120.48.55.108

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 908,
    "payload_entropy": 4.844260357632477,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 22,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "cf99a5926131044aea127ec8e1be9bc67108bd7d",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "risk_confidence_factor": 74,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a56f27d283dbfad58de9a53fa440b4d8",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\u0007\ufffdM\u000fF>k|\ufffd[13\ufffd\ufffd\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\u0007\ufffdM\u000fF>k|\ufffd[13\ufffd\ufffd\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\u0007\ufffdM\u000fF>k|\ufffd[13\ufffd\ufffd\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\u0007\ufffdM\u000fF>k|\ufffd[13\ufffd\ufffd\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\u0007\ufffdM\u000fF>k|\ufffd[13\ufffd\ufffd\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3a215481130d7b7fa527157ecc927d1e44f87487",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce_burst",
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 908,
    "payload_entropy": 4.828737977302587,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 22,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "cf99a5926131044aea127ec8e1be9bc67108bd7d",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "risk_confidence_factor": 74,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "d4cf30f7274e9dfb23109d8bfdf9d43b",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffdm\ufffd\b\ufffd\ufffd\ufffdU\ufffd\ufffdp\ufffd{\u00019\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffdm\ufffd\b\ufffd\ufffd\ufffdU\ufffd\ufffdp\ufffd{\u00019\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffdm\ufffd\b\ufffd\ufffd\ufffdU\ufffd\ufffdp\ufffd{\u00019\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffdm\ufffd\b\ufffd\ufffd\ufffdU\ufffd\ufffdp\ufffd{\u00019\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffdm\ufffd\b\ufffd\ufffd\ufffdU\ufffd\ufffdp\ufffd{\u00019\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "1fe1a5e0547d201f4283b7ef6616fcbb8e820636",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce_burst",
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 908,
    "payload_entropy": 4.825693040494123,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 22,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "cf99a5926131044aea127ec8e1be9bc67108bd7d",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "risk_confidence_factor": 74,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "0efca98929b317cc39e237f2e62d6777",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffdm\ufffd^\ufffd\u0011\u0014\ufffd!\u0000A\ufffd%r\ufffd\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffdm\ufffd^\ufffd\u0011\u0014\ufffd!\u0000A\ufffd%r\ufffd\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffdm\ufffd^\ufffd\u0011\u0014\ufffd!\u0000A\ufffd%r\ufffd\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffdm\ufffd^\ufffd\u0011\u0014\ufffd!\u0000A\ufffd%r\ufffd\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffdm\ufffd^\ufffd\u0011\u0014\ufffd!\u0000A\ufffd%r\ufffd\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "591a8537587a91fbd806b52c365f8cf59b47dd0b",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce_burst",
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 908,
    "payload_entropy": 4.817424114291419,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 22,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "cf99a5926131044aea127ec8e1be9bc67108bd7d",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "risk_confidence_factor": 74,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e4c94cf4f511c606178117a48e48ea34",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014*|j\ufffd\ufffd#v#\ufffd\r\u000fv1\ufffdp\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014*|j\ufffd\ufffd#v#\ufffd\r\u000fv1\ufffdp\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014*|j\ufffd\ufffd#v#\ufffd\r\u000fv1\ufffdp\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014*|j\ufffd\ufffd#v#\ufffd\r\u000fv1\ufffdp\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014*|j\ufffd\ufffd#v#\ufffd\r\u000fv1\ufffdp\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a32ddbc2a0d9b36219f7eb6166002d2c212cafea",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce_burst",
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ],
    "behavior_alert_count": 1,
    "behavior_priority": 72
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 12,
    "payload_entropy": 3.2516291673878226,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 21,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "e61df9daa23678fb8da412993c14604e07486452",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253"
    ],
    "pattern_ids": [
        "pat-0391"
    ],
    "risk_confidence_factor": 74,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e9e55307b9c6c1bf5bae2abdb628281d",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "payload_preview": "SSH-2.0-Go\r\n",
    "request_sample": "SSH-2.0-Go\r\n",
    "payload_snippet": "SSH-2.0-Go",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n",
        "payload_snippet": "SSH-2.0-Go",
        "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "07dd8ad1545441acc1afa921d61146b41b13f68f",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce_burst",
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated"
    ],
    "behavior_alert_count": 1,
    "behavior_priority": 72
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 908,
    "payload_entropy": 4.838464261627891,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 22,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "cf99a5926131044aea127ec8e1be9bc67108bd7d",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "risk_confidence_factor": 74,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "53aa9ce5725c5ebb33cced9e2fd56fff",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\u03dd\ufffdl\u0014a\b\ufffd\u021e\ufffd\ufffd\u001e):\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\u03dd\ufffdl\u0014a\b\ufffd\u021e\ufffd\ufffd\u001e):\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\u03dd\ufffdl\u0014a\b\ufffd\u021e\ufffd\ufffd\u001e):\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\u03dd\ufffdl\u0014a\b\ufffd\u021e\ufffd\ufffd\u001e):\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\u03dd\ufffdl\u0014a\b\ufffd\u021e\ufffd\ufffd\u001e):\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "fbd82bdbd34866518bb0b2d04c9d7f728c33c49d",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce_burst",
