104.152.52.210

{
    "protocol_emulated": true,
    "bytes_in": 8,
    "payload_entropy": 2.75,
    "port_category": "registered",
    "org": "Rethem Hosting LLC",
    "service": "rdp",
    "app_proto": "rdp",
    "asn": 14987,
    "country": "US",
    "dst_port": 3388,
    "risk_waf": 8,
    "risk_classification": 43,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 43,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 50,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "61b90af7f7762fd848a015c108644608d202d028",
    "event_fingerprint": "83f5ef87ea7d8eb1277bc2b5f6d31ae331c17062",
    "classification_reason": "Type \u00ab amqp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 174,
    "precision_signals": [
        "INT-PROTO-amqp-auth",
        "pat-0371",
        "pat-0537"
    ],
    "kb_rule_ids": [
        "INT-PROTO-amqp-auth",
        "pat-0371",
        "pat-0537"
    ],
    "matched_patterns": [
        "pat-0371",
        "pat-0537"
    ],
    "matched_pattern_names": [
        "AMQP protocol",
        "AMQP protocol header"
    ],
    "pattern_ids": [
        "pat-0371",
        "pat-0537"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 43,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 0,
        "risk_score": 50,
        "correlation_boost": 10
    },
    "named_classification_skipped": false,
    "service_name": "rdp",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14987,
        "org": "Rethem Hosting LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "bc2f502576523902588d3c36f36ea5a1",
        "path_pattern_hash": "e0a8a2707ca9342b66a175c0e4383ba0"
    },
    "target_context": {
        "dst_port": 3388,
        "service": "rdp",
        "service_name": "rdp",
        "risk_score": 50
    },
    "payload_preview": "AMQP\u0000\u0000\t\u0001",
    "request_sample": "AMQP\u0000\u0000\t\u0001",
    "payload_snippet": "AMQP\u0000\u0000\t\u0001",
    "evidence": {
        "request_sample": "AMQP\u0000\u0000\t\u0001",
        "payload_snippet": "AMQP\u0000\u0000\t\u0001",
        "classification_reason": "Type \u00ab amqp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "37799c01cfd75aa4607004cb209bccca41fb1ce1",
    "protocol_details": {
        "payload_preview": "AMQP\u0000\u0000\t\u0001",
        "port": 3388,
        "service": "rdp",
        "service_label_fr": "RDP"
    },
    "evidence_snippet": "AMQP",
    "attack_vector": "amqp probe \u00b7 via RDP:3388 \u00b7 (sonde \/ probe)",
    "target_port_label": "3388 \u00b7 RDP",
    "emulator_service": "rdp",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab amqp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "classification_reason_label_fr": "Type \u00ab amqp_probe \u00bb (signaux protocolaires) \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via RDP \u2014 campagne \/24 (104.152.52.0\/24)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 43,
            "behavior": 0,
            "geo": 40,
            "protocol": 36,
            "novelty": 0,
            "risk_score": 50,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "rdp",
        "service_label_fr": "RDP",
        "dst_port": 3388,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-PROTO-amqp-auth",
            "pat-0371",
            "pat-0537"
        ],
        "tags_summary_labels_fr": [
            "Proto Amqp Auth",
            "pat-0371",
            "pat-0537"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-rdp",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "AMQP\u0000\u0000\t\u0001",
            "port": 3388,
            "service": "rdp",
            "service_label_fr": "RDP"
        },
        "attack_vector": "amqp probe \u00b7 via RDP:3388 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "AMQP",
        "target_port_label": "3388 \u00b7 RDP",
        "emulator_service": "rdp",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (104.152.52.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "rdp",
        "service_banner": "honeypot-rdp",
        "service_os": "linux",
        "dst_port": "3388"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "104.152.52.0\/24",
    "coordinated_ip_count": 13,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "amqp_handshake",
        "net_rdp_probe",
        "rdp_emulated"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "bytes_in": 12,
    "payload_entropy": 3.584962500721156,
    "port_category": "registered",
    "org": "Rethem Hosting LLC",
    "service": "rdp",
    "app_proto": "rdp",
    "asn": 14987,
    "country": "US",
    "dst_port": 3388,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "aec477e58f1c183580c4e59c6d675789c96fdbee",
    "event_fingerprint": "83f5ef87ea7d8eb1277bc2b5f6d31ae331c17062",
    "classification_reason": "Type \u00ab port_3388_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
    "confidence": 0.65,
    "classification_confidence": 0.65,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 10
    },
    "named_classification_skipped": true,
    "named_candidate": "rdp_probe",
    "service_name": "rdp",
    "risk_confidence_factor": 55,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14987,
        "org": "Rethem Hosting LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "b2993d6e4414a846683a71de5eb18653",
        "path_pattern_hash": "1eaff5b2cbc7ae4da9a37f80e2e2ad47"
    },
    "target_context": {
        "dst_port": 3388,
        "service": "rdp",
        "service_name": "rdp",
        "risk_score": 42
    },
    "payload_preview": "@RSYTCD: 29\n",
    "request_sample": "@RSYTCD: 29\n",
    "payload_snippet": "@RSYTCD: 29",
    "evidence": {
        "request_sample": "@RSYTCD: 29\n",
        "payload_snippet": "@RSYTCD: 29",
        "classification_reason": "Type \u00ab port_3388_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "b82a8605edb9fbe5320381dcd4eabba4f709d04f",
    "protocol_details": {
        "payload_preview": "@RSYTCD: 29",
        "port": 3388,
        "service": "rdp",
        "service_label_fr": "RDP"
    },
    "evidence_snippet": "@RSYTCD: 29",
    "attack_vector": "port 3388 tcp \u00b7 via RDP:3388 \u00b7 (sonde \/ probe)",
    "target_port_label": "3388 \u00b7 RDP",
    "emulator_service": "rdp",
    "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_3388_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "classification_reason_label_fr": "Type \u00ab port_3388_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
        "confidence_pct": 65,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 40,
            "protocol": 36,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "rdp",
        "service_label_fr": "RDP",
        "dst_port": 3388,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-rdp",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "@RSYTCD: 29",
            "port": 3388,
            "service": "rdp",
            "service_label_fr": "RDP"
        },
        "attack_vector": "port 3388 tcp \u00b7 via RDP:3388 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "@RSYTCD: 29",
        "target_port_label": "3388 \u00b7 RDP",
        "emulator_service": "rdp",
        "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
        "confidence_factors_fr": "Confiance 65 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (104.152.52.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "rdp",
        "service_banner": "honeypot-rdp",
        "service_os": "linux",
        "dst_port": "3388"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "104.152.52.0\/24",
    "coordinated_ip_count": 8,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_rdp_probe",
        "rdp_emulated"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "bytes_in": 93,
    "payload_entropy": 4.82385726839113,
    "port_category": "registered",
    "org": "Rethem Hosting LLC",
    "service": "rdp",
    "app_proto": "rdp",
    "asn": 14987,
    "country": "US",
