106.75.12.68

{
    "protocol_emulated": true,
    "bytes_in": 225,
    "payload_entropy": 5.016112168084253,
    "port_category": "registered",
    "org": "China Unicom Beijing Province Network",
    "service": "rdp",
    "app_proto": "rdp",
    "asn": 4808,
    "country": "CN",
    "dst_port": 3388,
    "risk_waf": 8,
    "risk_classification": 36,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 36,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "9c73cbdadc7f7f37b617938f4b05a25f503dd6d1",
    "event_fingerprint": "83f5ef87ea7d8eb1277bc2b5f6d31ae331c17062",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 36,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 15,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "rdp",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 4808,
        "org": "China Unicom Beijing Province Network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "41d92145b6477f65ec1fd4a1316e204b",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja3": "b39f48e6040906afcee6dc915248e3db",
        "ja4": "5b5ad56a67eb4635bb350503c4ff8657",
        "tls_version": "0x0303",
        "tls_cipher_count": 52,
        "tls_sni": "62.3.50.33",
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "b39f48e6040906afcee6dc915248e3db",
    "tls_ja3": "771,17-19-50-64-162-56-106-163-18-102-20-22-51-103-158-57-107-159-52394-21-25-23-49160-49161-49187-49195-49162-49188-49196-52393-49159-49170-49171-49191-49199-49172-49192-49200-52392-49169-8-6-3-10-47-60-156-53-61-157-4-5,0-5-10-11-13-65281,23-24-25,0",
    "tls_ja4_hash": "5b5ad56a67eb4635bb350503c4ff8657",
    "tls_ja4": "t13d0152_c79c1c2c7c3c_40d2e578a3e2",
    "tls_version": "0x0303",
    "tls_cipher_count": 52,
    "tls_sni": "62.3.50.33",
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 3388,
        "service": "rdp",
        "service_name": "rdp",
        "risk_score": 40
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdd\u0007\ufffdT\ufffd=\ufffdS\ufffd,^\ufffd0Pz\ufffdc\ufffd.V\ufffd\ufffd\u000b\ufffdp\ufffd\f\u4e03\u0000\u0000h\u0000\u0011\u0000\u0013\u00002\u0000@\u0000\ufffd\u00008\u0000j\u0000\ufffd\u0000\u0012\u0000f\u0000\u0014\u0000\u0016\u00003\u0000g\u0000\ufffd\u00009\u0000k\u0000\ufffd\u032a\u0000\u0015\u0000\u0019\u0000\u0017\ufffd\b\ufffd\t\ufffd#\ufffd+\ufffd\n\ufffd$\ufffd,\u0329\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\u0328\ufffd\u0011\u0000\b",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdd\u0007\ufffdT\ufffd=\ufffdS\ufffd,^\ufffd0Pz\ufffdc\ufffd.V\ufffd\ufffd\u000b\ufffdp\ufffd\f\u4e03\u0000\u0000h\u0000\u0011\u0000\u0013\u00002\u0000@\u0000\ufffd\u00008\u0000j\u0000\ufffd\u0000\u0012\u0000f\u0000\u0014\u0000\u0016\u00003\u0000g\u0000\ufffd\u00009\u0000k\u0000\ufffd\u032a\u0000\u0015\u0000\u0019\u0000\u0017\ufffd\b\ufffd\t\ufffd#\ufffd+\ufffd\n\ufffd$\ufffd,\u0329\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\u0328\ufffd\u0011\u0000\b\u0000\u0006\u0000\u0003\u0000\n\u0000\/\u0000<\u0000\ufffd\u00005\u0000=\u0000\ufffd\u0000\u0004\u0000\u0005\u0001\u0000\u0000G\u0000\u0000\u0000\u000f\u0000\r\u0000\u0000\n62.3.50.33\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\b\u0000\u0006\u0000\u0017\u0000\u0018\u0000\u0019\u0000\u000b\u0000\u0002\u0001\u0000\u0000\r\u0000\u0010\u0000\u000e\u0004\u0001\u0004\u0003\u0002\u0001\u0002\u0003\u0004\u0001\u0005\u0001\u0006\u0001\ufffd\u0001\u0000\u0001\u0000",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdd\u0007\ufffdT\ufffd=\ufffdS\ufffd,^\ufffd0Pz\ufffdc\ufffd.V\ufffd\ufffd\u000b\ufffdp\ufffd\f\u4e03\u0000\u0000h\u0000\u0011\u0000\u0013\u00002\u0000@\u0000\ufffd\u00008\u0000j\u0000\ufffd\u0000\u0012\u0000f\u0000\u0014\u0000\u0016\u00003\u0000g\u0000\ufffd\u00009\u0000k\u0000\ufffd\u032a\u0000\u0015\u0000\u0019\u0000\u0017\ufffd\b\ufffd\t\ufffd#\ufffd+\ufffd\n\ufffd$\ufffd,\u0329\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\u0328\ufffd\u0011\u0000\b",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a82351dca6915f02e7a223e97a19c1d44e7c4e95",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdd\u0007\ufffdT\ufffd=\ufffdS\ufffd,^\ufffd0Pz\ufffdc\ufffd.V\ufffd\ufffd\u000b\ufffdp\ufffd\f\u4e03\u0000\u0000h\u0000\u0011\u0000\u0013\u00002\u0000@\u0000\ufffd\u00008\u0000j\u0000\ufffd\u0000\u0012\u0000f\u0000\u0014\u0000\u0016\u00003\u0000g\u0000\ufffd\u00009\u0000k\u0000\ufffd\u032a\u0000\u0015\u0000\u0019\u0000\u0017\ufffd\b\ufffd\t\ufffd#\ufffd+\ufffd\n\ufffd$\ufffd,\u0329\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\u0328\ufffd\u0011\u0000\b",
        "tls_ja3": "b39f48e6040906afcee6dc915248e3db",
        "tls_ja4": "5b5ad56a67eb4635bb350503c4ff8657",
        "tls_sni": "62.3.50.33",
        "port": 3388,
        "service": "rdp",
        "service_label_fr": "RDP"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdd\ufffdT\ufffd=\ufffdS\ufffd,^\ufffd0Pz\ufffdc\ufffd.V\ufffd\ufffd\ufffdp\ufffd\u4e03h2@\ufffd8j\ufffdf3g\ufffd9k\ufffd\u032a\ufffd\ufffd\t\ufffd#\ufffd+\ufffd\n\ufffd$\ufffd,\u0329\ufffd\ufffd\ufffd\ufffd'\ufffd\/\ufffd\ufffd(\ufffd0\u0328\ufffd",
    "attack_vector": "postgres probe \u00b7 via RDP:3388 \u00b7 (sonde \/ probe)",
    "target_port_label": "3388 \u00b7 RDP",
    "emulator_service": "rdp",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 36,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "rdp",
        "service_label_fr": "RDP",
        "dst_port": 3388,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-rdp",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\ufffdd\u0007\ufffdT\ufffd=\ufffdS\ufffd,^\ufffd0Pz\ufffdc\ufffd.V\ufffd\ufffd\u000b\ufffdp\ufffd\f\u4e03\u0000\u0000h\u0000\u0011\u0000\u0013\u00002\u0000@\u0000\ufffd\u00008\u0000j\u0000\ufffd\u0000\u0012\u0000f\u0000\u0014\u0000\u0016\u00003\u0000g\u0000\ufffd\u00009\u0000k\u0000\ufffd\u032a\u0000\u0015\u0000\u0019\u0000\u0017\ufffd\b\ufffd\t\ufffd#\ufffd+\ufffd\n\ufffd$\ufffd,\u0329\ufffd\u0007\ufffd\u0012\ufffd\u0013\ufffd'\ufffd\/\ufffd\u0014\ufffd(\ufffd0\u0328\ufffd\u0011\u0000\b",
            "tls_ja3": "b39f48e6040906afcee6dc915248e3db",
            "tls_ja4": "5b5ad56a67eb4635bb350503c4ff8657",
            "tls_sni": "62.3.50.33",
            "port": 3388,
            "service": "rdp",
            "service_label_fr": "RDP"
        },
        "attack_vector": "postgres probe \u00b7 via RDP:3388 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffdd\ufffdT\ufffd=\ufffdS\ufffd,^\ufffd0Pz\ufffdc\ufffd.V\ufffd\ufffd\ufffdp\ufffd\u4e03h2@\ufffd8j\ufffdf3g\ufffd9k\ufffd\u032a\ufffd\ufffd\t\ufffd#\ufffd+\ufffd\n\ufffd$\ufffd,\u0329\ufffd\ufffd\ufffd\ufffd'\ufffd\/\ufffd\ufffd(\ufffd0\u0328\ufffd",
        "target_port_label": "3388 \u00b7 RDP",
        "emulator_service": "rdp",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "rdp",
        "service_banner": "honeypot-rdp",
        "service_os": "linux",
        "dst_port": "3388"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_rdp_probe",
        "rdp_emulated",
        "tls_clienthello"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "030000130ed00000123400021f080000000000",
    "emulator_response_len": 19,
    "bytes_in": 19,
    "payload_entropy": 1.983740670882855,
    "port_category": "registered",
    "org": "China Unicom Beijing Province Network",
    "service": "rdp",
    "app_proto": "rdp",
    "asn": 4808,
    "country": "CN",
    "dst_port": 3388,
    "risk_waf": 8,
    "risk_classification": 52,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 48,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "11333e2ac29f7dfcef09b4493c3dc673186a4a67",
    "event_fingerprint": "83f5ef87ea7d8eb1277bc2b5f6d31ae331c17062",
    "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 83,
    "precision_signals": [
        "pat-0348",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0348",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0348",
        "pat-0868",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "RDP TPKT header",
        "ET H.323 setup",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0348",
        "pat-0868",
        "pat-0554",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 52,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0,
        "risk_score": 48
    },
    "named_classification_skipped": false,
    "service_name": "rdp",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 4808,
        "org": "China Unicom Beijing Province Network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "0003c8efa0acdc0c6540f4bdb920f6bc",
        "path_pattern_hash": "5dd788b551ee7afb63321e74cfc538f6"
    },
    "target_context": {
        "dst_port": 3388,
        "service": "rdp",
        "service_name": "rdp",
        "risk_score": 48
    },
    "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000",
    "request_sample": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000",
    "payload_snippet": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000",
    "evidence": {
        "request_sample": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000",
        "payload_snippet": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000",
        "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "ef97dd534bc06b5a7ac541249bc8d229a48086aa",
