080,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.39:80",
        "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic cm9vdDpjdnhpdg==",
        "target_port_label": "9080 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "socks5"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua",
        "net_web_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "0500",
    "emulator_response_len": 2,
    "bytes_in": 4,
    "payload_entropy": 1.5,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 197769,
    "country": "SI",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "426dec8df888ffa63f455322a8a4f2110dbd3010",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 8
    },
    "service_name": "socks5",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8",
        "path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 45
    },
    "payload_preview": "\u0005\u0002\u0000\u0002",
    "request_sample": "\u0005\u0002\u0000\u0002",
    "payload_snippet": "\u0005\u0002\u0000\u0002",
    "evidence": {
        "request_sample": "\u0005\u0002\u0000\u0002",
        "payload_snippet": "\u0005\u0002\u0000\u0002",
        "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "network_service_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "20f660764e133838b1f3c3a1f8264509dfee0592",
    "protocol_details": {
        "payload_preview": "\u0005\u0002\u0000\u0002",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0005\u0002\u0000\u0002",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "socks5"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_socks5_probe",
        "socks5_emulated",
        "socks5_handshake"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "0500",
    "emulator_response_len": 2,
    "bytes_in": 4,
    "payload_entropy": 1.5,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 197769,
    "country": "SI",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "426dec8df888ffa63f455322a8a4f2110dbd3010",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 8
    },
    "service_name": "socks5",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8",
        "path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 45
    },
    "payload_preview": "\u0005\u0002\u0000\u0002",
    "request_sample": "\u0005\u0002\u0000\u0002",
    "payload_snippet": "\u0005\u0002\u0000\u0002",
    "evidence": {
        "request_sample": "\u0005\u0002\u0000\u0002",
        "payload_snippet": "\u0005\u0002\u0000\u0002",
        "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "network_service_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "20f660764e133838b1f3c3a1f8264509dfee0592",
    "protocol_details": {
        "payload_preview": "\u0005\u0002\u0000\u0002",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0005\u0002\u0000\u0002",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "socks5"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_socks5_probe",
        "socks5_emulated",
        "socks5_handshake"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a2049424d5f485454505f5365727665720d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c68746d6c3e3c626f64793e49424d20576562537068657265204170706c69636174696f6e2053",
    "emulator_response_len": 147,
    "http_header_count": 0,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "39:80",
    "http_ua_hash": null,
    "http_host_hash": null,
    "http_target_hash": "a4e43627b26c17b2036ba11f0b42fd77523b561f",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 36,
    "payload_entropy": 4.062305474194333,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 197769,
    "country": "SI",
    "dst_port": 9080,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 0
    },
    "risk_score": 40,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "cd04e782d239e46bc18ffa0b511d16368028d2c7",
    "event_fingerprint": "e5fc4a01d7feb7cff5e101e91ae7190711dab77f",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "342d13eaf6d0e3e225266162f496c064",
        "path_pattern_hash": "6d7ab931061a1536afc76452310da337"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 9080,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\n",
    "method": "CONNECT",
    "path": "102.220.160.39:80",
    "request_line": "CONNECT 102.220.160.39:80 HTTP\/1.1",
    "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\n",
    "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0",
    "evidence": {
        "method": "CONNECT",
        "path": "102.220.160.39:80",
        "request_line": "CONNECT 102.220.160.39:80 HTTP\/1.1",
        "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\n",
        "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 0,
        "risk_score": 40,
        "correlation_boost": 8
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.85,
    "classification_confidence": 0.85,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a52acc279588f527267f975d67b9aad788460c91",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "102.220.160.39:80",
        "request_line": "CONNECT 102.220.160.39:80 HTTP\/1.1",
        "port": 9080,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.39:80",
    "target_port_label": "9080 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 85,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 0,
            "risk_score": 40,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 9080,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "102.220.160.39:80",
            "request_line": "CONNECT 102.220.160.39:80 HTTP\/1.1",
            "port": 9080,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:9080 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.39:80",
        "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0",
        "target_port_label": "9080 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 85 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "9080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "socks5"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua",
        "net_web_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "0500",
    "emulator_response_len": 2,
    "bytes_in": 4,
    "payload_entropy": 1.5,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 197769,
    "country": "SI",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "426dec8df888ffa63f455322a8a4f2110dbd3010",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45
    },
