{"ip":"122.121.153.136","exported_at":"2026-10-23T09:30:49+00:00","period_days":30,"metrics":{"events7d":655,"distinct_ports":1,"distinct_classifications":2,"max_severity":6,"last_sensor_id":"paris-1","max_waf_score":null,"max_risk_score":35,"attack_stage":"probe","attack_chain_stage":"discovery","threat_family":["database_scan"],"recommended_action":"monitor","confidence":0.95,"risk_breakdown":{"waf":8,"classification":56,"behavior":0,"geo":0,"protocol":36,"novelty":25},"mitre_tactics":["TA0007","TA0001"],"mitre_technique":"TA0007","top_mitre_technique":"TA0007","top_mitre_count":655,"executive_one_liner_fr":"Activit\u00e9 suspecte \u00b7 risque 35\/100","campaign_hint_fr":null,"confidence_breakdown":{"waf":8,"classification":56,"behavior":0,"geo":0,"protocol":36,"novelty":25,"risk_score":35},"persona_hostname":"mail.sensor-1.internal","correlation_flags":[],"correlation_flags_labels_fr":[],"confidence_pct":95,"confidence_hint_fr":null,"sensor_role_label_fr":"Renseignement menaces","tags_summary_labels_fr":["pat-0519","Upstream"],"tags_summary":["pat-0519","INT-upstream"],"attack_vector":"mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)","protocol_details":{"mssql_tds_fr":"Connexion TDS Microsoft SQL Server","payload_preview":"\u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b#\ufffd\u0000\u0000\u0000\u0000\u0000\u0000(\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u04ac\ufffdB\ufffd\ufffd\ufffd\ufffdt 8\ufffd\f\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\u0002\u0000\u0000\u0001","port":1433,"service":"mssql","service_label_fr":"MSSQL"},"protocol_summary_fr":"Payload \u0012\u0001\u0000^\u0000\u0000\u0001\u0000\u0000\u0000$\u0000\u0006\u0001\u0000*\u0000\u0001\u0002\u0000+\u0000\u0001\u0003\u0000,\u0000\u0004\u0004\u00000\u0000\u0001\u0005\u00001\u0000$\u0006\u0000U\u0000\u0001\ufffd\u0004\b#\ufffd\u0000\u0000\u0000\u0000\u0000\u0000(\ufffd\u0000\ufffd\ufffd\ufffd\ufffd\u04ac\ufffd\u2026 \u00b7 MSSQL:1433","evidence_snippet":"^$*+,01$U\ufffd#\ufffd(\ufffd\ufffd\ufffd\ufffd\ufffd\u04ac\ufffdB\ufffd\ufffd\ufffd\ufffdt 8\ufffdb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd","target_port_label":"1433 \u00b7 MSSQL","emulator_service":"mssql","confidence_reason":"Confiance 95 % \u2014 Motif catalogue confirm\u00e9","classification_reason":"Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%","classification_reason_label_fr":"Type \u00ab Protocole TDS MSSQL \u00bb (signaux protocolaires) \u00b7 confiance 95%","confidence_factors_fr":"Confiance 95 % \u2014 Score WAF 8","payload_preview":"^$*+,01$U\ufffd#\ufffd(\ufffd\ufffd\ufffd\ufffd\ufffd\u04ac\ufffdB\ufffd\ufffd\ufffd\ufffdt 8\ufffdb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd","open_intel":{"source":"Emerging Threats open","status":"ok","matched":false,"label_fr":null,"detail_fr":null},"open_intel_ipsum":{"source":"IPsum","status":"ok","matched":false,"label_fr":null,"detail_fr":null},"open_intel_cins":{"source":"CINS Army","status":"ok","matched":false,"label_fr":null,"detail_fr":null}},"dnsbl":{"query":"136.153.121.122.dnsbl.blacklistip.com","listed":false,"available":false,"response":null,"meaning":null,"label":null},"events":[{"id":5784886,"ip":"122.121.153.136","ts":"2026-10-21 06:27:55.000000","proto":"tcp","src_port":64082,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.689048156786396, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 3462, \u0022country\u0022: \u0022TW\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022338799153e42ab29e9432eb3b4b0bcf68536621c\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022TW\u0022, \u0022asn\u0022: 3462, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002280ff50919bceb8fbe449021cbff86f3b\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\u04ac\ufffdB\ufffd\ufffd\ufffd\ufffdt 8\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\u04ac\ufffdB\ufffd\ufffd\ufffd\ufffdt 8\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\u04ac\ufffdB\ufffd\ufffd\ufffd\ufffdt 8\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\u04ac\ufffdB\ufffd\ufffd\ufffd\ufffdt 8\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\u04ac\ufffdB\ufffd\ufffd\ufffd\ufffdt 8\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022c8c80c92154f1ee08c3c06120cf04d8715777023\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\u04ac\ufffdB\ufffd\ufffd\ufffd\ufffdt 8\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffd\ufffd\ufffd\ufffd\ufffd\u04ac\ufffdB\ufffd\ufffd\ufffd\ufffdt 8\ufffdb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\u04ac\ufffdB\ufffd\ufffd\ufffd\ufffdt 8\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffd\ufffd\ufffd\ufffd\ufffd\u04ac\ufffdB\ufffd\ufffd\ufffd\ufffdt 8\ufffdb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_slow\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_slow\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":5784833,"ip":"122.121.153.136","ts":"2026-10-21 06:27:48.000000","proto":"tcp","src_port":52084,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.654525683405156, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 3462, \u0022country\u0022: \u0022TW\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022338799153e42ab29e9432eb3b4b0bcf68536621c\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022TW\u0022, \u0022asn\u0022: 