    "dst_port": 3388,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 46,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 46,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "bf3d40de88e59358890c997b5a1680f465627a06",
    "event_fingerprint": "83f5ef87ea7d8eb1277bc2b5f6d31ae331c17062",
    "classification_reason": "Type \u00ab port_3388_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
    "confidence": 0.55,
    "classification_confidence": 0.55,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 46,
        "novelty": 15,
        "risk_score": 42
    },
    "named_classification_skipped": true,
    "named_candidate": "rdp_probe",
    "service_name": "rdp",
    "risk_confidence_factor": 55,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14987,
        "org": "Rethem Hosting LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e7a83416e69650f8e7835005d4408764",
        "path_pattern_hash": "1eaff5b2cbc7ae4da9a37f80e2e2ad47"
    },
    "target_context": {
        "dst_port": 3388,
        "service": "rdp",
        "service_name": "rdp",
        "risk_score": 42
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: curl\/7.61.1\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: curl\/7.61.1\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: curl\/7.61.1\r\nAccept: *\/*\r\nConnection: close",
    "evidence": {
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: curl\/7.61.1\r\nAccept: *\/*\r\nConnection: close\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: curl\/7.61.1\r\nAccept: *\/*\r\nConnection: close",
        "classification_reason": "Type \u00ab port_3388_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "dcc012f11666f68e846d55a0736cdc9342e929e3",
    "protocol_details": {
        "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: curl\/7.61.1\r\nAccept: *\/*\r\nConnection: close",
        "port": 3388,
        "service": "rdp",
        "service_label_fr": "RDP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: curl\/7.61.1\r\nAccept: *\/*\r\nConnection: close",
    "attack_vector": "port 3388 tcp \u00b7 via RDP:3388 \u00b7 (sonde \/ probe)",
    "target_port_label": "3388 \u00b7 RDP",
    "emulator_service": "rdp",
    "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_3388_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "classification_reason_label_fr": "Type \u00ab port_3388_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
        "confidence_pct": 55,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 40,
            "protocol": 46,
            "novelty": 15,
            "risk_score": 42
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "rdp",
        "service_label_fr": "RDP",
        "dst_port": 3388,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-rdp",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: curl\/7.61.1\r\nAccept: *\/*\r\nConnection: close",
            "port": 3388,
            "service": "rdp",
            "service_label_fr": "RDP"
        },
        "attack_vector": "port 3388 tcp \u00b7 via RDP:3388 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33\r\nUser-Agent: curl\/7.61.1\r\nAccept: *\/*\r\nConnection: close",
        "target_port_label": "3388 \u00b7 RDP",
        "emulator_service": "rdp",
        "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
        "confidence_factors_fr": "Confiance 55 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "rdp",
        "service_banner": "honeypot-rdp",
        "service_os": "linux",
        "dst_port": "3388"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_get_probe",
        "net_rdp_probe",
        "rdp_emulated"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "bytes_in": 1487,
    "payload_entropy": 7.737047678352719,
    "port_category": "registered",
    "org": "Rethem Hosting LLC",
    "service": "rdp",
    "app_proto": "rdp",
    "asn": 14987,
    "country": "US",
    "dst_port": 3388,
    "risk_waf": 8,
    "risk_classification": 36,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 36,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 36,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "9c73cbdadc7f7f37b617938f4b05a25f503dd6d1",
    "event_fingerprint": "83f5ef87ea7d8eb1277bc2b5f6d31ae331c17062",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 36,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "rdp",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14987,
        "org": "Rethem Hosting LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "9cf94ccbd45adaebc45df6f3f9d0e1e8",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5"
    },
    "target_context": {
        "dst_port": 3388,
        "service": "rdp",
        "service_name": "rdp",
        "risk_score": 40
    },
    "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003f\ufffd\u000b(\u001b\ufffd \ufffd}\ufffd\u001fV#9\ufffd\ufffd\ufffdjy\u03c1&\ufffd\ufffd\ufffd\u0000\u001a\ufffd\u001d\u000e\ufffd\/ \ufffdo\ufffd\ufffd\ufffd=Z\ufffd\ufffd!\u0017\u0015)z\ufffd\u07b6\u03e2\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003f\ufffd\u000b(\u001b\ufffd \ufffd}\ufffd\u001fV#9\ufffd\ufffd\ufffdjy\u03c1&\ufffd\ufffd\ufffd\u0000\u001a\ufffd\u001d\u000e\ufffd\/ \ufffdo\ufffd\ufffd\ufffd=Z\ufffd\ufffd!\u0017\u0015)z\ufffd\u07b6\u03e2\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\f\u0000\n\u0011\ufffd\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u00002\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0004\ufffd\u0004\ufffd\u0011\ufffd\u0004\ufffd\u0100\ufffd\u0015\ufffd\ufffdk\ufffd\n\ufffd\ufffd\r\u0005`\ufffd0\u0005\ufffd\ufffd\ufffd",
        "payload_snippet": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003f\ufffd\u000b(\u001b\ufffd \ufffd}\ufffd\u001fV#9\ufffd\ufffd\ufffdjy\u03c1&\ufffd\ufffd\ufffd\u0000\u001a\ufffd\u001d\u000e\ufffd\/ \ufffdo\ufffd\ufffd\ufffd=Z\ufffd\ufffd!\u0017\u0015)z\ufffd\u07b6\u03e2\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "958d829352e0bf9ca882f3621444d8daf99fcc13",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003f\ufffd\u000b(\u001b\ufffd \ufffd}\ufffd\u001fV#9\ufffd\ufffd\ufffdjy\u03c1&\ufffd\ufffd\ufffd\u0000\u001a\ufffd\u001d\u000e\ufffd\/ \ufffdo\ufffd\ufffd\ufffd=Z\ufffd\ufffd!\u0017\u0015)z\ufffd\u07b6\u03e2\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
        "port": 3388,
        "service": "rdp",
        "service_label_fr": "RDP"
    },
    "evidence_snippet": "\ufffd\ufffdf\ufffd(\ufffd \ufffd}\ufffdV#9\ufffd\ufffd\ufffdjy\u03c1&\ufffd\ufffd\ufffd\ufffd\ufffd\/ \ufffdo\ufffd\ufffd\ufffd=Z\ufffd\ufffd!)z\ufffd\u07b6\u03e2\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd",
    "attack_vector": "postgres probe \u00b7 via RDP:3388 \u00b7 (sonde \/ probe)",
    "target_port_label": "3388 \u00b7 RDP",
    "emulator_service": "rdp",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 36,
            "behavior": 0,
            "geo": 40,
            "protocol": 36,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "rdp",
        "service_label_fr": "RDP",
        "dst_port": 3388,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-rdp",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0005\ufffd\u0001\u0000\u0005\ufffd\u0003\u0003f\ufffd\u000b(\u001b\ufffd \ufffd}\ufffd\u001fV#9\ufffd\ufffd\ufffdjy\u03c1&\ufffd\ufffd\ufffd\u0000\u001a\ufffd\u001d\u000e\ufffd\/ \ufffdo\ufffd\ufffd\ufffd=Z\ufffd\ufffd!\u0017\u0015)z\ufffd\u07b6\u03e2\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd\u0005\ufffd\ufffd\ufffd\ufffd\ufffd\u0000\u001a\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0005c\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000",
            "port": 3388,
            "service": "rdp",
            "service_label_fr": "RDP"
        },
        "attack_vector": "postgres probe \u00b7 via RDP:3388 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffdf\ufffd(\ufffd \ufffd}\ufffdV#9\ufffd\ufffd\ufffdjy\u03c1&\ufffd\ufffd\ufffd\ufffd\ufffd\/ \ufffdo\ufffd\ufffd\ufffd=Z\ufffd\ufffd!)z\ufffd\u07b6\u03e2\ufffd+\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffdc\ufffd",