    "protocol_details": {
        "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000",
        "port": 3388,
        "service": "rdp",
        "service_label_fr": "RDP"
    },
    "evidence_snippet": "\ufffd",
    "attack_vector": "rdp probe \u00b7 via RDP:3388 \u00b7 (sonde \/ probe)",
    "target_port_label": "3388 \u00b7 RDP",
    "emulator_service": "rdp",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "N\u00e9gociation protocole RDP \u00b7 confiance 95%",
        "classification_reason_label_fr": "N\u00e9gociation protocole RDP \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 48\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 52,
            "behavior": 0,
            "geo": 0,
            "protocol": 36,
            "novelty": 0,
            "risk_score": 48
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 48,
        "risk_label": "Moyen",
        "service_name": "rdp",
        "service_label_fr": "RDP",
        "dst_port": 3388,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0348",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "pat-0348",
            "Upstream"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-rdp",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0003\u0000\u0000\u0013\u000e\ufffd\u0000\u0000\u0000\u0000\u0000\u0001\u0000\b\u0000\u000b\u0000\u0000\u0000",
            "port": 3388,
            "service": "rdp",
            "service_label_fr": "RDP"
        },
        "attack_vector": "rdp probe \u00b7 via RDP:3388 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd",
        "target_port_label": "3388 \u00b7 RDP",
        "emulator_service": "rdp",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "rdp",
        "service_banner": "honeypot-rdp",
        "service_os": "linux",
        "dst_port": "3388"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_rdp_probe",
        "rdp_cookie",
        "rdp_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "8001000100000000",
    "emulator_response_len": 8,
    "bytes_in": 16,
    "payload_entropy": 3.75,
    "port_category": "registered",
    "org": "China Unicom Beijing Province Network",
    "service": "thrift",
    "app_proto": "thrift",
    "asn": 4808,
    "country": "CN",
    "dst_port": 7911,
    "risk_waf": 8,
    "risk_classification": 66,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 66,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 41,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "6a09006b0e850b1b56a31ba2fa5da46c8874c836",
    "event_fingerprint": "7f31ac088192b45f7c39b8ebbeae23ded7df95a6",
    "classification_reason": "Type \u00ab pop3_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%",
    "confidence": 0.95,
    "classification_confidence": 0.95,
    "precision_score": 74,
    "precision_signals": [
        "INT-EMAIL-pop3-user"
    ],
    "kb_rule_ids": [
        "INT-EMAIL-pop3-user"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 66,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 41
    },
    "named_classification_skipped": false,
    "service_name": "thrift",
    "risk_confidence_factor": 95,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 4808,
        "org": "China Unicom Beijing Province Network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "0d14e8dd95e3e871a180c82e1bc78157",
        "path_pattern_hash": "3f394465ae666f782f2351014fe4e7c6"
    },
    "target_context": {
        "dst_port": 7911,
        "service": "thrift",
        "service_name": "thrift",
        "risk_score": 41
    },
    "payload_preview": "USER anonymous\r\n",
    "request_sample": "USER anonymous\r\n",
    "payload_snippet": "USER anonymous",
    "evidence": {
        "request_sample": "USER anonymous\r\n",
        "payload_snippet": "USER anonymous",
        "classification_reason": "Type \u00ab pop3_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1110"
    ],
    "mitre": "T1110",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "13783bf6bb5751b5886eb28d38a80c50717aa950",
    "protocol_details": {
        "payload_preview": "USER anonymous",
        "port": 7911,
        "service": "thrift",
        "service_label_fr": "THRIFT"
    },
    "evidence_snippet": "USER anonymous",
    "attack_vector": "pop3 bruteforce \u00b7 via THRIFT:7911 \u00b7 (sonde \/ probe)",
    "target_port_label": "7911 \u00b7 THRIFT",
    "emulator_service": "thrift",
    "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab pop3_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "classification_reason_label_fr": "Type \u00ab pop3_bruteforce \u00bb (signaux protocolaires) \u00b7 confiance 95%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 41\/100",
        "confidence_pct": 95,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 66,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 41
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 41,
        "risk_label": "Moyen",
        "service_name": "thrift",
        "service_label_fr": "THRIFT",
        "dst_port": 7911,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-EMAIL-pop3-user"
        ],
        "tags_summary_labels_fr": [
            "Email Pop3 User"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "T1110",
        "mitre_technique": "T1110",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-thrift",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "USER anonymous",
            "port": 7911,
            "service": "thrift",
            "service_label_fr": "THRIFT"
        },
        "attack_vector": "pop3 bruteforce \u00b7 via THRIFT:7911 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "USER anonymous",
        "target_port_label": "7911 \u00b7 THRIFT",
        "emulator_service": "thrift",
        "confidence_reason": "Confiance 95 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 95 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "thrift",
        "service_banner": "honeypot-thrift",
        "service_os": "linux",
        "dst_port": "7911"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_thrift_probe",
        "pop3_probe",
        "thrift_emulated",
        "thrift_payload"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "8001000100000000",
    "emulator_response_len": 8,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "China Unicom Beijing Province Network",
    "service": "thrift",
    "app_proto": "thrift",
    "asn": 4808,
    "country": "CN",
    "dst_port": 7911,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 24,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "96943e1f08a6d78a39639583437f894bee97199a",
    "event_fingerprint": "7f31ac088192b45f7c39b8ebbeae23ded7df95a6",
    "classification_reason": "Type \u00ab thrift_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 24
    },
    "named_classification_skipped": false,
    "service_name": "thrift",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 4808,
        "org": "China Unicom Beijing Province Network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "56d977daea0d390c8ae0fc528d53a7e2"
    },
    "target_context": {
        "dst_port": 7911,
        "service": "thrift",
        "service_name": "thrift",
        "risk_score": 24
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "81d55707e77037112cd4c5d72b46403e8c3db045",
    "protocol_details": {
        "port": 7911,
        "service": "thrift",
        "service_label_fr": "THRIFT"
    },
    "attack_vector": "thrift probe \u00b7 via THRIFT:7911 \u00b7 (sonde \/ probe)",
    "target_port_label": "7911 \u00b7 THRIFT",
    "emulator_service": "thrift",
    "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab thrift_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab thrift_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 24
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 24,
        "risk_label": "Faible",
        "service_name": "thrift",
        "service_label_fr": "THRIFT",
        "dst_port": 7911,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-thrift",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "port": 7911,
            "service": "thrift",
            "service_label_fr": "THRIFT"
        },
        "attack_vector": "thrift probe \u00b7 via THRIFT:7911 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "7911 \u00b7 THRIFT",
        "emulator_service": "thrift",
        "confidence_reason": "Confiance 0 % \u2014 2 signal(aux) capteur",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "thrift",
        "service_banner": "honeypot-thrift",
        "service_os": "linux",
        "dst_port": "7911"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_thrift_probe",
        "thrift_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "8001000100000000",
    "emulator_response_len": 8,
    "bytes_in": 54,
    "payload_entropy": 4.513784724225435,
    "port_category": "registered",
    "org": "China Unicom Beijing Province Network",
    "service": "thrift",
    "app_proto": "thrift",
    "asn": 4808,
    "country": "CN",
    "dst_port": 7911,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 40,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 40,
        "novelty": 15
    },