3462, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00221019f2f515b96eac283b1e82170f317e\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000q\ufffdv\ufffd\ufffd[\ufffdM\ufffd\ufffd\ufffdBSE\\u0004}\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000q\ufffdv\ufffd\ufffd[\ufffdM\ufffd\ufffd\ufffdBSE\\u0004}\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000q\ufffdv\ufffd\ufffd[\ufffdM\ufffd\ufffd\ufffdBSE\\u0004}\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000q\ufffdv\ufffd\ufffd[\ufffdM\ufffd\ufffd\ufffdBSE\\u0004}\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000q\ufffdv\ufffd\ufffd[\ufffdM\ufffd\ufffd\ufffdBSE\\u0004}\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002252b051d0bb87744085faf1475b4b610af28f7432\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000q\ufffdv\ufffd\ufffd[\ufffdM\ufffd\ufffd\ufffdBSE\\u0004}\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffdq\ufffdv\ufffd\ufffd[\ufffdM\ufffd\ufffd\ufffdBSE}b*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab mssql_tds \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000q\ufffdv\ufffd\ufffd[\ufffdM\ufffd\ufffd\ufffdBSE\\u0004}\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffdq\ufffdv\ufffd\ufffd[\ufffdM\ufffd\ufffd\ufffdBSE}b*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_slow\u0022, \u0022net_mssql_tds\u0022], \u0022behavior_alert_count\u0022: 1, \u0022behavior_priority\u0022: 72}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_slow\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":5784730,"ip":"122.121.153.136","ts":"2026-10-21 06:27:33.000000","proto":"tcp","src_port":59996,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.646494965297034, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 3462, \u0022country\u0022: \u0022TW\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022b82edc85ccfccb9933b235c8b96d99fe50ee52d8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022TW\u0022, \u0022asn\u0022: 3462, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00229151cad2825768ddd7026af98c0d5174\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffdw6\\u0015\ufffd\ufffdGM\ufffdV\\u000e\ufffd\ufffd\ufffd\ufffd\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffdw6\\u0015\ufffd\ufffdGM\ufffdV\\u000e\ufffd\ufffd\ufffd\ufffd\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffdw6\\u0015\ufffd\ufffdGM\ufffdV\\u000e\ufffd\ufffd\ufffd\ufffd\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffdw6\\u0015\ufffd\ufffdGM\ufffdV\\u000e\ufffd\ufffd\ufffd\ufffd\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffdw6\\u0015\ufffd\ufffdGM\ufffdV\\u000e\ufffd\ufffd\ufffd\ufffd\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002286071bfdd4e8d030aa576be366e3399bd99f8404\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffdw6\\u0015\ufffd\ufffdGM\ufffdV\\u000e\ufffd\ufffd\ufffd\ufffd\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffd\ufffdw6\ufffd\ufffdGM\ufffdV\ufffd\ufffd\ufffd\ufffd\ufffdb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffdw6\\u0015\ufffd\ufffdGM\ufffdV\\u000e\ufffd\ufffd\ufffd\ufffd\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffd\ufffdw6\ufffd\ufffdGM\ufffdV\ufffd\ufffd\ufffd\ufffd\ufffdb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce\u0022, \u0022net_mssql_tds\u0022], \u0022behavior_alert_count\u0022: 1, \u0022behavior_priority\u0022: 72}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":5784645,"ip":"122.121.153.136","ts":"2026-10-21 06:27:19.000000","proto":"tcp","src_port":55262,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.646494965297034, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 3462, \u0022country\u0022: \u0022TW\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022b82edc85ccfccb9933b235c8b96d99fe50ee52d8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022TW\u0022, \u0022asn\u0022: 3462, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022ab8c175ac0fcb91a7b4ae5a2a84b54c1\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\\u001bwZ\ufffd\u024f\\u001bB\ufffd\/\\u001fn\ufffd\\u0003.\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\\u001bwZ\ufffd\u024f\\u001bB\ufffd\/\\u001fn\ufffd\\u0003.\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\\u001bwZ\ufffd\u024f\\u001bB\ufffd\/\\u001fn\ufffd\\u0003.\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\\u001bwZ\ufffd\u024f\\u001bB\ufffd\/\\u001fn\ufffd\\u0003.\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\\u001bwZ\ufffd\u024f\\u001bB\ufffd\/\\u001fn\ufffd\\u0003.\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022d5080cd375c63d4bbec75354bd725c671afea4e2\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\\u001bwZ\ufffd\u024f\\u001bB\ufffd\/\\u001fn\ufffd\\u0003.\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffdwZ\ufffd\u024fB\ufffd\/n\ufffd.\ufffdb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\\u001bwZ\ufffd\u024f\\u001bB\ufffd\/\\u001fn\ufffd\\u0003.\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffdwZ\ufffd\u024fB\ufffd\/n\ufffd.