        "target_port_label": "3388 \u00b7 RDP",
        "emulator_service": "rdp",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "rdp",
        "service_banner": "honeypot-rdp",
        "service_os": "linux",
        "dst_port": "3388"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_rdp_probe",
        "rdp_emulated",
        "tls_clienthello"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "fffb01fffb03fffd180d0a5562756e74752032322e3034204c54530d0a686f6e6579706f74206c6f67696e3a20",
    "emulator_response_len": 45,
    "bytes_in": 233,
    "payload_entropy": 5.400173145337043,
    "port_category": "well_known",
    "org": "Rethem Hosting LLC",
    "service": "telnet",
    "app_proto": "telnet",
    "asn": 14987,
    "country": "US",
    "dst_port": 23,
    "risk_waf": 8,
    "risk_classification": 85,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 36,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 85,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 15
    },
    "risk_score": 52,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "ee98e358747c5d752a0eb3d3b34c59d0ffe7f883",
    "event_fingerprint": "79b983d64b1c5573cc70fb9163374500a6810d67",
    "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 84,
    "precision_signals": [
        "pat-0842"
    ],
    "kb_rule_ids": [
        "pat-0842"
    ],
    "matched_patterns": [
        "pat-0842"
    ],
    "matched_pattern_names": [
        "CRS 921130 duplicate CL"
    ],
    "pattern_ids": [
        "pat-0842"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 85,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 15,
        "risk_score": 52,
        "correlation_boost": 18
    },
    "named_classification_skipped": false,
    "service_name": "telnet",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14987,
        "org": "Rethem Hosting LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "1b681f79fb39b6cbf7b332ed7bf65e66",
        "path_pattern_hash": "06b55a159b5d265fc8976ebb0a005f8a"
    },
    "target_context": {
        "dst_port": 23,
        "service": "telnet",
        "service_name": "telnet",
        "risk_score": 52
    },
    "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:23\r\nUser-Agent: curl\/7.61.1\r\nAccept: *\/*\r\nContent-Type: application\/json\r\nContent-Length: 102\r",
    "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:23\r\nUser-Agent: curl\/7.61.1\r\nAccept: *\/*\r\nContent-Type: application\/json\r\nContent-Length: 102\r\n\r\n{\"jsonrpc\":\"2.0\",\"method\":\"web3_clientVersion\",\"params\":[],\"id\":67}%!(EXTRA string=web3_clientVersion)",
    "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:23\r\nUser-Agent: curl\/7.61.1\r\nAccept: *\/*\r\nContent-Type: application\/json\r\nContent-Length: 102",
    "evidence": {
        "request_sample": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:23\r\nUser-Agent: curl\/7.61.1\r\nAccept: *\/*\r\nContent-Type: application\/json\r\nContent-Length: 102\r\n\r\n{\"jsonrpc\":\"2.0\",\"method\":\"web3_clientVersion\",\"params\":[],\"id\":67}%!(EXTRA string=web3_clientVersion)",
        "payload_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:23\r\nUser-Agent: curl\/7.61.1\r\nAccept: *\/*\r\nContent-Type: application\/json\r\nContent-Length: 102",
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "web_injection"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "daa006d02fb283680d54ebb45b6fec75f5277492",
    "protocol_details": {
        "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:23\r\nUser-Agent: curl\/7.61.1\r\nAccept: *\/*\r\nContent-Type: application\/json\r\nContent-Length: 102",
        "port": 23,
        "service": "telnet",
        "service_label_fr": "Telnet"
    },
    "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:23\r\nUser-Agent: curl\/7.61.1\r\nAccept: *\/*\r\nContent-Type: application\/json\r\nContent-Length: 102",
    "attack_vector": "http smuggling probe \u00b7 via Telnet:23 \u00b7 (tentative d'exploit)",
    "target_port_label": "23 \u00b7 Telnet",
    "emulator_service": "telnet",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab http_smuggling_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 52\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 100 % \u2014 via Telnet \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 85,
            "behavior": 0,
            "geo": 40,
            "protocol": 36,
            "novelty": 15,
            "risk_score": 52,
            "correlation_boost": 18
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 52,
        "risk_label": "Moyen",
        "service_name": "telnet",
        "service_label_fr": "Telnet",
        "dst_port": 23,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0842"
        ],
        "tags_summary_labels_fr": [
            "pat-0842"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-telnet",
        "correlation_flags": [
            "scan_coordonn\u00e9",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +18",
        "protocol_details": {
            "payload_preview": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:23\r\nUser-Agent: curl\/7.61.1\r\nAccept: *\/*\r\nContent-Type: application\/json\r\nContent-Length: 102",
            "port": 23,
            "service": "telnet",
            "service_label_fr": "Telnet"
        },
        "attack_vector": "http smuggling probe \u00b7 via Telnet:23 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "POST \/ HTTP\/1.1\r\nHost: 62.3.50.33:23\r\nUser-Agent: curl\/7.61.1\r\nAccept: *\/*\r\nContent-Type: application\/json\r\nContent-Length: 102",
        "target_port_label": "23 \u00b7 Telnet",
        "emulator_service": "telnet",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (104.152.52.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "telnet",
        "service_banner": "honeypot-telnet",
        "service_os": "linux",
        "dst_port": "23"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "rdp",
        "telnet"
    ],
    "multi_protocol_window_s": 300,
    "coordinated_scan": true,
    "coordinated_subnet": "104.152.52.0\/24",
    "coordinated_ip_count": 15,
    "behavior_alerts": [
        "coordinated_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 18,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_telnet_probe",
        "telnet_emulated"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "bytes_in": 23,
    "payload_entropy": 2.869051181926132,
    "port_category": "registered",
    "org": "Rethem Hosting LLC",
    "service": "rdp",
    "app_proto": "rdp",
    "asn": 14987,
    "country": "US",
    "dst_port": 3388,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "aec477e58f1c183580c4e59c6d675789c96fdbee",
    "event_fingerprint": "83f5ef87ea7d8eb1277bc2b5f6d31ae331c17062",
    "classification_confidence": 0.68,
    "confidence": 0.68,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 18
    },
    "service_name": "rdp",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14987,
        "org": "Rethem Hosting LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "fbdd8a43325d7d2993b6b92d0fa1a02b",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 3388,
        "service": "rdp",
        "service_name": "rdp",
        "risk_score": 45
    },
    "payload_preview": "\u0006\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\t \u0018\u0201\u00008\ufffd\u0004\ufffd",
    "request_sample": "\u0006\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\t \u0018\u0201\u00008\ufffd\u0004\ufffd",
    "payload_snippet": "\u0006\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\t \u0018\u0201\u00008\ufffd\u0004\ufffd",
    "evidence": {
        "request_sample": "\u0006\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\t \u0018\u0201\u00008\ufffd\u0004\ufffd",