    "risk_score": 24,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "c5e62f76f2529021c653760b81734950a4cafc44",
    "event_fingerprint": "7f31ac088192b45f7c39b8ebbeae23ded7df95a6",
    "classification_reason": "Type \u00ab thrift_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 40,
        "novelty": 15,
        "risk_score": 24
    },
    "named_classification_skipped": false,
    "service_name": "thrift",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 4808,
        "org": "China Unicom Beijing Province Network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "c29cc4329e487da3d649780af238716c",
        "path_pattern_hash": "56d977daea0d390c8ae0fc528d53a7e2"
    },
    "target_context": {
        "dst_port": 7911,
        "service": "thrift",
        "service_name": "thrift",
        "risk_score": 24
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7911\r\nAccept: *\/*\r\n\r\n",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7911\r\nAccept: *\/*\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7911\r\nAccept: *\/*",
    "evidence": {
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7911\r\nAccept: *\/*\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7911\r\nAccept: *\/*",
        "classification_reason": "Type \u00ab thrift_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3ec01a7fcc6bac2c903c369e88ac63978f38932c",
    "protocol_details": {
        "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7911\r\nAccept: *\/*",
        "port": 7911,
        "service": "thrift",
        "service_label_fr": "THRIFT"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7911\r\nAccept: *\/*",
    "attack_vector": "thrift probe \u00b7 via THRIFT:7911 \u00b7 (sonde \/ probe)",
    "target_port_label": "7911 \u00b7 THRIFT",
    "emulator_service": "thrift",
    "confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab thrift_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab thrift_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 40,
            "novelty": 15,
            "risk_score": 24
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 24,
        "risk_label": "Faible",
        "service_name": "thrift",
        "service_label_fr": "THRIFT",
        "dst_port": 7911,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-thrift",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7911\r\nAccept: *\/*",
            "port": 7911,
            "service": "thrift",
            "service_label_fr": "THRIFT"
        },
        "attack_vector": "thrift probe \u00b7 via THRIFT:7911 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:7911\r\nAccept: *\/*",
        "target_port_label": "7911 \u00b7 THRIFT",
        "emulator_service": "thrift",
        "confidence_reason": "Confiance 0 % \u2014 4 signal(aux) capteur",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "thrift",
        "service_banner": "honeypot-thrift",
        "service_os": "linux",
        "dst_port": "7911"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_get_probe",
        "net_thrift_probe",
        "thrift_emulated",
        "thrift_payload"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "8001000100000000",
    "emulator_response_len": 8,
    "bytes_in": 247,
    "payload_entropy": 5.776006042818989,
    "port_category": "registered",
    "org": "China Unicom Beijing Province Network",
    "service": "thrift",
    "app_proto": "thrift",
    "asn": 4808,
    "country": "CN",
    "dst_port": 7911,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "4e4b89810feaebf33465e1f4b749ec1485565454",
    "event_fingerprint": "7f31ac088192b45f7c39b8ebbeae23ded7df95a6",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 35
    },
    "named_classification_skipped": false,
    "service_name": "thrift",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 4808,
        "org": "China Unicom Beijing Province Network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "4c695a2a38e519cc62fbb3305f10c31c",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja3": "9460af62ae0af667130bf0d36514f084",
        "ja4": "9d78dfefabcee3ee16297d72e4cafc86",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "9460af62ae0af667130bf0d36514f084",
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,11-65281-23-18-5-10-13-43-51,29-23-24-25,0",
    "tls_ja4_hash": "9d78dfefabcee3ee16297d72e4cafc86",
    "tls_ja4": "t13d0119_e060b20e9557_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 7911,
        "service": "thrift",
        "service_name": "thrift",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003u,\ufffd\ufffdG\ufffd]B\ufffdZ\u0341)\ufffda\ufffd\ufffd\u001f\b\ufffdBn\ufffdhYe\ufffdeeIJ \btT\u0014E\ufffd?\u001b\ufffd\ufffdu\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffd\ufffdh\ufffd\ufffd\ufffdh\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0011\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003u,\ufffd\ufffdG\ufffd]B\ufffdZ\u0341)\ufffda\ufffd\ufffd\u001f\b\ufffdBn\ufffdhYe\ufffdeeIJ \btT\u0014E\ufffd?\u001b\ufffd\ufffdu\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffd\ufffdh\ufffd\ufffd\ufffdh\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0011\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 u\ufffd2]*\ufffd\u001du0-\ufffd_\ufffd\ufffd\ufffd;\ufffd\ufffd'\u0000\ufffd4\ufffd?\u0018tg\ufffd_\ufffdK\r",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003u,\ufffd\ufffdG\ufffd]B\ufffdZ\u0341)\ufffda\ufffd\ufffd\u001f\b\ufffdBn\ufffdhYe\ufffdeeIJ \btT\u0014E\ufffd?\u001b\ufffd\ufffdu\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffd\ufffdh\ufffd\ufffd\ufffdh\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0011\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d64fa4fd65ffc5bc58dfc581c72452d40c56d862",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003u,\ufffd\ufffdG\ufffd]B\ufffdZ\u0341)\ufffda\ufffd\ufffd\u001f\b\ufffdBn\ufffdhYe\ufffdeeIJ \btT\u0014E\ufffd?\u001b\ufffd\ufffdu\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffd\ufffdh\ufffd\ufffd\ufffdh\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0011\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
        "tls_ja3": "9460af62ae0af667130bf0d36514f084",
        "tls_ja4": "9d78dfefabcee3ee16297d72e4cafc86",
        "port": 7911,
        "service": "thrift",
        "service_label_fr": "THRIFT"
    },
    "evidence_snippet": "\ufffd\ufffdu,\ufffd\ufffdG\ufffd]B\ufffdZ\u0341)\ufffda\ufffd\ufffd\ufffdBn\ufffdhYe\ufffdeeIJ tTE\ufffd?\ufffd\ufffdu\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffd\ufffdh\ufffd\ufffd\ufffdh\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd",
    "attack_vector": "postgres probe \u00b7 via THRIFT:7911 \u00b7 (sonde \/ probe)",
    "target_port_label": "7911 \u00b7 THRIFT",
    "emulator_service": "thrift",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "thrift",
        "service_label_fr": "THRIFT",
        "dst_port": 7911,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-thrift",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003u,\ufffd\ufffdG\ufffd]B\ufffdZ\u0341)\ufffda\ufffd\ufffd\u001f\b\ufffdBn\ufffdhYe\ufffdeeIJ \btT\u0014E\ufffd?\u001b\ufffd\ufffdu\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffd\ufffdh\ufffd\ufffd\ufffdh\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u0011\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
            "tls_ja3": "9460af62ae0af667130bf0d36514f084",
            "tls_ja4": "9d78dfefabcee3ee16297d72e4cafc86",
            "port": 7911,
            "service": "thrift",
            "service_label_fr": "THRIFT"
        },
        "attack_vector": "postgres probe \u00b7 via THRIFT:7911 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffdu,\ufffd\ufffdG\ufffd]B\ufffdZ\u0341)\ufffda\ufffd\ufffd\ufffdBn\ufffdhYe\ufffdeeIJ tTE\ufffd?\ufffd\ufffdu\ufffd\ufffd\ufffd\ufffdY\ufffd\ufffd\ufffdh\ufffd\ufffd\ufffdh\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd",
        "target_port_label": "7911 \u00b7 THRIFT",
        "emulator_service": "thrift",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "thrift",
        "service_banner": "honeypot-thrift",
        "service_os": "linux",
        "dst_port": "7911"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_thrift_probe",
        "thrift_emulated",
        "thrift_payload",
        "tls_clienthello"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "8001000100000000",
    "emulator_response_len": 8,
    "bytes_in": 8,
    "payload_entropy": 1.061278124459133,
    "port_category": "registered",
    "org": "China Unicom Beijing Province Network",
    "service": "thrift",
    "app_proto": "thrift",
    "asn": 4808,
    "country": "CN",
    "dst_port": 7911,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "80545153ff337c578a872001739d0cd52ecc455f",
    "event_fingerprint": "7f31ac088192b45f7c39b8ebbeae23ded7df95a6",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab thrift_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 0,
        "risk_score": 35
    },
    "service_name": "thrift",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 4808,
        "org": "China Unicom Beijing Province Network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "71150925937982d9cbe009151fff4c2a",