    "service_name": "socks5",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8",
        "path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 45
    },
    "payload_preview": "\u0005\u0002\u0000\u0002",
    "request_sample": "\u0005\u0002\u0000\u0002",
    "payload_snippet": "\u0005\u0002\u0000\u0002",
    "evidence": {
        "request_sample": "\u0005\u0002\u0000\u0002",
        "payload_snippet": "\u0005\u0002\u0000\u0002",
        "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "network_service_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "20f660764e133838b1f3c3a1f8264509dfee0592",
    "protocol_details": {
        "payload_preview": "\u0005\u0002\u0000\u0002",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0005\u0002\u0000\u0002",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_socks5_probe",
        "socks5_emulated",
        "socks5_handshake"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "0500",
    "emulator_response_len": 2,
    "bytes_in": 4,
    "payload_entropy": 1.5,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "socks5",
    "app_proto": "socks5",
    "asn": 197769,
    "country": "SI",
    "dst_port": 1080,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 5.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "426dec8df888ffa63f455322a8a4f2110dbd3010",
    "event_fingerprint": "3331cd638f7f2882b3f28f93273086620fcbe7b5",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 45
    },
    "service_name": "socks5",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8",
        "path_pattern_hash": "bfccf9f2989c411a7f395b1e4889bbc9"
    },
    "target_context": {
        "dst_port": 1080,
        "service": "socks5",
        "service_name": "socks5",
        "risk_score": 45
    },
    "payload_preview": "\u0005\u0002\u0000\u0002",
    "request_sample": "\u0005\u0002\u0000\u0002",
    "payload_snippet": "\u0005\u0002\u0000\u0002",
    "evidence": {
        "request_sample": "\u0005\u0002\u0000\u0002",
        "payload_snippet": "\u0005\u0002\u0000\u0002",
        "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "network_service_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "20f660764e133838b1f3c3a1f8264509dfee0592",
    "protocol_details": {
        "payload_preview": "\u0005\u0002\u0000\u0002",
        "port": 1080,
        "service": "socks5",
        "service_label_fr": "SOCKS5"
    },
    "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
    "target_port_label": "1080 \u00b7 SOCKS5",
    "emulator_service": "socks5",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab socks5_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 40,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 45
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "socks5",
        "service_label_fr": "SOCKS5",
        "dst_port": 1080,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-socks5",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0005\u0002\u0000\u0002",
            "port": 1080,
            "service": "socks5",
            "service_label_fr": "SOCKS5"
        },
        "attack_vector": "socks5 probe \u00b7 via SOCKS5:1080 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "1080 \u00b7 SOCKS5",
        "emulator_service": "socks5",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "socks5",
        "service_banner": "honeypot-socks5",
        "service_os": "linux",
        "dst_port": "1080"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_socks5_probe",
        "socks5_emulated",
        "socks5_handshake"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 120,
    "payload_entropy": 5.1511880711801705,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "https",
    "app_proto": "https",
    "asn": 197769,
    "country": "SI",
    "dst_port": 9443,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0",
    "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.57,
    "classification_confidence": 0.57,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568",
        "pat-0600"
    ],
    "matched_pattern_names": [
        "Cred Basic auth spray",
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy",
        "HTTPS alt 9443 probe"
    ],
    "pattern_ids": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568",
        "pat-0600"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15,
        "risk_score": 46,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "https",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "8ce16af3cc13bc00edd2ae5ad17e12ee",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 9443,
        "service": "https",
        "service_name": "https",
        "risk_score": 46
    },
    "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic cGVyc29uYWw6cGVyc29uYWwyMDI1\r\n\r\n",
    "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic cGVyc29uYWw6cGVyc29uYWwyMDI1\r\n\r\n",
    "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic cGVyc29uYWw6cGVyc29uYWwyMDI1",
    "evidence": {
        "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic cGVyc29uYWw6cGVyc29uYWwyMDI1\r\n\r\n",
        "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic cGVyc29uYWw6cGVyc29uYWwyMDI1",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "15384d6ef8bb9b03b283e9871cf3d7b6ccbe6496",
    "protocol_details": {
        "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic cGVyc29uYWw6cGVyc29uYWwyMDI1",
        "port": 9443,
        "service": "https",
        "service_label_fr": "HTTPS"
    },
    "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic cGVyc29uYWw6cGVyc29uYWwyMDI1",
    "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
    "target_port_label": "9443 \u00b7 HTTPS",
    "emulator_service": "https",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 57 % \u2014 via HTTPS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 57,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 15,
            "risk_score": 46,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "https",
        "service_label_fr": "HTTPS",
        "dst_port": 9443,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-https",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic cGVyc29uYWw6cGVyc29uYWwyMDI1",
            "port": 9443,
            "service": "https",
            "service_label_fr": "HTTPS"
        },
        "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic cGVyc29uYWw6cGVyc29uYWwyMDI1",