        "payload_snippet": "\u0006\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\t \u0018\u0201\u00008\ufffd\u0004\ufffd",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "806b8c86b37e8430d8084f923301c46082fe395c",
    "protocol_details": {
        "payload_preview": "\u0006\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\t \u0018\u0201\u00008\ufffd\u0004\ufffd",
        "port": 3388,
        "service": "rdp",
        "service_label_fr": "RDP"
    },
    "evidence_snippet": "\ufffd\t \u02018\ufffd\ufffd",
    "attack_vector": "rdp probe \u00b7 via RDP:3388 \u00b7 (sonde \/ probe)",
    "target_port_label": "3388 \u00b7 RDP",
    "emulator_service": "rdp",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 68,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 40,
            "protocol": 36,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 18
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "rdp",
        "service_label_fr": "RDP",
        "dst_port": 3388,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-rdp",
        "correlation_flags": [
            "scan_coordonn\u00e9",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +18",
        "protocol_details": {
            "payload_preview": "\u0006\u0000\ufffd\u0007\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\t \u0018\u0201\u00008\ufffd\u0004\ufffd",
            "port": 3388,
            "service": "rdp",
            "service_label_fr": "RDP"
        },
        "attack_vector": "rdp probe \u00b7 via RDP:3388 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\t \u02018\ufffd\ufffd",
        "target_port_label": "3388 \u00b7 RDP",
        "emulator_service": "rdp",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 68 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (104.152.52.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "rdp",
        "service_banner": "honeypot-rdp",
        "service_os": "linux",
        "dst_port": "3388"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "rdp",
        "telnet"
    ],
    "multi_protocol_window_s": 300,
    "coordinated_scan": true,
    "coordinated_subnet": "104.152.52.0\/24",
    "coordinated_ip_count": 15,
    "behavior_alerts": [
        "coordinated_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 18,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_rdp_probe",
        "rdp_emulated"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "fffb01fffb03fffd180d0a5562756e74752032322e3034204c54530d0a686f6e6579706f74206c6f67696e3a20",
    "emulator_response_len": 45,
    "bytes_in": 47,
    "payload_entropy": 2.407956137576773,
    "port_category": "well_known",
    "org": "Rethem Hosting LLC",
    "service": "telnet",
    "app_proto": "telnet",
    "asn": 14987,
    "country": "US",
    "dst_port": 23,
    "risk_waf": 8,
    "risk_classification": 56,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "e1a6ee059e29da8d573782e6bb1d463edb0e3603",
    "event_fingerprint": "7830084f3631fd67335daad60c7f9167c0b27a2d",
    "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 83,
    "precision_signals": [
        "pat-0519",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0519",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0519",
        "pat-0768",
        "pat-0771",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "MSSQL TDS prelogin",
        "Mumble ping",
        "STUN binding",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0519",
        "pat-0768",
        "pat-0771",
        "pat-0554",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 56,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 0,
        "risk_score": 35,
        "correlation_boost": 18
    },
    "named_classification_skipped": false,
    "service_name": "telnet",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14987,
        "org": "Rethem Hosting LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "1d4de02e442f4f701f78f2c23d15b264",
        "path_pattern_hash": "285321e27377a1f85e5a231ca6cbffb2"
    },
    "target_context": {
        "dst_port": 23,
        "service": "telnet",
        "service_name": "telnet",
        "risk_score": 35
    },
    "payload_preview": "\u0012\u0001\u0000\/\u0000\u0000\u0002\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000",
    "request_sample": "\u0012\u0001\u0000\/\u0000\u0000\u0002\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000",
    "payload_snippet": "\u0012\u0001\u0000\/\u0000\u0000\u0002\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0012\u0001\u0000\/\u0000\u0000\u0002\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000",
        "payload_snippet": "\u0012\u0001\u0000\/\u0000\u0000\u0002\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "database_scan"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "0f9baa6f17a97fbe3632ea3d17a901981bcd90af",
    "protocol_details": {
        "payload_preview": "\u0012\u0001\u0000\/\u0000\u0000\u0002\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000",
        "port": 23,
        "service": "telnet",
        "service_label_fr": "Telnet"
    },
    "evidence_snippet": "\/ !\"&\ufffd",
    "attack_vector": "mssql tds \u00b7 via Telnet:23 \u00b7 (sonde \/ probe)",
    "target_port_label": "23 \u00b7 Telnet",
    "emulator_service": "telnet",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 56,
            "behavior": 0,
            "geo": 40,
            "protocol": 36,
            "novelty": 0,
            "risk_score": 35,
            "correlation_boost": 18
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "telnet",
        "service_label_fr": "Telnet",
        "dst_port": 23,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0519",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "pat-0519",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-telnet",
        "correlation_flags": [
            "scan_coordonn\u00e9",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +18",
        "protocol_details": {
            "payload_preview": "\u0012\u0001\u0000\/\u0000\u0000\u0002\u0000\u0000\u0000\u001a\u0000\u0006\u0001\u0000 \u0000\u0001\u0002\u0000!\u0000\u0001\u0003\u0000\"\u0000\u0004\u0004\u0000&\u0000\u0001\ufffd\u0000\u0000\u0000\u0000\u0000\u0000\u0001\u0000\u0000\u0000\u0000\u0000\u0000",
            "port": 23,
            "service": "telnet",
            "service_label_fr": "Telnet"
        },
        "attack_vector": "mssql tds \u00b7 via Telnet:23 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\/ !\"&\ufffd",
        "target_port_label": "23 \u00b7 Telnet",
        "emulator_service": "telnet",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (104.152.52.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "telnet",
        "service_banner": "honeypot-telnet",
        "service_os": "linux",
        "dst_port": "23"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "rdp",
        "telnet"
    ],
    "multi_protocol_window_s": 300,
    "coordinated_scan": true,
    "coordinated_subnet": "104.152.52.0\/24",
    "coordinated_ip_count": 14,
    "behavior_alerts": [
        "coordinated_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 18,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "mssql_tds",
        "net_mssql_tds",
        "telnet_emulated"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "fffb01fffb03fffd180d0a5562756e74752032322e3034204c54530d0a686f6e6579706f74206c6f67696e3a20",
    "emulator_response_len": 45,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "well_known",
    "org": "Rethem Hosting LLC",
    "service": "telnet",
    "app_proto": "telnet",
    "asn": 14987,
    "country": "US",
    "dst_port": 23,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "ee98e358747c5d752a0eb3d3b34c59d0ffe7f883",
    "event_fingerprint": "79b983d64b1c5573cc70fb9163374500a6810d67",
    "classification_reason": "Type \u00ab port_23_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