        "path_pattern_hash": "56d977daea0d390c8ae0fc528d53a7e2"
    },
    "target_context": {
        "dst_port": 7911,
        "service": "thrift",
        "service_name": "thrift",
        "risk_score": 35
    },
    "payload_preview": "\u0000\u0000\u0000d\u0000\u0000\u0000\u0018",
    "request_sample": "\u0000\u0000\u0000d\u0000\u0000\u0000\u0018",
    "payload_snippet": "\u0000\u0000\u0000d\u0000\u0000\u0000\u0018",
    "evidence": {
        "request_sample": "\u0000\u0000\u0000d\u0000\u0000\u0000\u0018",
        "payload_snippet": "\u0000\u0000\u0000d\u0000\u0000\u0000\u0018",
        "classification_reason": "Type \u00ab thrift_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "aebff38a44a1f6fa717362735aa630dfc1b273f6",
    "protocol_details": {
        "payload_preview": "\u0000\u0000\u0000d\u0000\u0000\u0000\u0018",
        "port": 7911,
        "service": "thrift",
        "service_label_fr": "THRIFT"
    },
    "evidence_snippet": "d",
    "attack_vector": "thrift probe \u00b7 via THRIFT:7911 \u00b7 (sonde \/ probe)",
    "target_port_label": "7911 \u00b7 THRIFT",
    "emulator_service": "thrift",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab thrift_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab thrift_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 0,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "thrift",
        "service_label_fr": "THRIFT",
        "dst_port": 7911,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-thrift",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0000\u0000\u0000d\u0000\u0000\u0000\u0018",
            "port": 7911,
            "service": "thrift",
            "service_label_fr": "THRIFT"
        },
        "attack_vector": "thrift probe \u00b7 via THRIFT:7911 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "d",
        "target_port_label": "7911 \u00b7 THRIFT",
        "emulator_service": "thrift",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "thrift",
        "service_banner": "honeypot-thrift",
        "service_os": "linux",
        "dst_port": "7911"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_thrift_probe",
        "thrift_emulated",
        "thrift_payload"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "8001000100000000",
    "emulator_response_len": 8,
    "bytes_in": 247,
    "payload_entropy": 5.7830803634873735,
    "port_category": "registered",
    "org": "China Unicom Beijing Province Network",
    "service": "thrift",
    "app_proto": "thrift",
    "asn": 4808,
    "country": "CN",
    "dst_port": 7911,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 30,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "4e4b89810feaebf33465e1f4b749ec1485565454",
    "event_fingerprint": "7f31ac088192b45f7c39b8ebbeae23ded7df95a6",
    "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0369"
    ],
    "kb_rule_ids": [
        "pat-0369"
    ],
    "matched_patterns": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "PostgreSQL startup",
        "STUN binding",
        "Minecraft varint handshake",
        "SOCKS5 greeting",
        "SIP TLS ClientHello",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0369",
        "pat-0771",
        "pat-0554",
        "pat-0567",
        "pat-0578",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 0,
        "protocol": 30,
        "novelty": 15,
        "risk_score": 35
    },
    "named_classification_skipped": false,
    "service_name": "thrift",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 4808,
        "org": "China Unicom Beijing Province Network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ecdbd3ab37dd634552a0a02b6788694f",
        "path_pattern_hash": "80f3c71fe26f36a0a9399108643f66c5",
        "ja3": "9460af62ae0af667130bf0d36514f084",
        "ja4": "9d78dfefabcee3ee16297d72e4cafc86",
        "tls_version": "0x0303",
        "tls_cipher_count": 19,
        "ja3_client_category": "nmap_scanner"
    },
    "tls_ja3_hash": "9460af62ae0af667130bf0d36514f084",
    "tls_ja3": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,11-65281-23-18-5-10-13-43-51,29-23-24-25,0",
    "tls_ja4_hash": "9d78dfefabcee3ee16297d72e4cafc86",
    "tls_ja4": "t13d0119_e060b20e9557_cc710080a5f9",
    "tls_version": "0x0303",
    "tls_cipher_count": 19,
    "ja3_client_category": "nmap_scanner",
    "target_context": {
        "dst_port": 7911,
        "service": "thrift",
        "service_name": "thrift",
        "risk_score": 35
    },
    "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0006\ufffd\ufffd\u000b\ufffd>f\u001d\u0012T\u0011\ufffd\u0011\ufffd\ufffdD\b\ufffd)s\ufffd!\ufffd\ufffdW\u001bR\ufffd\ufffd\u013f\ufffd l\ufffd\ufffd\u001cN\u0006=\ufffd\u00c1\ufffd\ufffdK\ufffd\ufffdG\u0016#\ufffd\ufffd&\ufffdJfZ\ufffd9\ufffd\ufffd\u0015\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
    "evidence": {
        "request_sample": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0006\ufffd\ufffd\u000b\ufffd>f\u001d\u0012T\u0011\ufffd\u0011\ufffd\ufffdD\b\ufffd)s\ufffd!\ufffd\ufffdW\u001bR\ufffd\ufffd\u013f\ufffd l\ufffd\ufffd\u001cN\u0006=\ufffd\u00c1\ufffd\ufffdK\ufffd\ufffdG\u0016#\ufffd\ufffd&\ufffdJfZ\ufffd9\ufffd\ufffd\u0015\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001\u0000\u0001\u0000\u0000\u0017\u0000\u0000\u0000\u0012\u0000\u0000\u0000\u0005\u0000\u0005\u0001\u0000\u0000\u0000\u0000\u0000\n\u0000\n\u0000\b\u0000\u001d\u0000\u0017\u0000\u0018\u0000\u0019\u0000\r\u0000\u001a\u0000\u0018\b\u0004\u0004\u0003\b\u0007\b\u0005\b\u0006\u0004\u0001\u0005\u0001\u0006\u0001\u0005\u0003\u0006\u0003\u0002\u0001\u0002\u0003\u0000+\u0000\t\b\u0003\u0004\u0003\u0003\u0003\u0002\u0003\u0001\u00003\u0000&\u0000$\u0000\u001d\u0000 P\u00071\ufffd\ufffd\u0569\ufffdC\ufffd\ufffd1gZ\ufffd\ufffd\u0005T\ufffd\ufffd\ufffdZG\ufffdR<~\u0005\ufffd\ufffd\u0002",
        "payload_snippet": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0006\ufffd\ufffd\u000b\ufffd>f\u001d\u0012T\u0011\ufffd\u0011\ufffd\ufffdD\b\ufffd)s\ufffd!\ufffd\ufffdW\u001bR\ufffd\ufffd\u013f\ufffd l\ufffd\ufffd\u001cN\u0006=\ufffd\u00c1\ufffd\ufffdK\ufffd\ufffdG\u0016#\ufffd\ufffd&\ufffdJfZ\ufffd9\ufffd\ufffd\u0015\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "0759db4fc9623af64e3c87d13d5b2c6c427a2562",
    "protocol_details": {
        "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0006\ufffd\ufffd\u000b\ufffd>f\u001d\u0012T\u0011\ufffd\u0011\ufffd\ufffdD\b\ufffd)s\ufffd!\ufffd\ufffdW\u001bR\ufffd\ufffd\u013f\ufffd l\ufffd\ufffd\u001cN\u0006=\ufffd\u00c1\ufffd\ufffdK\ufffd\ufffdG\u0016#\ufffd\ufffd&\ufffdJfZ\ufffd9\ufffd\ufffd\u0015\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
        "tls_ja3": "9460af62ae0af667130bf0d36514f084",
        "tls_ja4": "9d78dfefabcee3ee16297d72e4cafc86",
        "port": 7911,
        "service": "thrift",
        "service_label_fr": "THRIFT"
    },
    "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd>fT\ufffd\ufffd\ufffdD\ufffd)s\ufffd!\ufffd\ufffdWR\ufffd\ufffd\u013f\ufffd l\ufffd\ufffdN=\ufffd\u00c1\ufffd\ufffdK\ufffd\ufffdG#\ufffd\ufffd&\ufffdJfZ\ufffd9\ufffd\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd",
    "attack_vector": "postgres probe \u00b7 via THRIFT:7911 \u00b7 (sonde \/ probe)",
    "target_port_label": "7911 \u00b7 THRIFT",
    "emulator_service": "thrift",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab postgres_probe \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 0,
            "protocol": 30,
            "novelty": 15,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "thrift",
        "service_label_fr": "THRIFT",
        "dst_port": 7911,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0369"
        ],
        "tags_summary_labels_fr": [
            "pat-0369"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-thrift",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\u0006\ufffd\ufffd\u000b\ufffd>f\u001d\u0012T\u0011\ufffd\u0011\ufffd\ufffdD\b\ufffd)s\ufffd!\ufffd\ufffdW\u001bR\ufffd\ufffd\u013f\ufffd l\ufffd\ufffd\u001cN\u0006=\ufffd\u00c1\ufffd\ufffdK\ufffd\ufffdG\u0016#\ufffd\ufffd&\ufffdJfZ\ufffd9\ufffd\ufffd\u0015\ufffd\u0000&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\u0013\ufffd\n\ufffd\u0014\u0000\ufffd\u0000\ufffd\u0000\/\u00005\ufffd\u0012\u0000\n\u0013\u0001\u0013\u0002\u0013\u0003\u0001\u0000\u0000\u0000\u000b\u0000\u0002\u0001\u0000\ufffd\u0001",
            "tls_ja3": "9460af62ae0af667130bf0d36514f084",
            "tls_ja4": "9d78dfefabcee3ee16297d72e4cafc86",
            "port": 7911,
            "service": "thrift",
            "service_label_fr": "THRIFT"
        },
        "attack_vector": "postgres probe \u00b7 via THRIFT:7911 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd\ufffd\ufffd\ufffd\ufffd>fT\ufffd\ufffd\ufffdD\ufffd)s\ufffd!\ufffd\ufffdWR\ufffd\ufffd\u013f\ufffd l\ufffd\ufffdN=\ufffd\u00c1\ufffd\ufffdK\ufffd\ufffdG#\ufffd\ufffd&\ufffdJfZ\ufffd9\ufffd\ufffd\ufffd&\ufffd+\ufffd\/\ufffd,\ufffd0\u0329\u0328\ufffd\t\ufffd\ufffd\n\ufffd\ufffd\ufffd\/5\ufffd\n\ufffd",
        "target_port_label": "7911 \u00b7 THRIFT",
        "emulator_service": "thrift",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "meta_truncated": true,