\ufffdb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":5784619,"ip":"122.121.153.136","ts":"2026-10-21 06:27:16.000000","proto":"tcp","src_port":54308,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.6677715610417145, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 3462, \u0022country\u0022: \u0022TW\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022b82edc85ccfccb9933b235c8b96d99fe50ee52d8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022TW\u0022, \u0022asn\u0022: 3462, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00229af7565572dfcc5112a8daad5ed88547\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000[\ufffd\ufffd\ufffd\ufffd\\u0015}J\ufffd\ufffd\ufffd{A:n\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000[\ufffd\ufffd\ufffd\ufffd\\u0015}J\ufffd\ufffd\ufffd{A:n\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000[\ufffd\ufffd\ufffd\ufffd\\u0015}J\ufffd\ufffd\ufffd{A:n\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000[\ufffd\ufffd\ufffd\ufffd\\u0015}J\ufffd\ufffd\ufffd{A:n\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000[\ufffd\ufffd\ufffd\ufffd\\u0015}J\ufffd\ufffd\ufffd{A:n\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b8ddeaf54b5a517b137bb56cc1a097d1a14caf91\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000[\ufffd\ufffd\ufffd\ufffd\\u0015}J\ufffd\ufffd\ufffd{A:n\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffd[\ufffd\ufffd\ufffd\ufffd}J\ufffd\ufffd\ufffd{A:n\ufffdb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000[\ufffd\ufffd\ufffd\ufffd\\u0015}J\ufffd\ufffd\ufffd{A:n\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffd[\ufffd\ufffd\ufffd\ufffd}J\ufffd\ufffd\ufffd{A:n\ufffdb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":5784571,"ip":"122.121.153.136","ts":"2026-10-21 06:27:09.000000","proto":"tcp","src_port":52101,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.566488331904234, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 3462, \u0022country\u0022: \u0022TW\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022b82edc85ccfccb9933b235c8b96d99fe50ee52d8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022TW\u0022, \u0022asn\u0022: 3462, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002261e0f955d932c6cab04a1c2b8f4a28e7\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\\u0004j\ufffdlq\u00b6K\ufffd\ufffd\ufffd\ufffd|V\ufffd\\u0000\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\\u0004j\ufffdlq\u00b6K\ufffd\ufffd\ufffd\ufffd|V\ufffd\\u0000\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\\u0004j\ufffdlq\u00b6K\ufffd\ufffd\ufffd\ufffd|V\ufffd\\u0000\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\\u0004j\ufffdlq\u00b6K\ufffd\ufffd\ufffd\ufffd|V\ufffd\\u0000\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\\u0004j\ufffdlq\u00b6K\ufffd\ufffd\ufffd\ufffd|V\ufffd\\u0000\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022faea8739598d1e597bea0ad2be0b0ecd2d65b22d\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\\u0004j\ufffdlq\u00b6K\ufffd\ufffd\ufffd\ufffd|V\ufffd\\u0000\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffdj\ufffdlq\u00b6K\ufffd\ufffd\ufffd\ufffd|V\ufffdb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\\u0004j\ufffdlq\u00b6K\ufffd\ufffd\ufffd\ufffd|V\ufffd\\u0000\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffdj\ufffdlq\u00b6K\ufffd\ufffd\ufffd\ufffd|V\ufffdb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":5784548,"ip":"122.121.153.136","ts":"2026-10-21 06:27:06.000000","proto":"tcp","src_port":51152,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.625218369552353, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 3462, \u0022country\u0022: \u0022TW\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022b82edc85ccfccb9933b235c8b96d99fe50ee52d8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022TW\u0022, \u0022asn\u0022: 3462, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022edb568b9becbc74ece35842fbcf17072\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\ufffdxK\ufffd\ufffd\ufffdB\ufffd\ufffd\ufffd\\u0019V\u05e1z\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\ufffdxK\ufffd\ufffd\ufffdB\ufffd\ufffd\ufffd\\u0019V\u05e1z\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\ufffdxK\ufffd\ufffd\ufffdB\ufffd\ufffd\ufffd\\u0019V\u05e1z\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\ufffdxK\ufffd\ufffd\ufffdB\ufffd\ufffd\ufffd\\u0019V\u05e1z\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\ufffdxK\ufffd\ufffd\ufffdB\ufffd\ufffd\ufffd\\u0019V\u05e1z\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b06d92dfd713ad1c9bf47fffe6a4f60f72ebca71\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\ufffdxK\ufffd\ufffd\ufffdB\ufffd\ufffd\ufffd\\u0019V\u05e1z\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffd\ufffd\ufffdxK\ufffd\ufffd\ufffdB\ufffd\ufffd\ufffdV\u05e1zb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\ufffdxK\ufffd\ufffd\ufffdB\ufffd\ufffd\ufffd\\u0019V\u05e1z\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffd\ufffd\ufffdxK\ufffd\ufffd\ufffdB\ufffd\ufffd\ufffdV\u05e1zb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":5784525,"ip":"122.121.153.136","ts":"2026-10-21 06:27:03.000000","proto":"tcp","src_port":50259,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.52915029994331, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 3462, \u0022country\u0022: \u0022TW\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022b82edc85ccfccb9933b235c8b96d99fe50ee52d8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022TW\u0022, \u0022asn\u0022: 3462, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00224dbaddddb1754d53a11e4c63a37a5075\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\\u001b\\u001e\ufffd\\u0016\ufffd\\u000fL\ufffd42\ufffdQ\\u0003\\u0000\\u0003\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\\u001b\\u001e\ufffd\\u0016\ufffd\\u000fL\ufffd42\ufffdQ\\u0003\\u0000\\u0003\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\\u001b\\u001e\ufffd\\u0016\ufffd\\u000fL\ufffd42\ufffdQ\\u0003\\u0000\\u0003\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\\u001b\\u001e\ufffd\\u0016\ufffd\\u000fL\ufffd42\ufffdQ\\u0003\\u0000\\u0003\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\\u001b\\u001e\ufffd\\u0016\ufffd\\u000fL\ufffd42\ufffdQ\\u0003\\u0000\\u0003\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022fa4b669cf069abc129a958fd08c24a10ac36b515\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\\u001b\\u001e\ufffd\\u0016\ufffd\\u000fL\ufffd42\ufffdQ\\u0003\\u0000\\u0003\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffd\ufffd\ufffd\ufffdL\ufffd42\ufffdQb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\\u001b\\u001e\ufffd\\u0016\ufffd\\u000fL\ufffd42\ufffdQ\\u0003\\u0000\\u0003\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffd\ufffd\ufffd\ufffdL\ufffd42\ufffdQb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":5784520,"ip":"122.121.153.136","ts":"2026-10-21 