        "target_port_label": "9443 \u00b7 HTTPS",
        "emulator_service": "https",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "https",
        "service_banner": "honeypot-https",
        "service_os": "linux",
        "dst_port": "9443"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "https",
        "ssh"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_alt_port",
        "net_web_probe",
        "websphere_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
    "emulator_response_len": 39,
    "bytes_in": 1159,
    "payload_entropy": 4.8400676477679,
    "port_category": "well_known",
    "org": "VPS Dedicated LLC",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 197769,
    "country": "SI",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 195,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "pat-0392",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "pat-0392",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0348",
        "pat-0391",
        "pat-0392",
        "pat-0868",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "RDP TPKT header",
        "SSH-2.0 banner RFC4253",
        "libssh banner",
        "ET H.323 setup",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0348",
        "pat-0391",
        "pat-0392",
        "pat-0868",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ce0c6340b5178f08070510cf2b9878fe",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd]o \ufffd\ufffd\u02f8\ufffd\ufffdG$V\ufffd\ufffd\u0003\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
    "request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd]o \ufffd\ufffd\u02f8\ufffd\ufffdG$V\ufffd\ufffd\u0003\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie",
    "payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd]o \ufffd\ufffd\u02f8\ufffd\ufffdG$V\ufffd\ufffd\u0003\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
    "evidence": {
        "request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd]o \ufffd\ufffd\u02f8\ufffd\ufffdG$V\ufffd\ufffd\u0003\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie",
        "payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd]o \ufffd\ufffd\u02f8\ufffd\ufffdG$V\ufffd\ufffd\u0003\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "00fefa02ac8656af738666d7b18d9389c136dc45",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd]o \ufffd\ufffd\u02f8\ufffd\ufffdG$V\ufffd\ufffd\u0003\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
        "payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd]o \ufffd\ufffd\u02f8\ufffd\ufffdG$V\ufffd\ufffd\u0003\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nl\ufffd]o \ufffd\ufffd\u02f8\ufffd\ufffdG$V\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 40,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "pat-0392",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "pat-0392",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd]o \ufffd\ufffd\u02f8\ufffd\ufffdG$V\ufffd\ufffd\u0003\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
            "payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd]o \ufffd\ufffd\u02f8\ufffd\ufffdG$V\ufffd\ufffd\u0003\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nl\ufffd]o \ufffd\ufffd\u02f8\ufffd\ufffdG$V\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 108,
    "payload_entropy": 5.14442995189274,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "https",
    "app_proto": "https",
    "asn": 197769,
    "country": "SI",
    "dst_port": 9443,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0",
    "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.57,
    "classification_confidence": 0.57,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568",
        "pat-0600"
    ],
    "matched_pattern_names": [
        "Cred Basic auth spray",
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy",
        "HTTPS alt 9443 probe"
    ],
    "pattern_ids": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568",
        "pat-0600"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15,
        "risk_score": 46,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "https",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "3cfe7e6d2682ff9b3ddb97a2029814a4",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 9443,
        "service": "https",
        "service_name": "https",
        "risk_score": 46
    },
    "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic YWRtaW46MTIzNDU=\r\n\r\n",
    "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic YWRtaW46MTIzNDU=\r\n\r\n",
    "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic YWRtaW46MTIzNDU=",
    "evidence": {
        "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic YWRtaW46MTIzNDU=\r\n\r\n",
        "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic YWRtaW46MTIzNDU=",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7596b3115b5c76eb99a57fce0d9393dd153abac5",
    "protocol_details": {
        "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic YWRtaW46MTIzNDU=",
        "port": 9443,
        "service": "https",
        "service_label_fr": "HTTPS"
    },
    "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic YWRtaW46MTIzNDU=",
    "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
    "target_port_label": "9443 \u00b7 HTTPS",
    "emulator_service": "https",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 57 % \u2014 via HTTPS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 57,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 15,
            "risk_score": 46,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "https",
        "service_label_fr": "HTTPS",
        "dst_port": 9443,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-https",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic YWRtaW46MTIzNDU=",
            "port": 9443,
            "service": "https",
            "service_label_fr": "HTTPS"
        },
        "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic YWRtaW46MTIzNDU=",
        "target_port_label": "9443 \u00b7 HTTPS",
        "emulator_service": "https",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "https",
        "service_banner": "honeypot-https",
        "service_os": "linux",
        "dst_port": "9443"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "https",
        "ssh"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_alt_port",