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "thrift",
        "service_banner": "honeypot-thrift",
        "service_os": "linux",
        "dst_port": "7911"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_thrift_probe",
        "thrift_emulated",
        "thrift_payload",
        "tls_clienthello"
    ]
}

{
    "http_header_count": 7,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "ico",
    "http_ua_hash": "a5d5a57da7d8753f3afeadd30f5a71ed889b4399",
    "http_host_hash": "1cd2744106700ab51749a7c0080ba4d56bc0cbc6",
    "http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
    "http_referer_hash": "1c9edce7bc8d910780d9b4445fe8b462afc0f47e",
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 369,
    "payload_entropy": 5.530338878169577,
    "port_category": "registered",
    "org": "China Unicom Beijing Province Network",
    "service": "http",
    "app_proto": "http",
    "asn": 4808,
    "country": "CN",
    "dst_port": 16010,
    "risk_waf": 84,
    "risk_classification": 68,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.3,
    "risk_breakdown": {
        "waf": 84,
        "classification": 68,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 48,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "61821c8a715e53a675cf861d731d12c402f947b8",
    "event_fingerprint": "097d4d9a7a80fdc1d31110d0d3527e0bea59cff6",
    "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence": 0.5,
    "classification_confidence": 0.5,
    "precision_score": 70,
    "precision_signals": [
        "pat-0284"
    ],
    "kb_rule_ids": [
        "pat-0284"
    ],
    "matched_patterns": [
        "pat-0284"
    ],
    "matched_pattern_names": [
        "CRS 941130"
    ],
    "pattern_ids": [
        "pat-0284"
    ],
    "confidence_breakdown": {
        "waf": 84,
        "classification": 68,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 48
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 4808,
        "org": "China Unicom Beijing Province Network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c3db206658f24424e13f6ac99c6aeea2",
        "payload_hash": "7bc5e440a018f4244deaaaa42b227b75",
        "path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
    },
    "target_context": {
        "dst_port": 16010,
        "service": "http",
        "service_name": "http",
        "risk_score": 48
    },
    "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:16010\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Geck",
    "method": "GET",
    "path": "\/favicon.ico",
    "user_agent": "Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/49.0.2623.112 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/favicon.ico HTTP\/1.1",
    "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:16010\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/49.0.2623.112 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8\r\nAccept-Charset: ",
    "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:16010\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Geck",
    "evidence": {
        "method": "GET",
        "path": "\/favicon.ico",
        "user_agent": "Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/49.0.2623.112 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:16010\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/49.0.2623.112 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8\r\nAccept-Charset: ",
        "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:16010\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Geck",
        "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f94e1c89c490fa22d4112ba3724926162f3df092",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/favicon.ico",
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/49.0.2623.112 Safari\/537.36",
        "port": 16010,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:16010\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Geck",
    "attack_vector": "xss attack \u00b7 via HTTP:16010 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/favicon.ico",
    "target_port_label": "16010 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 48\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 84,
            "classification": 68,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 48
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 48,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 16010,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0284"
        ],
        "tags_summary_labels_fr": [
            "pat-0284"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/favicon.ico",
            "request_line": "GET \/favicon.ico HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/49.0.2623.112 Safari\/537.36",
            "port": 16010,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "xss attack \u00b7 via HTTP:16010 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/favicon.ico",
        "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:16010\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Geck",
        "target_port_label": "16010 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 84 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "16010"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ]
}

{
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": null,
    "http_host_hash": "1cd2744106700ab51749a7c0080ba4d56bc0cbc6",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 55,
    "payload_entropy": 4.4400063042370705,
    "port_category": "registered",
    "org": "China Unicom Beijing Province Network",
    "service": "http",
    "app_proto": "http",
    "asn": 4808,
    "country": "CN",
    "dst_port": 16010,
    "risk_waf": 20,
    "risk_classification": 8,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.9,
    "risk_breakdown": {
        "waf": 20,
        "classification": 8,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 0
    },
    "risk_score": 35,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "798952fea733a7e2c46781c70a0d543c83197d94",
    "event_fingerprint": "b794ec5c1a07a70da26480ca0f26ccdb335e2bca",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 4808,
        "org": "China Unicom Beijing Province Network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "fd49a90919e681396b241496e6bbc05f",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 16010,
        "service": "http",
        "service_name": "http",
        "risk_score": 35
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:16010\r\nAccept: *\/*\r\n\r\n",
    "method": "GET",
    "path": "\/",
    "waf_tags": [
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:16010\r\nAccept: *\/*\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:16010\r\nAccept: *\/*",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "waf_tags": [
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:16010\r\nAccept: *\/*\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:16010\r\nAccept: *\/*",
        "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 61%"
    },
    "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 61%",
    "confidence_breakdown": {
        "waf": 20,
        "classification": 8,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 0,
        "risk_score": 35
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.61,
    "classification_confidence": 0.61,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e299074eacaa5fd2dceb2d3c29158766fbf15df3",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "port": 16010,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:16010\r\nAccept: *\/*",
    "attack_vector": "http \u00b7 via HTTP:16010 \u00b7 (sonde \/ probe)",
    "target_port_label": "16010 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 61 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 61%",
        "classification_reason_label_fr": "Tags WAF: sap-sapcontrol-path \u00b7 confiance 61%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 61,
        "confidence_breakdown": {
            "waf": 20,
            "classification": 8,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 0,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 16010,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "port": 16010,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http \u00b7 via HTTP:16010 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:16010\r\nAccept: *\/*",
        "target_port_label": "16010 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 61 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 61 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "16010"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "http_no_ua"
    ]
}

{
    "http_header_count": 6,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "a5d5a57da7d8753f3afeadd30f5a71ed889b4399",
    "http_host_hash": "1cd2744106700ab51749a7c0080ba4d56bc0cbc6",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 324,
    "payload_entropy": 5.553287151852128,
    "port_category": "registered",
    "org": "China Unicom Beijing Province Network",
    "service": "http",
    "app_proto": "http",