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ],
    "behavior_alert_count": 1,
    "behavior_priority": 72
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 908,
    "payload_entropy": 4.843727451844436,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 22,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "cf99a5926131044aea127ec8e1be9bc67108bd7d",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "risk_confidence_factor": 74,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "372d0174f2670dd777d3c8ff1a328513",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\u02daEw<\u0003\ufffd\ufffd\ufffd3\ufffd\ufffd\ufffd\u0012\ufffd\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\u02daEw<\u0003\ufffd\ufffd\ufffd3\ufffd\ufffd\ufffd\u0012\ufffd\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\u02daEw<\u0003\ufffd\ufffd\ufffd3\ufffd\ufffd\ufffd\u0012\ufffd\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\u02daEw<\u0003\ufffd\ufffd\ufffd3\ufffd\ufffd\ufffd\u0012\ufffd\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\u02daEw<\u0003\ufffd\ufffd\ufffd3\ufffd\ufffd\ufffd\u0012\ufffd\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "84c4766e75de2e6c3bbcf6f6adca545eb201f531",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce_burst",
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 908,
    "payload_entropy": 4.845521642905304,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 22,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "cf99a5926131044aea127ec8e1be9bc67108bd7d",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "risk_confidence_factor": 74,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "079d1dd9e73649ae27ba9988bc673bb3",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffd\u000b\u0011\ufffd\ufffd\ufffd\ufffd{qA1z\ufffdF\u0013\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffd\u000b\u0011\ufffd\ufffd\ufffd\ufffd{qA1z\ufffdF\u0013\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffd\u000b\u0011\ufffd\ufffd\ufffd\ufffd{qA1z\ufffdF\u0013\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffd\u000b\u0011\ufffd\ufffd\ufffd\ufffd{qA1z\ufffdF\u0013\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffd\u000b\u0011\ufffd\ufffd\ufffd\ufffd{qA1z\ufffdF\u0013\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "f1b721431c2e1e82c0edf7e076a99d10e503102c",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce_burst",
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 908,
    "payload_entropy": 4.819097109560736,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 22,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "cf99a5926131044aea127ec8e1be9bc67108bd7d",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "risk_confidence_factor": 74,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "d843c96570484c8eb5c9fd28f1f58f50",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffd\ufffd\ufffd\ufffd.\ufffdh\ufffd\u0019Vp\ufffd\ufffdY\u0017\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffd\ufffd\ufffd\ufffd.\ufffdh\ufffd\u0019Vp\ufffd\ufffdY\u0017\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffd\ufffd\ufffd\ufffd.\ufffdh\ufffd\u0019Vp\ufffd\ufffdY\u0017\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffd\ufffd\ufffd\ufffd.\ufffdh\ufffd\u0019Vp\ufffd\ufffdY\u0017\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffd\ufffd\ufffd\ufffd.\ufffdh\ufffd\u0019Vp\ufffd\ufffdY\u0017\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c90ca9539a2e95bc73ee3bb06559c70f303e483b",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce_burst",
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 908,
    "payload_entropy": 4.849850941014256,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 22,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "cf99a5926131044aea127ec8e1be9bc67108bd7d",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "risk_confidence_factor": 74,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "8edb5ef87eb641073d3c0f5a278c38c3",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014 \u001c\u0001^;G0\ufffd+\ufffd:\ufffd\ufffd\ufffd\f\u000b\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014 \u001c\u0001^;G0\ufffd+\ufffd:\ufffd\ufffd\ufffd\f\u000b\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014 \u001c\u0001^;G0\ufffd+\ufffd:\ufffd\ufffd\ufffd\f\u000b\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014 \u001c\u0001^;G0\ufffd+\ufffd:\ufffd\ufffd\ufffd\f\u000b\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014 \u001c\u0001^;G0\ufffd+\ufffd:\ufffd\ufffd\ufffd\f\u000b\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e377137657a3bbbe0a578b33204bcb69ddf99c34",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce_burst",
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 908,
    "payload_entropy": 4.8306786175483865,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 22,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "cf99a5926131044aea127ec8e1be9bc67108bd7d",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "risk_confidence_factor": 74,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "c73979ed9510185cc08bcad2ddbf06f6",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014?\ufffd\ufffd\ufffd\ufffd\ufffdB\ufffdH[\ufffd\u0004\u0015\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014?\ufffd\ufffd\ufffd\ufffd\ufffdB\ufffdH[\ufffd\u0004\u0015\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014?\ufffd\ufffd\ufffd\ufffd\ufffdB\ufffdH[\ufffd\u0004\u0015\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014?\ufffd\ufffd\ufffd\ufffd\ufffdB\ufffdH[\ufffd\u0004\u0015\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014?\ufffd\ufffd\ufffd\ufffd\ufffdB\ufffdH[\ufffd\u0004\u0015\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "4d119823aacf01c6472cd59594008c868c528b23",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce_burst",
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 908,