06:27:02.000000","proto":"tcp","src_port":50007,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.603941773807672, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 3462, \u0022country\u0022: \u0022TW\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022b82edc85ccfccb9933b235c8b96d99fe50ee52d8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022TW\u0022, \u0022asn\u0022: 3462, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022e1ed001ba2821dd95bfe91051c7524ea\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd,.\ufffd8\ufffd\ufffdD\ufffd\ufffd\ufffd\u0086\ufffd7\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd,.\ufffd8\ufffd\ufffdD\ufffd\ufffd\ufffd\u0086\ufffd7\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd,.\ufffd8\ufffd\ufffdD\ufffd\ufffd\ufffd\u0086\ufffd7\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd,.\ufffd8\ufffd\ufffdD\ufffd\ufffd\ufffd\u0086\ufffd7\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd,.\ufffd8\ufffd\ufffdD\ufffd\ufffd\ufffd\u0086\ufffd7\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002262e4e1b72280eedbc15400975d321894885f68ef\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd,.\ufffd8\ufffd\ufffdD\ufffd\ufffd\ufffd\u0086\ufffd7\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffd\ufffd,.\ufffd8\ufffd\ufffdD\ufffd\ufffd\ufffd\u0086\ufffd7\ufffdb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd,.\ufffd8\ufffd\ufffdD\ufffd\ufffd\ufffd\u0086\ufffd7\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffd\ufffd,.\ufffd8\ufffd\ufffdD\ufffd\ufffd\ufffd\u0086\ufffd7\ufffdb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":5784412,"ip":"122.121.153.136","ts":"2026-10-21 06:26:47.000000","proto":"tcp","src_port":62278,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.646494965297034, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 3462, \u0022country\u0022: \u0022TW\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022b82edc85ccfccb9933b235c8b96d99fe50ee52d8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022TW\u0022, \u0022asn\u0022: 3462, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022850111054301d5983bdf917afc3b5f81\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd.t\ufffd\\u000f1\ufffdM\ufffddc\ufffdxnx\\u001e\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd.t\ufffd\\u000f1\ufffdM\ufffddc\ufffdxnx\\u001e\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd.t\ufffd\\u000f1\ufffdM\ufffddc\ufffdxnx\\u001e\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd.t\ufffd\\u000f1\ufffdM\ufffddc\ufffdxnx\\u001e\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd.t\ufffd\\u000f1\ufffdM\ufffddc\ufffdxnx\\u001e\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00228e9512a700edfa21e66b99654b675806741c0baa\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd.t\ufffd\\u000f1\ufffdM\ufffddc\ufffdxnx\\u001e\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffd\ufffd.t\ufffd1\ufffdM\ufffddc\ufffdxnxb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd.t\ufffd\\u000f1\ufffdM\ufffddc\ufffdxnx\\u001e\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffd\ufffd.t\ufffd1\ufffdM\ufffddc\ufffdxnxb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":5784406,"ip":"122.121.153.136","ts":"2026-10-21 06:26:46.000000","proto":"tcp","src_port":62043,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.6677715610417145, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 3462, \u0022country\u0022: \u0022TW\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022b82edc85ccfccb9933b235c8b96d99fe50ee52d8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022TW\u0022, \u0022asn\u0022: 3462, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022b56a178e64d0d3da0e4f143d8c0e3dde\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000:\\t\u0634\ufffd\u0027\ufffdA\ufffdx\ufffd;\ufffd\\u001e\ufffd\\u0018\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000:\\t\u0634\ufffd\u0027\ufffdA\ufffdx\ufffd;\ufffd\\u001e\ufffd\\u0018\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000:\\t\u0634\ufffd\u0027\ufffdA\ufffdx\ufffd;\ufffd\\u001e\ufffd\\u0018\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000:\\t\u0634\ufffd\u0027\ufffdA\ufffdx\ufffd;\ufffd\\u001e\ufffd\\u0018\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000:\\t\u0634\ufffd\u0027\ufffdA\ufffdx\ufffd;\ufffd\\u001e\ufffd\\u0018\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022672775a4313b4680fdf5b9ca45090696350ae126\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000:\\t\u0634\ufffd\u0027\ufffdA\ufffdx\ufffd;\ufffd\\u001e\ufffd\\u0018\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffd:\\t\u0634\ufffd\u0027\ufffdA\ufffdx\ufffd;\ufffd\ufffdb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000:\\t\u0634\ufffd\u0027\ufffdA\ufffdx\ufffd;\ufffd\\u001e\ufffd\\u0018\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffd:\\t\u0634\ufffd\u0027\ufffdA\ufffdx\ufffd;\ufffd\ufffdb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":5784402,"ip":"122.121.153.136","ts":"2026-10-21 