    "asn": 4808,
    "country": "CN",
    "dst_port": 16010,
    "risk_waf": 72,
    "risk_classification": 68,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 25,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 3.3,
    "risk_breakdown": {
        "waf": 72,
        "classification": 68,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15
    },
    "risk_score": 44,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "c5d40df84521e8f872108330fa5a0c5c189f86d7",
    "event_fingerprint": "e3a4dd37a1485a335e6df1f40067c51ac0d48853",
    "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
    "confidence": 0.59,
    "classification_confidence": 0.59,
    "precision_score": 70,
    "precision_signals": [
        "pat-0284"
    ],
    "kb_rule_ids": [
        "pat-0284"
    ],
    "matched_patterns": [
        "pat-0284"
    ],
    "matched_pattern_names": [
        "CRS 941130"
    ],
    "pattern_ids": [
        "pat-0284"
    ],
    "confidence_breakdown": {
        "waf": 72,
        "classification": 68,
        "behavior": 0,
        "geo": 0,
        "protocol": 25,
        "novelty": 15,
        "risk_score": 44
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 59,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 4808,
        "org": "China Unicom Beijing Province Network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c3db206658f24424e13f6ac99c6aeea2",
        "payload_hash": "8c3920ca41b57100b994f88511459785",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 16010,
        "service": "http",
        "service_name": "http",
        "risk_score": 44
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:16010\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/4",
    "method": "GET",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/49.0.2623.112 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:16010\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/49.0.2623.112 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8\r\nAccept-Charset: GBK,utf-8;q",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:16010\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/4",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/49.0.2623.112 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:16010\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/49.0.2623.112 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8\r\nAccept-Charset: GBK,utf-8;q",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:16010\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/4",
        "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "326d6cb0d46d0d6e0803a247bae6d3772bbee361",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/49.0.2623.112 Safari\/537.36",
        "port": 16010,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:16010\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/4",
    "attack_vector": "xss attack \u00b7 via HTTP:16010 \u00b7 (tentative d'exploit)",
    "target_port_label": "16010 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 44\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
        "confidence_pct": 59,
        "confidence_breakdown": {
            "waf": 72,
            "classification": 68,
            "behavior": 0,
            "geo": 0,
            "protocol": 25,
            "novelty": 15,
            "risk_score": 44
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 16010,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0284"
        ],
        "tags_summary_labels_fr": [
            "pat-0284"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/49.0.2623.112 Safari\/537.36",
            "port": 16010,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "xss attack \u00b7 via HTTP:16010 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:16010\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/4",
        "target_port_label": "16010 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "16010"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ]
}

{
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": null,
    "http_host_hash": "1cd2744106700ab51749a7c0080ba4d56bc0cbc6",
    "http_target_hash": "a00af0af3f36ab8a9ed1a15cf31c75380c1fd9e2",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 68,
    "payload_entropy": 4.6847558120554265,
    "port_category": "registered",
    "org": "China Unicom Beijing Province Network",
    "service": "http",
    "app_proto": "http",
    "asn": 4808,
    "country": "CN",
    "dst_port": 16010,
    "risk_waf": 8,
    "risk_classification": 8,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 35,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 2.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 8,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15
    },
    "risk_score": 35,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "00862788c2c22aebdbd633a83a5fc283c2f1c47b",
    "event_fingerprint": "e1a1c595c7cbd22ed02dd5f13304ffa6b2074092",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 4808,
        "org": "China Unicom Beijing Province Network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "fcb60a803d059c15038c2009026a7f9f",
        "path_pattern_hash": "e73d39a719e12fcc59f386a1c22e2c5a"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 16010,
        "service": "http",
        "service_name": "http",
        "risk_score": 35
    },
    "payload_preview": "GET \/master-status HTTP\/1.1\r\nHost: 62.3.50.33:16010\r\nAccept: *\/*\r\n\r\n",
    "method": "GET",
    "path": "\/master-status",
    "request_line": "GET \/master-status HTTP\/1.1",
    "request_sample": "GET \/master-status HTTP\/1.1\r\nHost: 62.3.50.33:16010\r\nAccept: *\/*\r\n\r\n",
    "payload_snippet": "GET \/master-status HTTP\/1.1\r\nHost: 62.3.50.33:16010\r\nAccept: *\/*",
    "evidence": {
        "method": "GET",
        "path": "\/master-status",
        "request_line": "GET \/master-status HTTP\/1.1",
        "request_sample": "GET \/master-status HTTP\/1.1\r\nHost: 62.3.50.33:16010\r\nAccept: *\/*\r\n\r\n",
        "payload_snippet": "GET \/master-status HTTP\/1.1\r\nHost: 62.3.50.33:16010\r\nAccept: *\/*",
        "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 58%"
    },
    "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 58%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 8,
        "behavior": 0,
        "geo": 0,
        "protocol": 35,
        "novelty": 15,
        "risk_score": 35
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "confidence": 0.58,
    "classification_confidence": 0.58,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7ccf68365e4a2bddc2dd78ea16233e244892afff",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/master-status",
        "request_line": "GET \/master-status HTTP\/1.1",
        "port": 16010,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/master-status HTTP\/1.1\r\nHost: 62.3.50.33:16010\r\nAccept: *\/*",
    "attack_vector": "http \u00b7 via HTTP:16010 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/master-status",
    "target_port_label": "16010 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 58 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 58%",
        "classification_reason_label_fr": "Type \u00ab http \u00bb (signaux protocolaires) \u00b7 confiance 58%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 35\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 8,
            "behavior": 0,
            "geo": 0,
            "protocol": 35,
            "novelty": 15,
            "risk_score": 35
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 35,
        "risk_label": "Faible",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 16010,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/master-status",
            "request_line": "GET \/master-status HTTP\/1.1",
            "port": 16010,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "http \u00b7 via HTTP:16010 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/master-status",
        "evidence_snippet": "GET \/master-status HTTP\/1.1\r\nHost: 62.3.50.33:16010\r\nAccept: *\/*",
        "target_port_label": "16010 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 58 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "16010"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_no_ua"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a20696d6167652f782d69636f6e0d0a436f6e74656e742d4c656e6774683a2032320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a0000010001001010000001002000680400001600",
    "emulator_response_len": 130,
    "http_header_count": 7,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "ico",
    "http_ua_hash": "a5d5a57da7d8753f3afeadd30f5a71ed889b4399",
    "http_host_hash": "f130243513b7300e0da1ac623a115de4e650e25b",
    "http_target_hash": "a40fba6620dee3abd15532f18848dacb6bb80f01",
    "http_referer_hash": "03f6e0aae9dfc708d3ccc4ed8b79095ae7a767dc",
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 367,
    "payload_entropy": 5.5287037418625,
    "port_category": "registered",
    "org": "China Unicom Beijing Province Network",
    "service": "http",
    "app_proto": "http",
    "asn": 4808,
    "country": "CN",