    "payload_entropy": 4.832015204257786,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 22,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "c184d075b91a12d7037abe4b255f38a75d51f987",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "risk_confidence_factor": 74,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ffaefff1db94eb8349a048c731404c86",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014b\u001c\ufffdy\ufffd\ufffdf\ufffd}\u0479{4\ufffd\u05f4\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014b\u001c\ufffdy\ufffd\ufffdf\ufffd}\u0479{4\ufffd\u05f4\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014b\u001c\ufffdy\ufffd\ufffdf\ufffd}\u0479{4\ufffd\u05f4\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014b\u001c\ufffdy\ufffd\ufffdf\ufffd}\u0479{4\ufffd\u05f4\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014b\u001c\ufffdy\ufffd\ufffdf\ufffd}\u0479{4\ufffd\u05f4\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "ef26bb53294044449e236efdb4322a4d8568288e",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce",
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 908,
    "payload_entropy": 4.834334037924975,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 22,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "c184d075b91a12d7037abe4b255f38a75d51f987",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "risk_confidence_factor": 74,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "829e41de764f8c6f1c2f485f14e40613",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffdL'z\ufffd?q\ufffd\u0002\ufffd\ufffd\ufffdjo\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffdL'z\ufffd?q\ufffd\u0002\ufffd\ufffd\ufffdjo\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffdL'z\ufffd?q\ufffd\u0002\ufffd\ufffd\ufffdjo\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffdL'z\ufffd?q\ufffd\u0002\ufffd\ufffd\ufffdjo\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffdL'z\ufffd?q\ufffd\u0002\ufffd\ufffd\ufffdjo\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "250c557f33389c7bb8ba3e290a77c6032e3e07a8",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce",
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 908,
    "payload_entropy": 4.849847337509588,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 22,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "c184d075b91a12d7037abe4b255f38a75d51f987",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "risk_confidence_factor": 74,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "b19e899b2604a536d05985ed2f8bd93e",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffd\u0010\\(\u001f\ufffd\u0012\ufffd\u0018d\ufffd\/\ufffd\ufffdE\b\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffd\u0010\\(\u001f\ufffd\u0012\ufffd\u0018d\ufffd\/\ufffd\ufffdE\b\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffd\u0010\\(\u001f\ufffd\u0012\ufffd\u0018d\ufffd\/\ufffd\ufffdE\b\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffd\u0010\\(\u001f\ufffd\u0012\ufffd\u0018d\ufffd\/\ufffd\ufffdE\b\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffd\u0010\\(\u001f\ufffd\u0012\ufffd\u0018d\ufffd\/\ufffd\ufffdE\b\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "9288366329bdc6d90c46e8c3fbc8f86f74484c6b",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce",
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 12,
    "payload_entropy": 3.2516291673878226,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 21,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "074b165bed03b3b6baf70acd0699e17eacfd93d6",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253"
    ],
    "pattern_ids": [
        "pat-0391"
    ],
    "risk_confidence_factor": 74,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e9e55307b9c6c1bf5bae2abdb628281d",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "payload_preview": "SSH-2.0-Go\r\n",
    "request_sample": "SSH-2.0-Go\r\n",
    "payload_snippet": "SSH-2.0-Go",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n",
        "payload_snippet": "SSH-2.0-Go",
        "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a93ca9f20c4fa378f4dd3e033e2f08343f2f17d8",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce",
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 908,
    "payload_entropy": 4.842477007191351,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 22,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "c184d075b91a12d7037abe4b255f38a75d51f987",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "risk_confidence_factor": 74,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "193b8be86b3899216962742fb4212839",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\u00026\ufffd\ufffd>!>o\ufffd\ufffdF\ufffd\ufffd\ufffdGK\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\u00026\ufffd\ufffd>!>o\ufffd\ufffdF\ufffd\ufffd\ufffdGK\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\u00026\ufffd\ufffd>!>o\ufffd\ufffdF\ufffd\ufffd\ufffdGK\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\u00026\ufffd\ufffd>!>o\ufffd\ufffdF\ufffd\ufffd\ufffdGK\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\u00026\ufffd\ufffd>!>o\ufffd\ufffdF\ufffd\ufffd\ufffdGK\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "39572f09744ae1d9107c33065b449461704baf86",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce",
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 908,
    "payload_entropy": 4.829641463983498,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 22,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "c184d075b91a12d7037abe4b255f38a75d51f987",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "risk_confidence_factor": 74,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "67f9e300202f8ca81a977c2ba5cf18e8",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014w\ufffdt\ufffd|\u0019n\n\u000f[\ufffdc\u0014\ufffd\ufffdZ\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014w\ufffdt\ufffd|\u0019n\n\u000f[\ufffdc\u0014\ufffd\ufffdZ\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014w\ufffdt\ufffd|\u0019n\n\u000f[\ufffdc\u0014\ufffd\ufffdZ\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014w\ufffdt\ufffd|\u0019n\n\u000f[\ufffdc\u0014\ufffd\ufffdZ\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014w\ufffdt\ufffd|\u0019n\n\u000f[\ufffdc\u0014\ufffd\ufffdZ\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "13b110687a6b72e2c52f4afdee3dc97d199f4cb8",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce",
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 12,
    "payload_entropy": 3.2516291673878226,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 21,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "074b165bed03b3b6baf70acd0699e17eacfd93d6",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253"
    ],
    "pattern_ids": [
        "pat-0391"
    ],