    "confidence": 0.73,
    "classification_confidence": 0.73,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 18
    },
    "named_classification_skipped": true,
    "named_candidate": "telnet_probe",
    "service_name": "telnet",
    "risk_confidence_factor": 55,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14987,
        "org": "Rethem Hosting LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "2bb94c377622e6c9a2e704e9148568af"
    },
    "target_context": {
        "dst_port": 23,
        "service": "telnet",
        "service_name": "telnet",
        "risk_score": 42
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "375a927bb9bbd2eb33edd9b4264c0c0b9afc3f8d",
    "protocol_details": {
        "port": 23,
        "service": "telnet",
        "service_label_fr": "Telnet"
    },
    "attack_vector": "port 23 tcp \u00b7 via Telnet:23 \u00b7 (sonde \/ probe)",
    "target_port_label": "23 \u00b7 Telnet",
    "emulator_service": "telnet",
    "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_23_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "classification_reason_label_fr": "Type \u00ab port_23_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
        "confidence_pct": 73,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 40,
            "protocol": 36,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 18
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "telnet",
        "service_label_fr": "Telnet",
        "dst_port": 23,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-telnet",
        "correlation_flags": [
            "scan_coordonn\u00e9",
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9",
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +18",
        "protocol_details": {
            "port": 23,
            "service": "telnet",
            "service_label_fr": "Telnet"
        },
        "attack_vector": "port 23 tcp \u00b7 via Telnet:23 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "23 \u00b7 Telnet",
        "emulator_service": "telnet",
        "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
        "confidence_factors_fr": "Confiance 73 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (104.152.52.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "telnet",
        "service_banner": "honeypot-telnet",
        "service_os": "linux",
        "dst_port": "23"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "rdp",
        "telnet"
    ],
    "multi_protocol_window_s": 300,
    "coordinated_scan": true,
    "coordinated_subnet": "104.152.52.0\/24",
    "coordinated_ip_count": 12,
    "behavior_alerts": [
        "coordinated_scan",
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 18,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_telnet_probe",
        "telnet_emulated"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "Rethem Hosting LLC",
    "service": "rdp",
    "app_proto": "rdp",
    "asn": 14987,
    "country": "US",
    "dst_port": 3388,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "aec477e58f1c183580c4e59c6d675789c96fdbee",
    "event_fingerprint": "83f5ef87ea7d8eb1277bc2b5f6d31ae331c17062",
    "classification_reason": "Type \u00ab port_3388_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
    "confidence": 0.65,
    "classification_confidence": 0.65,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 10
    },
    "named_classification_skipped": true,
    "named_candidate": "rdp_probe",
    "service_name": "rdp",
    "risk_confidence_factor": 55,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14987,
        "org": "Rethem Hosting LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "1eaff5b2cbc7ae4da9a37f80e2e2ad47"
    },
    "target_context": {
        "dst_port": 3388,
        "service": "rdp",
        "service_name": "rdp",
        "risk_score": 42
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c05b03c2e51a8f59a7f00affb6f25dc3db835577",
    "protocol_details": {
        "port": 3388,
        "service": "rdp",
        "service_label_fr": "RDP"
    },
    "attack_vector": "port 3388 tcp \u00b7 via RDP:3388 \u00b7 (sonde \/ probe)",
    "target_port_label": "3388 \u00b7 RDP",
    "emulator_service": "rdp",
    "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_3388_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "classification_reason_label_fr": "Type \u00ab port_3388_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
        "confidence_pct": 65,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 40,
            "protocol": 36,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "rdp",
        "service_label_fr": "RDP",
        "dst_port": 3388,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-rdp",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "port": 3388,
            "service": "rdp",
            "service_label_fr": "RDP"
        },
        "attack_vector": "port 3388 tcp \u00b7 via RDP:3388 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "3388 \u00b7 RDP",
        "emulator_service": "rdp",
        "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
        "confidence_factors_fr": "Confiance 65 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (104.152.52.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "rdp",
        "service_banner": "honeypot-rdp",
        "service_os": "linux",
        "dst_port": "3388"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "104.152.52.0\/24",
    "coordinated_ip_count": 8,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_rdp_probe",
        "rdp_emulated"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "bytes_in": 3,
    "payload_entropy": 1.584962500721156,
    "port_category": "registered",
    "org": "Rethem Hosting LLC",
    "service": "rdp",
    "app_proto": "rdp",
    "asn": 14987,
    "country": "US",
    "dst_port": 3388,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "549bfa21fd731668868b1616e117f47956918b35",
    "event_fingerprint": "83f5ef87ea7d8eb1277bc2b5f6d31ae331c17062",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "rdp",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14987,
        "org": "Rethem Hosting LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "da075e9d699084fc189cdd233081c49f",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 3388,
        "service": "rdp",
        "service_name": "rdp",
        "risk_score": 45
    },
    "payload_preview": "\u0005\u0001\u0000",
    "request_sample": "\u0005\u0001\u0000",
    "payload_snippet": "\u0005\u0001\u0000",
    "evidence": {
        "request_sample": "\u0005\u0001\u0000",
        "payload_snippet": "\u0005\u0001\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "5de1dd9d9bc018c7a797b7e9640204317a40caa4",
    "protocol_details": {
        "payload_preview": "\u0005\u0001\u0000",
        "port": 3388,
        "service": "rdp",
        "service_label_fr": "RDP"
    },
    "attack_vector": "rdp probe \u00b7 via RDP:3388 \u00b7 (sonde \/ probe)",
    "target_port_label": "3388 \u00b7 RDP",
    "emulator_service": "rdp",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 40,
            "protocol": 36,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "rdp",
        "service_label_fr": "RDP",
        "dst_port": 3388,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-rdp",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\u0005\u0001\u0000",
            "port": 3388,
            "service": "rdp",
            "service_label_fr": "RDP"
        },
        "attack_vector": "rdp probe \u00b7 via RDP:3388 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "3388 \u00b7 RDP",
        "emulator_service": "rdp",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (104.152.52.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "rdp",
        "service_banner": "honeypot-rdp",
        "service_os": "linux",