    "dst_port": 8030,
    "risk_waf": 84,
    "risk_classification": 68,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.6,
    "risk_breakdown": {
        "waf": 84,
        "classification": 68,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 47,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "03be72577fbb49a965ace599005eb32778f0f2e2",
    "event_fingerprint": "0a383e4833fdb4d951397c942c3fb6e4ba93f39d",
    "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence": 0.5,
    "classification_confidence": 0.5,
    "precision_score": 70,
    "precision_signals": [
        "pat-0284"
    ],
    "kb_rule_ids": [
        "pat-0284"
    ],
    "matched_patterns": [
        "pat-0284"
    ],
    "matched_pattern_names": [
        "CRS 941130"
    ],
    "pattern_ids": [
        "pat-0284"
    ],
    "confidence_breakdown": {
        "waf": 84,
        "classification": 68,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 15,
        "risk_score": 47
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 4808,
        "org": "China Unicom Beijing Province Network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c3db206658f24424e13f6ac99c6aeea2",
        "payload_hash": "5f86d9ca53030ecf179b57a9274fb637",
        "path_pattern_hash": "b18036488649e7cc8a55b0a02c8b737a"
    },
    "target_context": {
        "dst_port": 8030,
        "service": "http",
        "service_name": "http",
        "risk_score": 47
    },
    "payload_preview": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:8030\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko",
    "method": "GET",
    "path": "\/favicon.ico",
    "user_agent": "Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/49.0.2623.112 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3"
    ],
    "waf_rule_names": [
        "rce-0",
        "ssrf-3",
        "nosqli-3"
    ],
    "request_line": "GET \/favicon.ico HTTP\/1.1",
    "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:8030\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/49.0.2623.112 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8\r\nAccept-Charset: G",
    "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:8030\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko",
    "evidence": {
        "method": "GET",
        "path": "\/favicon.ico",
        "user_agent": "Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/49.0.2623.112 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950406:ssrf-3",
            "950470:nosqli-3"
        ],
        "waf_rule_names": [
            "rce-0",
            "ssrf-3",
            "nosqli-3"
        ],
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "request_sample": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:8030\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/49.0.2623.112 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8\r\nAccept-Charset: G",
        "payload_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:8030\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko",
        "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "71c0ed0fba2514444c3bed9c98146f462c0b897e",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/favicon.ico",
        "request_line": "GET \/favicon.ico HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/49.0.2623.112 Safari\/537.36",
        "port": 8030,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:8030\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko",
    "attack_vector": "xss attack \u00b7 via HTTP:8030 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/favicon.ico",
    "target_port_label": "8030 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 50 % \u2014 via HTTP",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 84,
            "classification": 68,
            "behavior": 0,
            "geo": 0,
            "protocol": 33,
            "novelty": 15,
            "risk_score": 47
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 47,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8030,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0284"
        ],
        "tags_summary_labels_fr": [
            "pat-0284"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/favicon.ico",
            "request_line": "GET \/favicon.ico HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/49.0.2623.112 Safari\/537.36",
            "port": 8030,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "xss attack \u00b7 via HTTP:8030 \u00b7 (tentative d'exploit) \u00b7 \u2192 \/favicon.ico",
        "evidence_snippet": "GET \/favicon.ico HTTP\/1.1\r\nHost: 62.3.50.33:8030\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko",
        "target_port_label": "8030 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 84 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8030"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "950406:ssrf-3",
        "950470:nosqli-3",
        "net_web_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": null,
    "http_host_hash": "f130243513b7300e0da1ac623a115de4e650e25b",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 54,
    "payload_entropy": 4.476747687188397,
    "port_category": "registered",
    "org": "China Unicom Beijing Province Network",
    "service": "http",
    "app_proto": "http",
    "asn": 4808,
    "country": "CN",
    "dst_port": 8030,
    "risk_waf": 20,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.2,
    "risk_breakdown": {
        "waf": 20,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 0
    },
    "risk_score": 40,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "ea98ddfe0593f212ce3c26134f0b4db412015955",
    "event_fingerprint": "344bc3b645f0d14c46febd05d922892fe85e0183",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 4808,
        "org": "China Unicom Beijing Province Network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "5c38273f19148faa109ad51ec946c9f9",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 8030,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8030\r\nAccept: *\/*\r\n\r\n",
    "method": "GET",
    "path": "\/",
    "waf_tags": [
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8030\r\nAccept: *\/*\r\n\r\n",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8030\r\nAccept: *\/*",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "waf_tags": [
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8030\r\nAccept: *\/*\r\n\r\n",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8030\r\nAccept: *\/*",
        "classification_reason": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%"
    },
    "classification_reason": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%",
    "confidence_breakdown": {
        "waf": 20,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 0,
        "risk_score": 40
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a6f49dce79852064f26ff4bc5a0459444e90660a",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "port": 8030,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8030\r\nAccept: *\/*",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:8030 \u00b7 (sonde \/ probe)",
    "target_port_label": "8030 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 74 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%",
        "classification_reason_label_fr": "Sonde HTTP (tag sap-sapcontrol-path) \u00b7 confiance 74%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 74,
        "confidence_breakdown": {
            "waf": 20,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 0,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8030,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "port": 8030,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:8030 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8030\r\nAccept: *\/*",
        "target_port_label": "8030 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 74 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF",
        "confidence_factors_fr": "Confiance 74 % \u2014 Score WAF 20 \u00b7 1 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8030"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950734:sap-sapcontrol-path",
        "http_no_ua",
        "net_web_probe"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 6,
    "http_query_params": 0,
    "http_path_depth": 0,
    "http_path_ext": null,
    "http_ua_hash": "a5d5a57da7d8753f3afeadd30f5a71ed889b4399",
    "http_host_hash": "f130243513b7300e0da1ac623a115de4e650e25b",
    "http_target_hash": "42099b4af021e53fd8fd4e056c2568d7c2e3ffa8",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": true,
    "bytes_in": 323,
    "payload_entropy": 5.552605668445012,
    "port_category": "registered",
    "org": "China Unicom Beijing Province Network",
    "service": "http",
    "app_proto": "http",
    "asn": 4808,
    "country": "CN",
    "dst_port": 8030,
    "risk_waf": 72,
    "risk_classification": 68,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 1.6,
    "risk_breakdown": {
        "waf": 72,
        "classification": 68,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 43,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "1746b6af65fe520956327b10af14d9d9b928f3d1",