    "risk_confidence_factor": 74,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e9e55307b9c6c1bf5bae2abdb628281d",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "payload_preview": "SSH-2.0-Go\r\n",
    "request_sample": "SSH-2.0-Go\r\n",
    "payload_snippet": "SSH-2.0-Go",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n",
        "payload_snippet": "SSH-2.0-Go",
        "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a93ca9f20c4fa378f4dd3e033e2f08343f2f17d8",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce",
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 908,
    "payload_entropy": 4.829171248473705,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 22,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "c184d075b91a12d7037abe4b255f38a75d51f987",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "risk_confidence_factor": 74,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "4a34160dc11a82f52be745c855f49ebc",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffd\u0720\u0019\ufffd\u000f\ufffd\ufffd0\ufffd\ufffdu\ufffd1\ufffd)\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffd\u0720\u0019\ufffd\u000f\ufffd\ufffd0\ufffd\ufffdu\ufffd1\ufffd)\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffd\u0720\u0019\ufffd\u000f\ufffd\ufffd0\ufffd\ufffdu\ufffd1\ufffd)\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffd\u0720\u0019\ufffd\u000f\ufffd\ufffd0\ufffd\ufffdu\ufffd1\ufffd)\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffd\u0720\u0019\ufffd\u000f\ufffd\ufffd0\ufffd\ufffdu\ufffd1\ufffd)\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "96cb386c88c7e2f1077c8ece1ca871e877dc28ef",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce",
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ],
    "behavior_alert_count": 1,
    "behavior_priority": 72
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 12,
    "payload_entropy": 3.2516291673878226,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 21,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "074b165bed03b3b6baf70acd0699e17eacfd93d6",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253"
    ],
    "pattern_ids": [
        "pat-0391"
    ],
    "risk_confidence_factor": 74,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e9e55307b9c6c1bf5bae2abdb628281d",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "payload_preview": "SSH-2.0-Go\r\n",
    "request_sample": "SSH-2.0-Go\r\n",
    "payload_snippet": "SSH-2.0-Go",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n",
        "payload_snippet": "SSH-2.0-Go",
        "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a93ca9f20c4fa378f4dd3e033e2f08343f2f17d8",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce",
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 908,
    "payload_entropy": 4.844278392208599,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 22,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "c184d075b91a12d7037abe4b255f38a75d51f987",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "risk_confidence_factor": 74,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "93b394ec8a070e4d53b551cc30f8347a",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffd@W\ufffd\ufffd\u001d<\ufffdv\ufffd\ufffd\u0006{\b\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffd@W\ufffd\ufffd\u001d<\ufffdv\ufffd\ufffd\u0006{\b\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffd@W\ufffd\ufffd\u001d<\ufffdv\ufffd\ufffd\u0006{\b\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffd@W\ufffd\ufffd\u001d<\ufffdv\ufffd\ufffd\u0006{\b\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffd@W\ufffd\ufffd\u001d<\ufffdv\ufffd\ufffd\u0006{\b\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "5a256c77a29c8f0ff1636e177f44547343954a9c",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce",
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 12,
    "payload_entropy": 3.2516291673878226,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 21,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "074b165bed03b3b6baf70acd0699e17eacfd93d6",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253"
    ],
    "pattern_ids": [
        "pat-0391"
    ],
    "risk_confidence_factor": 74,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e9e55307b9c6c1bf5bae2abdb628281d",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "payload_preview": "SSH-2.0-Go\r\n",
    "request_sample": "SSH-2.0-Go\r\n",
    "payload_snippet": "SSH-2.0-Go",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n",
        "payload_snippet": "SSH-2.0-Go",
        "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a93ca9f20c4fa378f4dd3e033e2f08343f2f17d8",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce",
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 908,
    "payload_entropy": 4.8509816928713345,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 22,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "c184d075b91a12d7037abe4b255f38a75d51f987",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "risk_confidence_factor": 74,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "d829cded007da076777586013985573e",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffdWL\u0003\ufffd\ufffd\u000f\ufffd\u0135{&\u0013\ufffd\ufffd\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffdWL\u0003\ufffd\ufffd\u000f\ufffd\u0135{&\u0013\ufffd\ufffd\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffdWL\u0003\ufffd\ufffd\u000f\ufffd\u0135{&\u0013\ufffd\ufffd\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffdWL\u0003\ufffd\ufffd\u000f\ufffd\u0135{&\u0013\ufffd\ufffd\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffdWL\u0003\ufffd\ufffd\u000f\ufffd\u0135{&\u0013\ufffd\ufffd\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "2ec722e9bc3e0f5009eb4b46ef993a9bebabe3a0",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce",
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 12,
    "payload_entropy": 3.2516291673878226,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 21,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "074b165bed03b3b6baf70acd0699e17eacfd93d6",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253"
    ],
    "pattern_ids": [
        "pat-0391"
    ],
    "risk_confidence_factor": 74,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e9e55307b9c6c1bf5bae2abdb628281d",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "payload_preview": "SSH-2.0-Go\r\n",
    "request_sample": "SSH-2.0-Go\r\n",
    "payload_snippet": "SSH-2.0-Go",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n",