06:26:46.000000","proto":"tcp","src_port":61775,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.603941773807672, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 3462, \u0022country\u0022: \u0022TW\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022b82edc85ccfccb9933b235c8b96d99fe50ee52d8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022TW\u0022, \u0022asn\u0022: 3462, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022933eab69be02632e3444a29650430625\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000B\ufffdP\ufffd\ufffd\u0360L\ufffd\ufffd l\ufffdL\ufffd\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000B\ufffdP\ufffd\ufffd\u0360L\ufffd\ufffd l\ufffdL\ufffd\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000B\ufffdP\ufffd\ufffd\u0360L\ufffd\ufffd l\ufffdL\ufffd\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000B\ufffdP\ufffd\ufffd\u0360L\ufffd\ufffd l\ufffdL\ufffd\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000B\ufffdP\ufffd\ufffd\u0360L\ufffd\ufffd l\ufffdL\ufffd\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022a088e6b7580fc601d32027d5a54cc3f9fa7cf794\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000B\ufffdP\ufffd\ufffd\u0360L\ufffd\ufffd l\ufffdL\ufffd\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffdB\ufffdP\ufffd\ufffd\u0360L\ufffd\ufffd l\ufffdL\ufffd\ufffdb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000B\ufffdP\ufffd\ufffd\u0360L\ufffd\ufffd l\ufffdL\ufffd\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffdB\ufffdP\ufffd\ufffd\u0360L\ufffd\ufffd l\ufffdL\ufffd\ufffdb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":5784382,"ip":"122.121.153.136","ts":"2026-10-21 06:26:43.000000","proto":"tcp","src_port":61017,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.638464247188914, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 3462, \u0022country\u0022: \u0022TW\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022b82edc85ccfccb9933b235c8b96d99fe50ee52d8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022TW\u0022, \u0022asn\u0022: 3462, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022832789a53c3587f7df31a952edf3cfad\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\\b[\ufffd\ufffd\ufffdH\ufffd\\u0019n\ufffd\ufffd=-\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\\b[\ufffd\ufffd\ufffdH\ufffd\\u0019n\ufffd\ufffd=-\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\\b[\ufffd\ufffd\ufffdH\ufffd\\u0019n\ufffd\ufffd=-\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\\b[\ufffd\ufffd\ufffdH\ufffd\\u0019n\ufffd\ufffd=-\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\\b[\ufffd\ufffd\ufffdH\ufffd\\u0019n\ufffd\ufffd=-\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022976e1c5f77debab4e44635c80900af095480825d\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\\b[\ufffd\ufffd\ufffdH\ufffd\\u0019n\ufffd\ufffd=-\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffd\ufffd[\ufffd\ufffd\ufffdH\ufffdn\ufffd\ufffd=-\ufffdb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\\b[\ufffd\ufffd\ufffdH\ufffd\\u0019n\ufffd\ufffd=-\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffd\ufffd[\ufffd\ufffd\ufffdH\ufffdn\ufffd\ufffd=-\ufffdb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":5784356,"ip":"122.121.153.136","ts":"2026-10-21 06:26:40.000000","proto":"tcp","src_port":60246,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.532081268465508, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 3462, \u0022country\u0022: \u0022TW\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022TW\u0022, \u0022asn\u0022: 3462, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022386349ccf9fdf582976528a60fb48e96\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\\u001c\ufffdb\\u0016\\u0003\ufffd0F\ufffd\\u0011Y\ufffd\ufffd\\u0005\\f\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\\u001c\ufffdb\\u0016\\u0003\ufffd0F\ufffd\\u0011Y\ufffd\ufffd\\u0005\\f\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\\u001c\ufffdb\\u0016\\u0003\ufffd0F\ufffd\\u0011Y\ufffd\ufffd\\u0005\\f\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\\u001c\ufffdb\\u0016\\u0003\ufffd0F\ufffd\\u0011Y\ufffd\ufffd\\u0005\\f\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\\u001c\ufffdb\\u0016\\u0003\ufffd0F\ufffd\\u0011Y\ufffd\ufffd\\u0005\\f\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00228f4f94b5fe172ff3fd48b97271f38b1a5aac85c8\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\\u001c\ufffdb\\u0016\\u0003\ufffd0F\ufffd\\u0011Y\ufffd\ufffd\\u0005\\f\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffd\ufffdb\ufffd0F\ufffdY\ufffd\ufffd\ufffdb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\\u001c\ufffdb\\u0016\\u0003\ufffd0F\ufffd\\u0011Y\ufffd\ufffd\\u0005\\f\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffd\ufffdb\ufffd0F\ufffdY\ufffd\ufffd\ufffdb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":5784336,"ip":"122.121.153.136","ts":"2026-10-21 06:26:37.000000","proto":"tcp","src_port":59413,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.545327146102068, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 3462, \u0022country\u0022: \u0022TW\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022TW\u0022, \u0022asn\u0022: 