        "dst_port": "3388"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "104.152.52.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_rdp_probe",
        "rdp_emulated",
        "socks5_greeting"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "bytes_in": 10,
    "payload_entropy": 2.0464393446710156,
    "port_category": "registered",
    "org": "Rethem Hosting LLC",
    "service": "rdp",
    "app_proto": "rdp",
    "asn": 14987,
    "country": "US",
    "dst_port": 3388,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 45,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "2d009dc0affca07cded0c7a5982ebc3c34c44e3d",
    "event_fingerprint": "83f5ef87ea7d8eb1277bc2b5f6d31ae331c17062",
    "classification_confidence": 0.6,
    "confidence": 0.6,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 0,
        "risk_score": 45,
        "correlation_boost": 10
    },
    "service_name": "rdp",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14987,
        "org": "Rethem Hosting LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e78176d7679ebfecfd6a90ad2167f273",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 3388,
        "service": "rdp",
        "service_name": "rdp",
        "risk_score": 45
    },
    "payload_preview": "\u0004\u0001\u0000P\u0001\u0000\u0000\u0001\u0000",
    "request_sample": "\u0004\u0001\u0000P\u0001\u0000\u0000\u0001\u0000",
    "payload_snippet": "\u0004\u0001\u0000P\u0001\u0000\u0000\u0001\u0000",
    "evidence": {
        "request_sample": "\u0004\u0001\u0000P\u0001\u0000\u0000\u0001\u0000",
        "payload_snippet": "\u0004\u0001\u0000P\u0001\u0000\u0000\u0001\u0000",
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "fd6ffde13b9950c12c3ac36c3402dde88e8e5d65",
    "protocol_details": {
        "payload_preview": "\u0004\u0001\u0000P\u0001\u0000\u0000\u0001\u0000",
        "port": 3388,
        "service": "rdp",
        "service_label_fr": "RDP"
    },
    "evidence_snippet": "P",
    "attack_vector": "rdp probe \u00b7 via RDP:3388 \u00b7 (sonde \/ probe)",
    "target_port_label": "3388 \u00b7 RDP",
    "emulator_service": "rdp",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab rdp_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 45\/100",
        "confidence_pct": 60,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 40,
            "protocol": 36,
            "novelty": 0,
            "risk_score": 45,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 45,
        "risk_label": "Moyen",
        "service_name": "rdp",
        "service_label_fr": "RDP",
        "dst_port": 3388,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-rdp",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\u0004\u0001\u0000P\u0001\u0000\u0000\u0001\u0000",
            "port": 3388,
            "service": "rdp",
            "service_label_fr": "RDP"
        },
        "attack_vector": "rdp probe \u00b7 via RDP:3388 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "P",
        "target_port_label": "3388 \u00b7 RDP",
        "emulator_service": "rdp",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 60 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (104.152.52.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "rdp",
        "service_banner": "honeypot-rdp",
        "service_os": "linux",
        "dst_port": "3388"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "104.152.52.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_rdp_probe",
        "rdp_emulated",
        "socks4_greeting"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "bytes_in": 12,
    "payload_entropy": 3.2516291673878226,
    "port_category": "registered",
    "org": "Rethem Hosting LLC",
    "service": "rdp",
    "app_proto": "rdp",
    "asn": 14987,
    "country": "US",
    "dst_port": 3388,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "0ef11add41a230e81ef521c6e9ce9cf1795d3be1",
    "event_fingerprint": "83f5ef87ea7d8eb1277bc2b5f6d31ae331c17062",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 49%",
    "confidence": 0.59,
    "classification_confidence": 0.59,
    "precision_score": 58,
    "precision_signals": [
        "pat-0391"
    ],
    "kb_rule_ids": [
        "pat-0391"
    ],
    "matched_patterns": [
        "pat-0391"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253"
    ],
    "pattern_ids": [
        "pat-0391"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 10
    },
    "named_classification_skipped": true,
    "named_candidate": "ssh_probe",
    "service_name": "rdp",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14987,
        "org": "Rethem Hosting LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e9e55307b9c6c1bf5bae2abdb628281d",
        "path_pattern_hash": "1eaff5b2cbc7ae4da9a37f80e2e2ad47"
    },
    "target_context": {
        "dst_port": 3388,
        "service": "rdp",
        "service_name": "rdp",
        "risk_score": 42
    },
    "payload_preview": "SSH-2.0-Go\r\n",
    "request_sample": "SSH-2.0-Go\r\n",
    "payload_snippet": "SSH-2.0-Go",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n",
        "payload_snippet": "SSH-2.0-Go",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f72f9a3a72f0f7696d1a9b3a5e6d1d54b6717f3d",
    "protocol_details": {
        "payload_preview": "SSH-2.0-Go",
        "port": 3388,
        "service": "rdp",
        "service_label_fr": "RDP"
    },
    "evidence_snippet": "SSH-2.0-Go",
    "attack_vector": "port 3388 tcp \u00b7 via RDP:3388 \u00b7 (sonde \/ probe)",
    "target_port_label": "3388 \u00b7 RDP",
    "emulator_service": "rdp",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 49%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
        "confidence_pct": 59,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 40,
            "protocol": 36,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "rdp",
        "service_label_fr": "RDP",
        "dst_port": 3388,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0391"
        ],
        "tags_summary_labels_fr": [
            "pat-0391"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-rdp",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "SSH-2.0-Go",
            "port": 3388,
            "service": "rdp",
            "service_label_fr": "RDP"
        },
        "attack_vector": "port 3388 tcp \u00b7 via RDP:3388 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-Go",
        "target_port_label": "3388 \u00b7 RDP",
        "emulator_service": "rdp",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9 \u00b7 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
        "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (104.152.52.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "rdp",
        "service_banner": "honeypot-rdp",
        "service_os": "linux",
        "dst_port": "3388"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "104.152.52.0\/24",
    "coordinated_ip_count": 3,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_rdp_probe",
        "rdp_emulated",
        "ssh_banner"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "bytes_in": 16,
    "payload_entropy": 3.0306390622295662,
    "port_category": "registered",
    "org": "Rethem Hosting LLC",
    "service": "rdp",
    "app_proto": "rdp",
    "asn": 14987,
    "country": "US",
    "dst_port": 3390,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "556ffa544c119ec94ae6ddb83ff59318e0128f85",
    "event_fingerprint": "700e745442e0a767acc5398300bd052d20e6e907",
    "classification_reason": "Type \u00ab port_3390_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
    "confidence": 0.65,
    "classification_confidence": 0.65,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 10
    },
    "named_classification_skipped": true,
    "named_candidate": "rdp_probe",
    "service_name": "rdp",
    "risk_confidence_factor": 55,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14987,