        "payload_snippet": "SSH-2.0-Go",
        "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a93ca9f20c4fa378f4dd3e033e2f08343f2f17d8",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce",
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 12,
    "payload_entropy": 3.2516291673878226,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 21,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "074b165bed03b3b6baf70acd0699e17eacfd93d6",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253"
    ],
    "pattern_ids": [
        "pat-0391"
    ],
    "risk_confidence_factor": 74,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e9e55307b9c6c1bf5bae2abdb628281d",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "payload_preview": "SSH-2.0-Go\r\n",
    "request_sample": "SSH-2.0-Go\r\n",
    "payload_snippet": "SSH-2.0-Go",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n",
        "payload_snippet": "SSH-2.0-Go",
        "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a93ca9f20c4fa378f4dd3e033e2f08343f2f17d8",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce",
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 908,
    "payload_entropy": 4.8431801026558015,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 22,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "c184d075b91a12d7037abe4b255f38a75d51f987",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "risk_confidence_factor": 74,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "243d09c7e9ffb05eeed0810d53e96ee5",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014n\ufffd\ufffd\ufffd\ufffd\ufffd({=\u041c\ufffd]\ufffdN\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014n\ufffd\ufffd\ufffd\ufffd\ufffd({=\u041c\ufffd]\ufffdN\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014n\ufffd\ufffd\ufffd\ufffd\ufffd({=\u041c\ufffd]\ufffdN\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014n\ufffd\ufffd\ufffd\ufffd\ufffd({=\u041c\ufffd]\ufffdN\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014n\ufffd\ufffd\ufffd\ufffd\ufffd({=\u041c\ufffd]\ufffdN\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a5e2e8dd8ec077d9c9f027a36df13f00f689785a",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce",
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 10,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "2c52b1f7aa472ff9e6b5ad5aa646dee43fa9d21b",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a6799212d5fca250223bcb5a1cd5aac2818ab5d0",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce",
        "net_ssh_probe",
        "ssh_banner_grab",
        "ssh_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 12,
    "payload_entropy": 3.2516291673878226,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 21,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "074b165bed03b3b6baf70acd0699e17eacfd93d6",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253"
    ],
    "pattern_ids": [
        "pat-0391"
    ],
    "risk_confidence_factor": 74,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e9e55307b9c6c1bf5bae2abdb628281d",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "payload_preview": "SSH-2.0-Go\r\n",
    "request_sample": "SSH-2.0-Go\r\n",
    "payload_snippet": "SSH-2.0-Go",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n",
        "payload_snippet": "SSH-2.0-Go",
        "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a93ca9f20c4fa378f4dd3e033e2f08343f2f17d8",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce",
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 12,
    "payload_entropy": 3.2516291673878226,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 21,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "074b165bed03b3b6baf70acd0699e17eacfd93d6",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253"
    ],
    "pattern_ids": [
        "pat-0391"
    ],
    "risk_confidence_factor": 74,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e9e55307b9c6c1bf5bae2abdb628281d",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "payload_preview": "SSH-2.0-Go\r\n",
    "request_sample": "SSH-2.0-Go\r\n",
    "payload_snippet": "SSH-2.0-Go",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n",
        "payload_snippet": "SSH-2.0-Go",
        "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a93ca9f20c4fa378f4dd3e033e2f08343f2f17d8",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce",
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 12,
    "payload_entropy": 3.2516291673878226,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 21,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "074b165bed03b3b6baf70acd0699e17eacfd93d6",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253"
    ],
    "pattern_ids": [
        "pat-0391"
    ],
    "risk_confidence_factor": 74,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e9e55307b9c6c1bf5bae2abdb628281d",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "payload_preview": "SSH-2.0-Go\r\n",
    "request_sample": "SSH-2.0-Go\r\n",
    "payload_snippet": "SSH-2.0-Go",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n",
        "payload_snippet": "SSH-2.0-Go",
        "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a93ca9f20c4fa378f4dd3e033e2f08343f2f17d8",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce",
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 908,
    "payload_entropy": 4.846987265621942,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 22,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "c184d075b91a12d7037abe4b255f38a75d51f987",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "risk_confidence_factor": 74,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "0e5a02c66d323ee50dadb1320b74f0a8",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\u0013\ufffd\ufffd$e\ufffd\ufffd\u0011\ufffdZ\u0015\ue9a2\ufffdX\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\u0013\ufffd\ufffd$e\ufffd\ufffd\u0011\ufffdZ\u0015\ue9a2\ufffdX\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\u0013\ufffd\ufffd$e\ufffd\ufffd\u0011\ufffdZ\u0015\ue9a2\ufffdX\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\u0013\ufffd\ufffd$e\ufffd\ufffd\u0011\ufffdZ\u0015\ue9a2\ufffdX\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\u0013\ufffd\ufffd$e\ufffd\ufffd\u0011\ufffdZ\u0015\ue9a2\ufffdX\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "9d93f27b2290cdd56b2546e200a63a136058e13b",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce",
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 12,