        "net_web_probe",
        "websphere_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e337031205562756e74752d317562756e7475330d0a",
    "emulator_response_len": 39,
    "bytes_in": 1159,
    "payload_entropy": 4.825207223939095,
    "port_category": "well_known",
    "org": "VPS Dedicated LLC",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 197769,
    "country": "SI",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 195,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "pat-0392",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "pat-0392",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0392",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "libssh banner",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0392",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "54a09ac4ba8475918307a2f3c7e449d1",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\ufffdvDa\u0015\ufffd\ufffd\"C\ufffd8\u0010\ufffda\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
    "request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\ufffdvDa\u0015\ufffd\ufffd\"C\ufffd8\u0010\ufffda\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie",
    "payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\ufffdvDa\u0015\ufffd\ufffd\"C\ufffd8\u0010\ufffda\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
    "evidence": {
        "request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\ufffdvDa\u0015\ufffd\ufffd\"C\ufffd8\u0010\ufffda\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie",
        "payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\ufffdvDa\u0015\ufffd\ufffd\"C\ufffd8\u0010\ufffda\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "4d03bf6691c9122e41178d3235173f2e15fb3712",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\ufffdvDa\u0015\ufffd\ufffd\"C\ufffd8\u0010\ufffda\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
        "payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\ufffdvDa\u0015\ufffd\ufffd\"C\ufffd8\u0010\ufffda\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nl\ufffd\ufffdvDa\ufffd\ufffd\"C\ufffd8\ufffda\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 40,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "pat-0392",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "pat-0392",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\ufffdvDa\u0015\ufffd\ufffd\"C\ufffd8\u0010\ufffda\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
            "payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffd\ufffdvDa\u0015\ufffd\ufffd\"C\ufffd8\u0010\ufffda\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nl\ufffd\ufffdvDa\ufffd\ufffd\"C\ufffd8\ufffda\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 110,
    "payload_entropy": 5.144729887166948,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "https",
    "app_proto": "https",
    "asn": 197769,
    "country": "SI",
    "dst_port": 9443,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0",
    "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.57,
    "classification_confidence": 0.57,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568",
        "pat-0600"
    ],
    "matched_pattern_names": [
        "Cred Basic auth spray",
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy",
        "HTTPS alt 9443 probe"
    ],
    "pattern_ids": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568",
        "pat-0600"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15,
        "risk_score": 46,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "https",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "7a9d40cabe12b19782875959229e9a42",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 9443,
        "service": "https",
        "service_name": "https",
        "risk_score": 46
    },
    "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic NjU0MzIxOjY1NDMyMQ==\r\n",
    "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic NjU0MzIxOjY1NDMyMQ==\r\n",
    "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic NjU0MzIxOjY1NDMyMQ==",
    "evidence": {
        "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic NjU0MzIxOjY1NDMyMQ==\r\n",
        "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic NjU0MzIxOjY1NDMyMQ==",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "192ddc437e95948f15a0d81b0a00b2efbbfc0899",
    "protocol_details": {
        "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic NjU0MzIxOjY1NDMyMQ==",
        "port": 9443,
        "service": "https",
        "service_label_fr": "HTTPS"
    },
    "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic NjU0MzIxOjY1NDMyMQ==",
    "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
    "target_port_label": "9443 \u00b7 HTTPS",
    "emulator_service": "https",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 57 % \u2014 via HTTPS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 57,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 15,
            "risk_score": 46,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "https",
        "service_label_fr": "HTTPS",
        "dst_port": 9443,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-https",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic NjU0MzIxOjY1NDMyMQ==",
            "port": 9443,
            "service": "https",
            "service_label_fr": "HTTPS"
        },
        "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic NjU0MzIxOjY1NDMyMQ==",
        "target_port_label": "9443 \u00b7 HTTPS",
        "emulator_service": "https",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "https",
        "service_banner": "honeypot-https",
        "service_os": "linux",
        "dst_port": "9443"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "https",
        "ssh"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_alt_port",
        "net_web_probe",
        "websphere_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a",
    "emulator_response_len": 41,
    "bytes_in": 1159,
    "payload_entropy": 4.82912236418035,
    "port_category": "well_known",
    "org": "VPS Dedicated LLC",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 197769,