3462, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002280d7a65ee58e3d9b596aa876afb485ec\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\ufffd\\u0016\ufffd\ufffd$4I\ufffd((\ufffd,4\ufffdO\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\ufffd\\u0016\ufffd\ufffd$4I\ufffd((\ufffd,4\ufffdO\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\ufffd\\u0016\ufffd\ufffd$4I\ufffd((\ufffd,4\ufffdO\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\ufffd\\u0016\ufffd\ufffd$4I\ufffd((\ufffd,4\ufffdO\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\ufffd\\u0016\ufffd\ufffd$4I\ufffd((\ufffd,4\ufffdO\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022f6ce6ce962ab870307231deab9d4738323d9805c\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\ufffd\\u0016\ufffd\ufffd$4I\ufffd((\ufffd,4\ufffdO\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffd\ufffd\ufffd\ufffd\ufffd$4I\ufffd((\ufffd,4\ufffdOb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\ufffd\\u0016\ufffd\ufffd$4I\ufffd((\ufffd,4\ufffdO\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffd\ufffd\ufffd\ufffd\ufffd$4I\ufffd((\ufffd,4\ufffdOb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\ufffd\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":5784328,"ip":"122.121.153.136","ts":"2026-10-21 06:26:36.000000","proto":"tcp","src_port":59137,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.646494965297034, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 3462, \u0022country\u0022: \u0022TW\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022TW\u0022, \u0022asn\u0022: 3462, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002287e350de57ff1ec53184deb92be53447\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\u05c8i\ufffd~8uJ\ufffdKQ\ufffd4\ufffd91\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\\u0002\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\u05c8i\ufffd~8uJ\ufffdKQ\ufffd4\ufffd91\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\u05c8i\ufffd~8uJ\ufffdKQ\ufffd4\ufffd91\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\\u0002\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\u05c8i\ufffd~8uJ\ufffdKQ\ufffd4\ufffd91\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\u05c8i\ufffd~8uJ\ufffdKQ\ufffd4\ufffd91\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\\u0002\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002258bd5f0333a5a1d4041916ad02ed26bbff0f6215\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\u05c8i\ufffd~8uJ\ufffdKQ\ufffd4\ufffd91\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffd\u05c8i\ufffd~8uJ\ufffdKQ\ufffd4\ufffd91b*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\u05c8i\ufffd~8uJ\ufffdKQ\ufffd4\ufffd91\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffd\u05c8i\ufffd~8uJ\ufffdKQ\ufffd4\ufffd91b*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":5784320,"ip":"122.121.153.136","ts":"2026-10-21 06:26:35.000000","proto":"tcp","src_port":58892,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.6677715610417145, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 3462, \u0022country\u0022: \u0022TW\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022TW\u0022, \u0022asn\u0022: 3462, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022c74099007a6ef8c0a5ad36596b4fa4fa\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\\u0017\\u000e\ufffd\ufffd\\u001c\\u0014\ufffdK\ufffd\ufffd\ufffdzf\\u000eL\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb~\\u0002\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\\u0017\\u000e\ufffd\ufffd\\u001c\\u0014\ufffdK\ufffd\ufffd\ufffdzf\\u000eL\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb~\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\\u0017\\u000e\ufffd\ufffd\\u001c\\u0014\ufffdK\ufffd\ufffd\ufffdzf\\u000eL\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb~\\u0002\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\\u0017\\u000e\ufffd\ufffd\\u001c\\u0014\ufffdK\ufffd\ufffd\ufffdzf\\u000eL\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb~\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\\u0017\\u000e\ufffd\ufffd\\u001c\\u0014\ufffdK\ufffd\ufffd\ufffdzf\\u000eL\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb~\\u0002\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022c37769bc18968537d122fab99771737a54ec50c3\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\\u0017\\u000e\ufffd\ufffd\\u001c\\u0014\ufffdK\ufffd\ufffd\ufffdzf\\u000eL\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb~\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffd\ufffd\ufffd\ufffdK\ufffd\ufffd\ufffdzfL\ufffdb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb~\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\\u0017\\u000e\ufffd\ufffd\\u001c\\u0014\ufffdK\ufffd\ufffd\ufffdzf\\u000eL\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb~\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffd\ufffd\ufffd\ufffdK\ufffd\ufffd\ufffdzfL\ufffdb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb~\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":5784311,"ip":"122.121.153.136","ts":"2026-10-21 06:26:34.000000","proto":"tcp","src_port":58680,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.638464247188912, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 3462, \u0022country\u0022: \u0022TW\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022TW\u0022, \u0022asn\u0022: 