    "payload_entropy": 3.2516291673878226,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 21,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "074b165bed03b3b6baf70acd0699e17eacfd93d6",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253"
    ],
    "pattern_ids": [
        "pat-0391"
    ],
    "risk_confidence_factor": 74,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e9e55307b9c6c1bf5bae2abdb628281d",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "payload_preview": "SSH-2.0-Go\r\n",
    "request_sample": "SSH-2.0-Go\r\n",
    "payload_snippet": "SSH-2.0-Go",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n",
        "payload_snippet": "SSH-2.0-Go",
        "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a93ca9f20c4fa378f4dd3e033e2f08343f2f17d8",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce",
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 12,
    "payload_entropy": 3.2516291673878226,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 21,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "074b165bed03b3b6baf70acd0699e17eacfd93d6",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253"
    ],
    "pattern_ids": [
        "pat-0391"
    ],
    "risk_confidence_factor": 74,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e9e55307b9c6c1bf5bae2abdb628281d",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "payload_preview": "SSH-2.0-Go\r\n",
    "request_sample": "SSH-2.0-Go\r\n",
    "payload_snippet": "SSH-2.0-Go",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n",
        "payload_snippet": "SSH-2.0-Go",
        "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a93ca9f20c4fa378f4dd3e033e2f08343f2f17d8",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce",
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 12,
    "payload_entropy": 3.2516291673878226,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 21,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "074b165bed03b3b6baf70acd0699e17eacfd93d6",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253"
    ],
    "pattern_ids": [
        "pat-0391"
    ],
    "risk_confidence_factor": 74,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e9e55307b9c6c1bf5bae2abdb628281d",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "payload_preview": "SSH-2.0-Go\r\n",
    "request_sample": "SSH-2.0-Go\r\n",
    "payload_snippet": "SSH-2.0-Go",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n",
        "payload_snippet": "SSH-2.0-Go",
        "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a93ca9f20c4fa378f4dd3e033e2f08343f2f17d8",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce",
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 12,
    "payload_entropy": 3.2516291673878226,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 21,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "074b165bed03b3b6baf70acd0699e17eacfd93d6",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253"
    ],
    "pattern_ids": [
        "pat-0391"
    ],
    "risk_confidence_factor": 74,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e9e55307b9c6c1bf5bae2abdb628281d",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "payload_preview": "SSH-2.0-Go\r\n",
    "request_sample": "SSH-2.0-Go\r\n",
    "payload_snippet": "SSH-2.0-Go",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n",
        "payload_snippet": "SSH-2.0-Go",
        "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a93ca9f20c4fa378f4dd3e033e2f08343f2f17d8",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce",
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 12,
    "payload_entropy": 3.2516291673878226,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 21,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "074b165bed03b3b6baf70acd0699e17eacfd93d6",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253"
    ],
    "pattern_ids": [
        "pat-0391"
    ],
    "risk_confidence_factor": 74,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e9e55307b9c6c1bf5bae2abdb628281d",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "payload_preview": "SSH-2.0-Go\r\n",
    "request_sample": "SSH-2.0-Go\r\n",
    "payload_snippet": "SSH-2.0-Go",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n",
        "payload_snippet": "SSH-2.0-Go",
        "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a93ca9f20c4fa378f4dd3e033e2f08343f2f17d8",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce",
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 908,
    "payload_entropy": 4.839648718364646,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 22,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "c184d075b91a12d7037abe4b255f38a75d51f987",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "risk_confidence_factor": 74,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "180438c27e62076a410f14c83136fc85",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014?\ufffd\u0337\ufffd\u07c4F\ufffd\ufffd,j\u00030\/\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014?\ufffd\u0337\ufffd\u07c4F\ufffd\ufffd,j\u00030\/\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014?\ufffd\u0337\ufffd\u07c4F\ufffd\ufffd,j\u00030\/\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014?\ufffd\u0337\ufffd\u07c4F\ufffd\ufffd,j\u00030\/\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014?\ufffd\u0337\ufffd\u07c4F\ufffd\ufffd,j\u00030\/\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "0f779876e83f811feed598f050411a454c6cf722",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce",
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 12,
    "payload_entropy": 3.2516291673878226,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 21,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "074b165bed03b3b6baf70acd0699e17eacfd93d6",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253"
    ],
    "pattern_ids": [
        "pat-0391"
    ],
    "risk_confidence_factor": 74,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e9e55307b9c6c1bf5bae2abdb628281d",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "payload_preview": "SSH-2.0-Go\r\n",
    "request_sample": "SSH-2.0-Go\r\n",
    "payload_snippet": "SSH-2.0-Go",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n",
        "payload_snippet": "SSH-2.0-Go",
        "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a93ca9f20c4fa378f4dd3e033e2f08343f2f17d8",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce",