        "org": "Rethem Hosting LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "8e65243748b47577405e64a8da4bd2c8",
        "path_pattern_hash": "1e06dc013597a552420cc3c139fe1caa"
    },
    "target_context": {
        "dst_port": 3390,
        "service": "rdp",
        "service_name": "rdp",
        "risk_score": 42
    },
    "payload_preview": "\u0000\u000e8\u001a#9\ufffdCXw-\u0000\u0000\u0000\u0000\u0000",
    "request_sample": "\u0000\u000e8\u001a#9\ufffdCXw-\u0000\u0000\u0000\u0000\u0000",
    "payload_snippet": "\u0000\u000e8\u001a#9\ufffdCXw-\u0000\u0000\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0000\u000e8\u001a#9\ufffdCXw-\u0000\u0000\u0000\u0000\u0000",
        "payload_snippet": "\u0000\u000e8\u001a#9\ufffdCXw-\u0000\u0000\u0000\u0000\u0000",
        "classification_reason": "Type \u00ab port_3390_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e0924d21b899096c909f628ed5e455c52da0bb6d",
    "protocol_details": {
        "payload_preview": "\u0000\u000e8\u001a#9\ufffdCXw-\u0000\u0000\u0000\u0000\u0000",
        "port": 3390,
        "service": "rdp",
        "service_label_fr": "RDP"
    },
    "evidence_snippet": "8#9\ufffdCXw-",
    "attack_vector": "port 3390 tcp \u00b7 via RDP:3390 \u00b7 (sonde \/ probe)",
    "target_port_label": "3390 \u00b7 RDP",
    "emulator_service": "rdp",
    "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_3390_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "classification_reason_label_fr": "Type \u00ab port_3390_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
        "confidence_pct": 65,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 40,
            "protocol": 36,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "rdp",
        "service_label_fr": "RDP",
        "dst_port": 3390,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-rdp",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\u0000\u000e8\u001a#9\ufffdCXw-\u0000\u0000\u0000\u0000\u0000",
            "port": 3390,
            "service": "rdp",
            "service_label_fr": "RDP"
        },
        "attack_vector": "port 3390 tcp \u00b7 via RDP:3390 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "8#9\ufffdCXw-",
        "target_port_label": "3390 \u00b7 RDP",
        "emulator_service": "rdp",
        "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
        "confidence_factors_fr": "Confiance 65 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (104.152.52.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "rdp",
        "service_banner": "honeypot-rdp",
        "service_os": "linux",
        "dst_port": "3390"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "104.152.52.0\/24",
    "coordinated_ip_count": 10,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_rdp_probe",
        "rdp_emulated"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "bytes_in": 8,
    "payload_entropy": 1.2987949406953985,
    "port_category": "registered",
    "org": "Rethem Hosting LLC",
    "service": "rdp",
    "app_proto": "rdp",
    "asn": 14987,
    "country": "US",
    "dst_port": 3390,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "556ffa544c119ec94ae6ddb83ff59318e0128f85",
    "event_fingerprint": "700e745442e0a767acc5398300bd052d20e6e907",
    "classification_reason": "Type \u00ab port_3390_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
    "confidence": 0.65,
    "classification_confidence": 0.65,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 10
    },
    "named_classification_skipped": true,
    "named_candidate": "rdp_probe",
    "service_name": "rdp",
    "risk_confidence_factor": 55,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14987,
        "org": "Rethem Hosting LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "3b9258d8a9c93aeb355ea26fc4bfa1b7",
        "path_pattern_hash": "1e06dc013597a552420cc3c139fe1caa"
    },
    "target_context": {
        "dst_port": 3390,
        "service": "rdp",
        "service_name": "rdp",
        "risk_score": 42
    },
    "payload_preview": "\u0000\u0000\u0000\b\u0000\ufffd\u0000\ufffd",
    "request_sample": "\u0000\u0000\u0000\b\u0000\ufffd\u0000\ufffd",
    "payload_snippet": "\u0000\u0000\u0000\b\u0000\ufffd\u0000\ufffd",
    "evidence": {
        "request_sample": "\u0000\u0000\u0000\b\u0000\ufffd\u0000\ufffd",
        "payload_snippet": "\u0000\u0000\u0000\b\u0000\ufffd\u0000\ufffd",
        "classification_reason": "Type \u00ab port_3390_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e0e43185854f2b555350629ea1d50d6a68bb4d9f",
    "protocol_details": {
        "payload_preview": "\u0000\u0000\u0000\b\u0000\ufffd\u0000\ufffd",
        "port": 3390,
        "service": "rdp",
        "service_label_fr": "RDP"
    },
    "evidence_snippet": "\ufffd\ufffd",
    "attack_vector": "port 3390 tcp \u00b7 via RDP:3390 \u00b7 (sonde \/ probe)",
    "target_port_label": "3390 \u00b7 RDP",
    "emulator_service": "rdp",
    "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_3390_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "classification_reason_label_fr": "Type \u00ab port_3390_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
        "confidence_pct": 65,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 40,
            "protocol": 36,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "rdp",
        "service_label_fr": "RDP",
        "dst_port": 3390,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-rdp",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\u0000\u0000\u0000\b\u0000\ufffd\u0000\ufffd",
            "port": 3390,
            "service": "rdp",
            "service_label_fr": "RDP"
        },
        "attack_vector": "port 3390 tcp \u00b7 via RDP:3390 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd",
        "target_port_label": "3390 \u00b7 RDP",
        "emulator_service": "rdp",
        "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
        "confidence_factors_fr": "Confiance 65 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (104.152.52.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "rdp",
        "service_banner": "honeypot-rdp",
        "service_os": "linux",
        "dst_port": "3390"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "104.152.52.0\/24",
    "coordinated_ip_count": 8,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_rdp_probe",
        "rdp_emulated"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "bytes_in": 8,
    "payload_entropy": 2.4056390622295662,
    "port_category": "registered",
    "org": "Rethem Hosting LLC",
    "service": "rdp",
    "app_proto": "rdp",
    "asn": 14987,
    "country": "US",
    "dst_port": 3390,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 42,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "556ffa544c119ec94ae6ddb83ff59318e0128f85",
    "event_fingerprint": "700e745442e0a767acc5398300bd052d20e6e907",
    "classification_reason": "Type \u00ab port_3390_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
    "confidence": 0.65,
    "classification_confidence": 0.65,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 0,
        "risk_score": 42,
        "correlation_boost": 10
    },
    "named_classification_skipped": true,
    "named_candidate": "rdp_probe",
    "service_name": "rdp",
    "risk_confidence_factor": 55,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14987,
        "org": "Rethem Hosting LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "694bec2754742b999eb8e010ccd19ce8",
        "path_pattern_hash": "1e06dc013597a552420cc3c139fe1caa"
    },
    "target_context": {
        "dst_port": 3390,
        "service": "rdp",
        "service_name": "rdp",
        "risk_score": 42
    },
    "payload_preview": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
    "request_sample": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
    "payload_snippet": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
    "evidence": {