3462, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00228b420f3502bbbec8d5085da5ebae6392\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\\u001d2\ufffd\ufffd\ufffdJ\ufffd\ufffdT\ufffd\ufffd\\n\ufffd\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb}\\u0002\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\\u001d2\ufffd\ufffd\ufffdJ\ufffd\ufffdT\ufffd\ufffd\\n\ufffd\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb}\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\\u001d2\ufffd\ufffd\ufffdJ\ufffd\ufffdT\ufffd\ufffd\\n\ufffd\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb}\\u0002\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\\u001d2\ufffd\ufffd\ufffdJ\ufffd\ufffdT\ufffd\ufffd\\n\ufffd\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb}\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\\u001d2\ufffd\ufffd\ufffdJ\ufffd\ufffdT\ufffd\ufffd\\n\ufffd\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb}\\u0002\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002269abaef1c5d136447ab2e81118f2e0a9fa8a92ce\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\\u001d2\ufffd\ufffd\ufffdJ\ufffd\ufffdT\ufffd\ufffd\\n\ufffd\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb}\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffd\ufffd2\ufffd\ufffd\ufffdJ\ufffd\ufffdT\ufffd\ufffd\\n\ufffd\ufffdb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb}\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\\u001d2\ufffd\ufffd\ufffdJ\ufffd\ufffdT\ufffd\ufffd\\n\ufffd\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb}\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffd\ufffd2\ufffd\ufffd\ufffdJ\ufffd\ufffdT\ufffd\ufffd\\n\ufffd\ufffdb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb}\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":5784301,"ip":"122.121.153.136","ts":"2026-10-21 06:26:33.000000","proto":"tcp","src_port":58439,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.595911055699551, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 3462, \u0022country\u0022: \u0022TW\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022TW\u0022, \u0022asn\u0022: 3462, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002226aa4479faffd17c8ac2a98a5fcf46de\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\ufffd|t\\u0012A\ufffd\ufffd\ufffd\ufffd$i~Y\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb|\\u0002\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\ufffd|t\\u0012A\ufffd\ufffd\ufffd\ufffd$i~Y\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb|\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\ufffd|t\\u0012A\ufffd\ufffd\ufffd\ufffd$i~Y\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb|\\u0002\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\ufffd|t\\u0012A\ufffd\ufffd\ufffd\ufffd$i~Y\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb|\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\ufffd|t\\u0012A\ufffd\ufffd\ufffd\ufffd$i~Y\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb|\\u0002\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022c535dc272dd767c831c77f28535807ba4a574dfd\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\ufffd|t\\u0012A\ufffd\ufffd\ufffd\ufffd$i~Y\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb|\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffd\ufffd\ufffd|tA\ufffd\ufffd\ufffd\ufffd$i~Yb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb|\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\ufffd|t\\u0012A\ufffd\ufffd\ufffd\ufffd$i~Y\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb|\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffd\ufffd\ufffd|tA\ufffd\ufffd\ufffd\ufffd$i~Yb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb|\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":5784291,"ip":"122.121.153.136","ts":"2026-10-21 06:26:32.000000","proto":"tcp","src_port":58204,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.595911055699551, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 3462, \u0022country\u0022: \u0022TW\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022TW\u0022, \u0022asn\u0022: 3462, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022f7e0266cbcd3482f62231b3a88af76a0\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\\r\ufffd\ufffdaK\\f\ufffdG\ufffdk\ufffd\\f\ufffdX\ufffdI\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb{\\u0002\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\\r\ufffd\ufffdaK\\f\ufffdG\ufffdk\ufffd\\f\ufffdX\ufffdI\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb{\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\\r\ufffd\ufffdaK\\f\ufffdG\ufffdk\ufffd\\f\ufffdX\ufffdI\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb{\\u0002\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\\r\ufffd\ufffdaK\\f\ufffdG\ufffdk\ufffd\\f\ufffdX\ufffdI\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb{\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\\r\ufffd\ufffdaK\\f\ufffdG\ufffdk\ufffd\\f\ufffdX\ufffdI\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb{\\u0002\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00220fafceb86080a91b335a3708b593143f628d2642\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\\r\ufffd\ufffdaK\\f\ufffdG\ufffdk\ufffd\\f\ufffdX\ufffdI\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb{\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffd\\r\ufffd\ufffdaK\ufffdG\ufffdk\ufffd\ufffdX\ufffdIb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb{\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\\r\ufffd\ufffdaK\\f\ufffdG\ufffdk\ufffd\\f\ufffdX\ufffdI\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb{\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffd\\r\ufffd\ufffdaK\ufffdG\ufffdk\ufffd\ufffdX\ufffdIb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdb{\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":5784289,"ip":"122.121.153.136","ts":"2026-10-21 