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 12,
    "payload_entropy": 3.2516291673878226,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 21,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "074b165bed03b3b6baf70acd0699e17eacfd93d6",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253"
    ],
    "pattern_ids": [
        "pat-0391"
    ],
    "risk_confidence_factor": 74,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e9e55307b9c6c1bf5bae2abdb628281d",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "payload_preview": "SSH-2.0-Go\r\n",
    "request_sample": "SSH-2.0-Go\r\n",
    "payload_snippet": "SSH-2.0-Go",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n",
        "payload_snippet": "SSH-2.0-Go",
        "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a93ca9f20c4fa378f4dd3e033e2f08343f2f17d8",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce",
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 10,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "2c52b1f7aa472ff9e6b5ad5aa646dee43fa9d21b",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a6799212d5fca250223bcb5a1cd5aac2818ab5d0",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce",
        "net_ssh_probe",
        "ssh_banner_grab",
        "ssh_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 908,
    "payload_entropy": 4.850338127215587,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 22,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "c184d075b91a12d7037abe4b255f38a75d51f987",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "risk_confidence_factor": 74,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "42d46fef90a105cafdd6fe8c715dd28c",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014&\u0013\ufffdbF\u0012=\ufffd!\ufffd\ufffd\ufffd\ufffd\t#\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014&\u0013\ufffdbF\u0012=\ufffd!\ufffd\ufffd\ufffd\ufffd\t#\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014&\u0013\ufffdbF\u0012=\ufffd!\ufffd\ufffd\ufffd\ufffd\t#\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014&\u0013\ufffdbF\u0012=\ufffd!\ufffd\ufffd\ufffd\ufffd\t#\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014&\u0013\ufffdbF\u0012=\ufffd!\ufffd\ufffd\ufffd\ufffd\t#\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "705bef5b4460a0e9e2537cef4813198c63c612ff",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce",
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 908,
    "payload_entropy": 4.846107891720716,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 22,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "c184d075b91a12d7037abe4b255f38a75d51f987",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "risk_confidence_factor": 74,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "009b373dbcec06c931643778a896868b",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u00143\u001d\ufffd\ufffdI\ufffd\ufffdkJ\u001c\ufffdg\ufffdX\ufffd\u0010\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u00143\u001d\ufffd\ufffdI\ufffd\ufffdkJ\u001c\ufffdg\ufffdX\ufffd\u0010\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u00143\u001d\ufffd\ufffdI\ufffd\ufffdkJ\u001c\ufffdg\ufffdX\ufffd\u0010\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u00143\u001d\ufffd\ufffdI\ufffd\ufffdkJ\u001c\ufffdg\ufffdX\ufffd\u0010\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u00143\u001d\ufffd\ufffdI\ufffd\ufffdkJ\u001c\ufffdg\ufffdX\ufffd\u0010\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "e4e90178b2e5d084507577e6d6e686fd4d916df3",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce",
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 12,
    "payload_entropy": 3.2516291673878226,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 21,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "074b165bed03b3b6baf70acd0699e17eacfd93d6",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253"
    ],
    "pattern_ids": [
        "pat-0391"
    ],
    "risk_confidence_factor": 74,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e9e55307b9c6c1bf5bae2abdb628281d",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "payload_preview": "SSH-2.0-Go\r\n",
    "request_sample": "SSH-2.0-Go\r\n",
    "payload_snippet": "SSH-2.0-Go",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n",
        "payload_snippet": "SSH-2.0-Go",
        "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a93ca9f20c4fa378f4dd3e033e2f08343f2f17d8",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce",
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 12,
    "payload_entropy": 3.2516291673878226,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 21,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "074b165bed03b3b6baf70acd0699e17eacfd93d6",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253"
    ],
    "pattern_ids": [
        "pat-0391"
    ],
    "risk_confidence_factor": 74,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e9e55307b9c6c1bf5bae2abdb628281d",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "payload_preview": "SSH-2.0-Go\r\n",
    "request_sample": "SSH-2.0-Go\r\n",
    "payload_snippet": "SSH-2.0-Go",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n",
        "payload_snippet": "SSH-2.0-Go",
        "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a93ca9f20c4fa378f4dd3e033e2f08343f2f17d8",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce",
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 908,
    "payload_entropy": 4.8260374509343595,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 22,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "c184d075b91a12d7037abe4b255f38a75d51f987",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "risk_confidence_factor": 74,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ef7a58714001ed0e240f69e495878178",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffda\ufffd\ufffdr\ufffd\b\ufffd\ufffdL|v\ufffdxI\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffda\ufffd\ufffdr\ufffd\b\ufffd\ufffdL|v\ufffdxI\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffda\ufffd\ufffdr\ufffd\b\ufffd\ufffdL|v\ufffdxI\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffda\ufffd\ufffdr\ufffd\b\ufffd\ufffdL|v\ufffdxI\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffda\ufffd\ufffdr\ufffd\b\ufffd\ufffdL|v\ufffdxI\ufffd\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "940d0beab7c98b0ad443f829e05485eb4dd56e21",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce",
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 12,