    "event_fingerprint": "8ebbcfe8560a7c995eb78cb68b7677e8885f05c5",
    "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
    "confidence": 0.59,
    "classification_confidence": 0.59,
    "precision_score": 70,
    "precision_signals": [
        "pat-0284"
    ],
    "kb_rule_ids": [
        "pat-0284"
    ],
    "matched_patterns": [
        "pat-0284"
    ],
    "matched_pattern_names": [
        "CRS 941130"
    ],
    "pattern_ids": [
        "pat-0284"
    ],
    "confidence_breakdown": {
        "waf": 72,
        "classification": 68,
        "behavior": 0,
        "geo": 0,
        "protocol": 33,
        "novelty": 15,
        "risk_score": 43
    },
    "named_classification_skipped": false,
    "service_name": "http",
    "risk_confidence_factor": 59,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 4808,
        "org": "China Unicom Beijing Province Network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "http_ua_hash": "c3db206658f24424e13f6ac99c6aeea2",
        "payload_hash": "6d908b2e78a4097fa87e6d578a3a06ce",
        "path_pattern_hash": "8a5edab282632443219e051e4ade2d1d"
    },
    "target_context": {
        "dst_port": 8030,
        "service": "http",
        "service_name": "http",
        "risk_score": 43
    },
    "payload_preview": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8030\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/49",
    "method": "GET",
    "path": "\/",
    "user_agent": "Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/49.0.2623.112 Safari\/537.36",
    "waf_tags": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path"
    ],
    "waf_rule_names": [
        "rce-0",
        "nosqli-3",
        "sap-sapcontrol-path"
    ],
    "request_line": "GET \/ HTTP\/1.1",
    "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8030\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/49.0.2623.112 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8\r\nAccept-Charset: GBK,utf-8;q=",
    "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8030\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/49",
    "evidence": {
        "method": "GET",
        "path": "\/",
        "user_agent": "Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/49.0.2623.112 Safari\/537.36",
        "waf_tags": [
            "950326:rce-0",
            "950470:nosqli-3",
            "950734:sap-sapcontrol-path"
        ],
        "waf_rule_names": [
            "rce-0",
            "nosqli-3",
            "sap-sapcontrol-path"
        ],
        "request_line": "GET \/ HTTP\/1.1",
        "request_sample": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8030\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/49.0.2623.112 Safari\/537.36\r\nAccept: text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8\r\nAccept-Charset: GBK,utf-8;q=",
        "payload_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8030\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/49",
        "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3a2453d9e51d660cc42d76d58e661b36aef1b8d8",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/",
        "request_line": "GET \/ HTTP\/1.1",
        "http_user_agent": "Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/49.0.2623.112 Safari\/537.36",
        "port": 8030,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8030\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/49",
    "attack_vector": "xss attack \u00b7 via HTTP:8030 \u00b7 (tentative d'exploit)",
    "target_port_label": "8030 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "classification_reason_label_fr": "Type \u00ab xss_attack \u00bb (signaux protocolaires) \u00b7 confiance 59%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 43\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 59 % \u2014 via HTTP",
        "confidence_pct": 59,
        "confidence_breakdown": {
            "waf": 72,
            "classification": 68,
            "behavior": 0,
            "geo": 0,
            "protocol": 33,
            "novelty": 15,
            "risk_score": 43
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 43,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8030,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0284"
        ],
        "tags_summary_labels_fr": [
            "pat-0284"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/",
            "request_line": "GET \/ HTTP\/1.1",
            "http_user_agent": "Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/49.0.2623.112 Safari\/537.36",
            "port": 8030,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "xss attack \u00b7 via HTTP:8030 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "GET \/ HTTP\/1.1\r\nHost: 62.3.50.33:8030\r\nUser-Agent: Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko) Chrome\/49",
        "target_port_label": "8030 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 59 % \u2014 Motif catalogue confirm\u00e9 \u00b7 3 tag(s) WAF",
        "confidence_factors_fr": "Confiance 59 % \u2014 Score WAF 72 \u00b7 3 tag(s) WAF",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8030"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "950326:rce-0",
        "950470:nosqli-3",
        "950734:sap-sapcontrol-path",
        "net_web_probe"
    ],
    "behavior_alert_count": 1,
    "behavior_priority": 96
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": null,
    "http_ua_hash": null,
    "http_host_hash": "f130243513b7300e0da1ac623a115de4e650e25b",
    "http_target_hash": "62a2f82bbb90af3b6e63afaf2fa0654aa86b6dcb",
    "http_referer_hash": null,
    "http_method": "GET",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 63,
    "payload_entropy": 4.659509288441918,
    "port_category": "registered",
    "org": "China Unicom Beijing Province Network",
    "service": "http",
    "app_proto": "http",
    "asn": 4808,
    "country": "CN",
    "dst_port": 8030,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 0.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "67a53c2a8de98688c6fc9b02a1f16b074bad54e9",
    "event_fingerprint": "e4d36db0ad6a58e8c545303658e26b203817e69b",
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 4808,
        "org": "China Unicom Beijing Province Network",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "3e31e8e4bf56756fcd4701494eb0fb96",
        "path_pattern_hash": "4b13d37d1dc4178450fea78546cdc0b5"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 8030,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "GET \/rs-status HTTP\/1.1\r\nHost: 62.3.50.33:8030\r\nAccept: *\/*\r\n\r\n",
    "method": "GET",
    "path": "\/rs-status",
    "request_line": "GET \/rs-status HTTP\/1.1",
    "request_sample": "GET \/rs-status HTTP\/1.1\r\nHost: 62.3.50.33:8030\r\nAccept: *\/*\r\n\r\n",
    "payload_snippet": "GET \/rs-status HTTP\/1.1\r\nHost: 62.3.50.33:8030\r\nAccept: *\/*",
    "evidence": {
        "method": "GET",
        "path": "\/rs-status",
        "request_line": "GET \/rs-status HTTP\/1.1",
        "request_sample": "GET \/rs-status HTTP\/1.1\r\nHost: 62.3.50.33:8030\r\nAccept: *\/*\r\n\r\n",
        "payload_snippet": "GET \/rs-status HTTP\/1.1\r\nHost: 62.3.50.33:8030\r\nAccept: *\/*",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 71%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 71%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 0,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 40
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.71,
    "classification_confidence": 0.71,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d8c0452441a1ae9f16c67875ebd1bfabea2a5e43",
    "protocol_details": {
        "http_method": "GET",
        "http_path": "\/rs-status",
        "request_line": "GET \/rs-status HTTP\/1.1",
        "port": 8030,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "GET \/rs-status HTTP\/1.1\r\nHost: 62.3.50.33:8030\r\nAccept: *\/*",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:8030 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/rs-status",
    "target_port_label": "8030 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 71 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 71%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 71%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 71,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 0,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8030,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "GET",
            "http_path": "\/rs-status",
            "request_line": "GET \/rs-status HTTP\/1.1",
            "port": 8030,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:8030 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/rs-status",
        "evidence_snippet": "GET \/rs-status HTTP\/1.1\r\nHost: 62.3.50.33:8030\r\nAccept: *\/*",
        "target_port_label": "8030 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 71 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 71 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8030"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_no_ua",
        "net_web_probe"
    ]
}