        "request_sample": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
        "payload_snippet": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
        "classification_reason": "Type \u00ab port_3390_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d9fcd4ea21821eba9e37203f4d3fa9ea210b8774",
    "protocol_details": {
        "payload_preview": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
        "port": 3390,
        "service": "rdp",
        "service_label_fr": "RDP"
    },
    "evidence_snippet": "\ufffd\/",
    "attack_vector": "port 3390 tcp \u00b7 via RDP:3390 \u00b7 (sonde \/ probe)",
    "target_port_label": "3390 \u00b7 RDP",
    "emulator_service": "rdp",
    "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_3390_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "classification_reason_label_fr": "Type \u00ab port_3390_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
        "confidence_pct": 65,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 40,
            "protocol": 36,
            "novelty": 0,
            "risk_score": 42,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "rdp",
        "service_label_fr": "RDP",
        "dst_port": 3390,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-rdp",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "\u0000\u0000\u0000\b\u0004\ufffd\u0016\/",
            "port": 3390,
            "service": "rdp",
            "service_label_fr": "RDP"
        },
        "attack_vector": "port 3390 tcp \u00b7 via RDP:3390 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\/",
        "target_port_label": "3390 \u00b7 RDP",
        "emulator_service": "rdp",
        "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
        "confidence_factors_fr": "Confiance 65 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (104.152.52.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "rdp",
        "service_banner": "honeypot-rdp",
        "service_os": "linux",
        "dst_port": "3390"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "104.152.52.0\/24",
    "coordinated_ip_count": 8,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_rdp_probe",
        "rdp_emulated"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "bytes_in": 110,
    "payload_entropy": 5.049154318239882,
    "port_category": "registered",
    "org": "Rethem Hosting LLC",
    "service": "rdp",
    "app_proto": "rdp",
    "asn": 14987,
    "country": "US",
    "dst_port": 3390,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 36,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 15
    },
    "risk_score": 42,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "556ffa544c119ec94ae6ddb83ff59318e0128f85",
    "event_fingerprint": "700e745442e0a767acc5398300bd052d20e6e907",
    "classification_reason": "Type \u00ab port_3390_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
    "confidence": 0.65,
    "classification_confidence": 0.65,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 15,
        "risk_score": 42,
        "correlation_boost": 10
    },
    "named_classification_skipped": true,
    "named_candidate": "rdp_probe",
    "service_name": "rdp",
    "risk_confidence_factor": 55,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "US",
        "asn": 14987,
        "org": "Rethem Hosting LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "3ff0757137b8aa9cf8c22dc0df751617",
        "path_pattern_hash": "1e06dc013597a552420cc3c139fe1caa"
    },
    "target_context": {
        "dst_port": 3390,
        "service": "rdp",
        "service_name": "rdp",
        "risk_score": 42
    },
    "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33\/ RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: VLC media player\/1.3.0 \r\nAccept: application\/sdp\r\n\r\n",
    "request_sample": "OPTIONS rtsp:\/\/62.3.50.33\/ RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: VLC media player\/1.3.0 \r\nAccept: application\/sdp\r\n\r\n",
    "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33\/ RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: VLC media player\/1.3.0 \r\nAccept: application\/sdp",
    "evidence": {
        "request_sample": "OPTIONS rtsp:\/\/62.3.50.33\/ RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: VLC media player\/1.3.0 \r\nAccept: application\/sdp\r\n\r\n",
        "payload_snippet": "OPTIONS rtsp:\/\/62.3.50.33\/ RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: VLC media player\/1.3.0 \r\nAccept: application\/sdp",
        "classification_reason": "Type \u00ab port_3390_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "ad817e53a3eaf6f631bd04a9687640fa22379f78",
    "protocol_details": {
        "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33\/ RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: VLC media player\/1.3.0 \r\nAccept: application\/sdp",
        "port": 3390,
        "service": "rdp",
        "service_label_fr": "RDP"
    },
    "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33\/ RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: VLC media player\/1.3.0 \r\nAccept: application\/sdp",
    "attack_vector": "port 3390 tcp \u00b7 via RDP:3390 \u00b7 (sonde \/ probe)",
    "target_port_label": "3390 \u00b7 RDP",
    "emulator_service": "rdp",
    "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_3390_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "classification_reason_label_fr": "Type \u00ab port_3390_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 42\/100",
        "confidence_pct": 65,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 40,
            "protocol": 36,
            "novelty": 15,
            "risk_score": 42,
            "correlation_boost": 10
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "reconnaissance",
        "attack_chain_stage_label_fr": "Reconnaissance",
        "risk_score": 42,
        "risk_label": "Moyen",
        "service_name": "rdp",
        "service_label_fr": "RDP",
        "dst_port": 3390,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-rdp",
        "correlation_flags": [
            "scan_coordonn\u00e9"
        ],
        "correlation_flags_labels_fr": [
            "Scan coordonn\u00e9"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +10",
        "protocol_details": {
            "payload_preview": "OPTIONS rtsp:\/\/62.3.50.33\/ RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: VLC media player\/1.3.0 \r\nAccept: application\/sdp",
            "port": 3390,
            "service": "rdp",
            "service_label_fr": "RDP"
        },
        "attack_vector": "port 3390 tcp \u00b7 via RDP:3390 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "OPTIONS rtsp:\/\/62.3.50.33\/ RTSP\/1.0\r\nCSeq: 1\r\nUser-Agent: VLC media player\/1.3.0 \r\nAccept: application\/sdp",
        "target_port_label": "3390 \u00b7 RDP",
        "emulator_service": "rdp",
        "confidence_reason": "Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes",
        "confidence_factors_fr": "Confiance 65 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +10",
        "campaign_hint_fr": "Campagne de scan \u2014 plusieurs IP du m\u00eame \/24 (104.152.52.0\/24, \u22653 pairs)",
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "reconnaissance",
                "label_fr": "Reconnaissance",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "rdp",
        "service_banner": "honeypot-rdp",
        "service_os": "linux",
        "dst_port": "3390"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "coordinated_scan": true,
    "coordinated_subnet": "104.152.52.0\/24",
    "coordinated_ip_count": 7,
    "behavior_alerts": [
        "coordinated_scan"
    ],
    "correlation_confidence_boost": 10,
    "attack_chain_stage": "reconnaissance",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_rdp_probe",
        "rdp_emulated"
    ],
    "asn_dc_heuristic": true
}