    "payload_entropy": 3.2516291673878226,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 21,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "074b165bed03b3b6baf70acd0699e17eacfd93d6",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253"
    ],
    "pattern_ids": [
        "pat-0391"
    ],
    "risk_confidence_factor": 74,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e9e55307b9c6c1bf5bae2abdb628281d",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "payload_preview": "SSH-2.0-Go\r\n",
    "request_sample": "SSH-2.0-Go\r\n",
    "payload_snippet": "SSH-2.0-Go",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n",
        "payload_snippet": "SSH-2.0-Go",
        "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a93ca9f20c4fa378f4dd3e033e2f08343f2f17d8",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce",
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 12,
    "payload_entropy": 3.2516291673878226,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 21,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "074b165bed03b3b6baf70acd0699e17eacfd93d6",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253"
    ],
    "pattern_ids": [
        "pat-0391"
    ],
    "risk_confidence_factor": 74,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e9e55307b9c6c1bf5bae2abdb628281d",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "payload_preview": "SSH-2.0-Go\r\n",
    "request_sample": "SSH-2.0-Go\r\n",
    "payload_snippet": "SSH-2.0-Go",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n",
        "payload_snippet": "SSH-2.0-Go",
        "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a93ca9f20c4fa378f4dd3e033e2f08343f2f17d8",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce",
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 908,
    "payload_entropy": 4.8307309336985895,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 22,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "c184d075b91a12d7037abe4b255f38a75d51f987",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "risk_confidence_factor": 74,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6418b05f705db79863c89c8409f21e32",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffdV\ufffd<4\ufffd\ufffd\ufffdN\ufffd\u054em\u0017\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffdV\ufffd<4\ufffd\ufffd\ufffdN\ufffd\u054em\u0017\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffdV\ufffd<4\ufffd\ufffd\ufffdN\ufffd\u054em\u0017\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffdV\ufffd<4\ufffd\ufffd\ufffdN\ufffd\u054em\u0017\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffdV\ufffd<4\ufffd\ufffd\ufffdN\ufffd\u054em\u0017\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "7d370c5a010e4eca2a85cb1d14f28330fff97a39",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce",
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 908,
    "payload_entropy": 4.833937012494545,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 22,
    "tag_count": 6,
    "anomaly_count": 0,
    "campaign_key": "c184d075b91a12d7037abe4b255f38a75d51f987",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "Minecraft varint handshake",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0554",
        "pat-0536"
    ],
    "risk_confidence_factor": 74,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "dce18d1f2ba6a93e2c1c8c964b76da52",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "payload_preview": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffdM\ufffdQD\ufffd\ufffdph\ufffd>\ufffd\u0364|\n\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffdM\ufffdQD\ufffd\ufffdph\ufffd>\ufffd\u0364|\n\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
    "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffdM\ufffdQD\ufffd\ufffdph\ufffd>\ufffd\u0364|\n\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffdM\ufffdQD\ufffd\ufffdph\ufffd>\ufffd\u0364|\n\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group14-sha1\u0000\u0000\u0001\ufffdrsa-sha2-512-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,ssh-rsa-cert-v01@openssh.com,ssh-",
        "payload_snippet": "SSH-2.0-Go\r\n\u0000\u0000\u0003|\u000b\u0014\ufffdM\ufffdQD\ufffd\ufffdph\ufffd>\ufffd\u0364|\n\u0000\u0000\u0000qcurve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diff",
        "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "1cc453941f489fa700e06c7ed52483ce34e97c48",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce",
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ]
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e397031205562756e74752d347562756e7475302e360d0a",
    "emulator_response_len": 41,
    "bytes_in": 12,
    "payload_entropy": 3.2516291673878226,
    "port_category": "well_known",
    "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 38365,
    "country": "CN",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 0,
    "risk_protocol": 36,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.9,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 0,
        "protocol": 36,
        "novelty": 0
    },
    "risk_score": 21,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "074b165bed03b3b6baf70acd0699e17eacfd93d6",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence": 0.74,
    "classification_confidence": 0.74,
    "precision_score": 83,
    "precision_signals": [
        "pat-0391",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "pat-0391",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253"
    ],
    "pattern_ids": [
        "pat-0391"
    ],
    "risk_confidence_factor": 74,
    "city": null,
    "is_datacenter": false,
    "is_tor_hint": false,
    "geo": {
        "country": "CN",
        "asn": 38365,
        "org": "Beijing Baidu Netcom Science and Technology Co., Ltd.",
        "is_datacenter": false,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e9e55307b9c6c1bf5bae2abdb628281d",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh"
    },
    "payload_preview": "SSH-2.0-Go\r\n",
    "request_sample": "SSH-2.0-Go\r\n",
    "payload_snippet": "SSH-2.0-Go",
    "evidence": {
        "request_sample": "SSH-2.0-Go\r\n",
        "payload_snippet": "SSH-2.0-Go",
        "classification_reason": "Type \u00ab ssh_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a93ca9f20c4fa378f4dd3e033e2f08343f2f17d8",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "net_bruteforce",
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated"
    ]
}