    "country": "SI",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 195,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "pat-0392",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "pat-0392",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0392",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "libssh banner",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0392",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "7216cf550fcf48593cbbc1ba9bb71fed",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdB\ufffdo'2\ufffd\ufffd\ufffd\u0267g\ufffdY\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
    "request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdB\ufffdo'2\ufffd\ufffd\ufffd\u0267g\ufffdY\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie",
    "payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdB\ufffdo'2\ufffd\ufffd\ufffd\u0267g\ufffdY\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
    "evidence": {
        "request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdB\ufffdo'2\ufffd\ufffd\ufffd\u0267g\ufffdY\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie",
        "payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdB\ufffdo'2\ufffd\ufffd\ufffd\u0267g\ufffdY\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a8c815c49844f37a07e747f8d238f7a130643310",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdB\ufffdo'2\ufffd\ufffd\ufffd\u0267g\ufffdY\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
        "payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdB\ufffdo'2\ufffd\ufffd\ufffd\u0267g\ufffdY\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nl\ufffdB\ufffdo'2\ufffd\ufffd\ufffd\u0267g\ufffdY\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 40,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "pat-0392",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "pat-0392",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdB\ufffdo'2\ufffd\ufffd\ufffd\u0267g\ufffdY\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
            "payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdB\ufffdo'2\ufffd\ufffd\ufffd\u0267g\ufffdY\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nl\ufffdB\ufffdo'2\ufffd\ufffd\ufffd\u0267g\ufffdY\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 108,
    "payload_entropy": 5.043922979927249,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "https",
    "app_proto": "https",
    "asn": 197769,
    "country": "SI",
    "dst_port": 9443,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0",
    "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.57,
    "classification_confidence": 0.57,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568",
        "pat-0600"
    ],
    "matched_pattern_names": [
        "Cred Basic auth spray",
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy",
        "HTTPS alt 9443 probe"
    ],
    "pattern_ids": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568",
        "pat-0600"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15,
        "risk_score": 46,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "https",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e69906aeebedb0dfa9b17dc762d8eb66",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 9443,
        "service": "https",
        "service_name": "https",
        "risk_score": 46
    },
    "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n",
    "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n",
    "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=",
    "evidence": {
        "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n\r\n",
        "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c243862143d3ea92324d4411e57f2eb615d0f2b0",
    "protocol_details": {
        "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=",
        "port": 9443,
        "service": "https",
        "service_label_fr": "HTTPS"
    },
    "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=",
    "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
    "target_port_label": "9443 \u00b7 HTTPS",
    "emulator_service": "https",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 57 % \u2014 via HTTPS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 57,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 15,
            "risk_score": 46,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "https",
        "service_label_fr": "HTTPS",
        "dst_port": 9443,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-https",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=",
            "port": 9443,
            "service": "https",
            "service_label_fr": "HTTPS"
        },
        "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=",
        "target_port_label": "9443 \u00b7 HTTPS",
        "emulator_service": "https",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "https",
        "service_banner": "honeypot-https",
        "service_os": "linux",
        "dst_port": "9443"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "https",
        "ssh"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_alt_port",
        "net_web_probe",
        "websphere_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f372e367031205562756e74752d347562756e7475302e370d0a",
    "emulator_response_len": 41,
    "bytes_in": 1159,
    "payload_entropy": 4.828568145717927,
    "port_category": "well_known",
    "org": "VPS Dedicated LLC",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 197769,
    "country": "SI",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 195,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "pat-0392",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "pat-0392",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0392",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "libssh banner",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0392",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6b551b7ec6d72139a705daac40f6d01b",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdjW\u0006\u0000\ufffd-k\u06ab] \ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
    "request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdjW\u0006\u0000\ufffd-k\u06ab] \ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie",
    "payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdjW\u0006\u0000\ufffd-k\u06ab] \ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
    "evidence": {
        "request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdjW\u0006\u0000\ufffd-k\u06ab] \ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie",
        "payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdjW\u0006\u0000\ufffd-k\u06ab] \ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "27d327c178b16321a44f7eac7a662be2d562a6ad",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdjW\u0006\u0000\ufffd-k\u06ab] \ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
        "payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdjW\u0006\u0000\ufffd-k\u06ab] \ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nl\ufffdjW\ufffd-k\u06ab] \ufffd\ufffd\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 40,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "pat-0392",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "pat-0392",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdjW\u0006\u0000\ufffd-k\u06ab] \ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
            "payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdjW\u0006\u0000\ufffd-k\u06ab] \ufffd\ufffd\ufffd\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nl\ufffdjW\ufffd-k\u06ab] \ufffd\ufffd\ufffd\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 104,
    "payload_entropy": 5.051845119859672,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "https",
    "app_proto": "https",
    "asn": 197769,
    "country": "SI",
    "dst_port": 9443,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0",
    "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568",
        "pat-0600"
    ],
    "matched_pattern_names": [
        "Cred Basic auth spray",
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy",
        "HTTPS alt 9443 probe"
    ],
    "pattern_ids": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568",
        "pat-0600"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15,
        "risk_score": 46
    },
    "named_classification_skipped": false,
    "service_name": "https",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "17c6faf590182f74a74e54a238bf36f9",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 9443,
        "service": "https",
        "service_name": "https",
        "risk_score": 46
    },
    "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n\r\n",
    "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n\r\n",
    "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0",
    "evidence": {
        "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n\r\n",
        "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "1ce705dfe7158600c7ec13f669753d1b7946b745",
    "protocol_details": {
        "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0",
        "port": 9443,
        "service": "https",
        "service_label_fr": "HTTPS"
    },
    "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0",
    "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
    "target_port_label": "9443 \u00b7 HTTPS",
    "emulator_service": "https",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 15,
            "risk_score": 46
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "https",
        "service_label_fr": "HTTPS",
        "dst_port": 9443,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-https",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0",
            "port": 9443,
            "service": "https",
            "service_label_fr": "HTTPS"
        },
        "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0",
        "target_port_label": "9443 \u00b7 HTTPS",
        "emulator_service": "https",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "https",
        "service_banner": "honeypot-https",
        "service_os": "linux",
        "dst_port": "9443"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_alt_port",
        "net_web_probe",
        "websphere_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "39:80",
    "http_ua_hash": null,
    "http_host_hash": "a4e43627b26c17b2036ba11f0b42fd77523b561f",
    "http_target_hash": "a4e43627b26c17b2036ba11f0b42fd77523b561f",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 114,
    "payload_entropy": 5.266586453530277,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 197769,
    "country": "SI",
    "dst_port": 8090,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 6.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
    "event_fingerprint": "3c9d528c291c68232b657ab46f77af01a4a6677c",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "47fd648aa9129397374701ec232c938c",
        "path_pattern_hash": "6d7ab931061a1536afc76452310da337"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 8090,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic cm9vdDoxcWF6QFdTWDNlZGM=\r\n",
    "method": "CONNECT",
    "path": "102.220.160.39:80",
    "request_line": "CONNECT 102.220.160.39:80 HTTP\/1.1",
    "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic cm9vdDoxcWF6QFdTWDNlZGM=\r\n",
    "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic cm9vdDoxcWF6QFdTWDNlZGM=",
    "evidence": {
        "method": "CONNECT",
        "path": "102.220.160.39:80",
        "request_line": "CONNECT 102.220.160.39:80 HTTP\/1.1",
        "request_sample": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic cm9vdDoxcWF6QFdTWDNlZGM=\r\n",
        "payload_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic cm9vdDoxcWF6QFdTWDNlZGM=",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 40
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "366640e0734416bc89e9a33229433e7ddc87ca69",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "102.220.160.39:80",
        "request_line": "CONNECT 102.220.160.39:80 HTTP\/1.1",
        "port": 8090,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic cm9vdDoxcWF6QFdTWDNlZGM=",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.39:80",
    "target_port_label": "8090 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8090,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "102.220.160.39:80",
            "request_line": "CONNECT 102.220.160.39:80 HTTP\/1.1",
            "port": 8090,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 102.220.160.39:80",
        "evidence_snippet": "CONNECT 102.220.160.39:80 HTTP\/1.0\r\nHost: 102.220.160.39:80\r\nProxy-Authorization: Basic cm9vdDoxcWF6QFdTWDNlZGM=",
        "target_port_label": "8090 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8090"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua",
        "net_web_probe"
    ],
    "asn_dc_heuristic": true
}