06:26:31.000000","proto":"tcp","src_port":57960,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.6677715610417145, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 3462, \u0022country\u0022: \u0022TW\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022TW\u0022, \u0022asn\u0022: 3462, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00225c90560746ea6f154cc6bb51316a05c6\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\\u000e\u058f\/\ufffdRB\ufffds\ufffd\ufffdA\ufffdA\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdbz\\u0002\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\\u000e\u058f\/\ufffdRB\ufffds\ufffd\ufffdA\ufffdA\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdbz\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\\u000e\u058f\/\ufffdRB\ufffds\ufffd\ufffdA\ufffdA\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdbz\\u0002\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\\u000e\u058f\/\ufffdRB\ufffds\ufffd\ufffdA\ufffdA\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdbz\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\\u000e\u058f\/\ufffdRB\ufffds\ufffd\ufffdA\ufffdA\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdbz\\u0002\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00228f1986168859389bad3ccb09156adf54e256c02b\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\\u000e\u058f\/\ufffdRB\ufffds\ufffd\ufffdA\ufffdA\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdbz\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffd\ufffd\u058f\/\ufffdRB\ufffds\ufffd\ufffdA\ufffdAb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdbz\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\\u000e\u058f\/\ufffdRB\ufffds\ufffd\ufffdA\ufffdA\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdbz\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffd\ufffd\u058f\/\ufffdRB\ufffds\ufffd\ufffdA\ufffdAb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdbz\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":5784281,"ip":"122.121.153.136","ts":"2026-10-21 06:26:30.000000","proto":"tcp","src_port":57733,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.6677715610417145, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 3462, \u0022country\u0022: \u0022TW\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022TW\u0022, \u0022asn\u0022: 3462, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00222cbc78c8737d00b6518d702402301fe4\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffdz\ufffd\\u0019\ufffd\\u000f\ufffdM\ufffd+\ufffdJi\ufffd\ufffd\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdby\\u0002\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffdz\ufffd\\u0019\ufffd\\u000f\ufffdM\ufffd+\ufffdJi\ufffd\ufffd\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdby\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffdz\ufffd\\u0019\ufffd\\u000f\ufffdM\ufffd+\ufffdJi\ufffd\ufffd\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdby\\u0002\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffdz\ufffd\\u0019\ufffd\\u000f\ufffdM\ufffd+\ufffdJi\ufffd\ufffd\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdby\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffdz\ufffd\\u0019\ufffd\\u000f\ufffdM\ufffd+\ufffdJi\ufffd\ufffd\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdby\\u0002\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00224e4e1535232f7f61f6f6053791183305e366643e\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffdz\ufffd\\u0019\ufffd\\u000f\ufffdM\ufffd+\ufffdJi\ufffd\ufffd\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdby\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffd\ufffdz\ufffd\ufffd\ufffdM\ufffd+\ufffdJi\ufffd\ufffd\ufffdb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdby\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffdz\ufffd\\u0019\ufffd\\u000f\ufffdM\ufffd+\ufffdJi\ufffd\ufffd\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdby\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffd\ufffdz\ufffd\ufffd\ufffdM\ufffd+\ufffdJi\ufffd\ufffd\ufffdb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdby\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":5784272,"ip":"122.121.153.136","ts":"2026-10-21 06:26:29.000000","proto":"tcp","src_port":57479,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.595911055699551, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 3462, \u0022country\u0022: \u0022TW\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022TW\u0022, \u0022asn\u0022: 3462, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022e9dee90bfb413a42fe08b36876d3cbce\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\ufffd\ufffdxK\ufffdgD\ufffdO\ufffd\\u0006A.U\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdbx\\u0002\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\ufffd\ufffdxK\ufffdgD\ufffdO\ufffd\\u0006A.U\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdbx\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\ufffd\ufffdxK\ufffdgD\ufffdO\ufffd\\u0006A.U\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdbx\\u0002\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\ufffd\ufffdxK\ufffdgD\ufffdO\ufffd\\u0006A.U\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdbx\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\ufffd\ufffdxK\ufffdgD\ufffdO\ufffd\\u0006A.U\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdbx\\u0002\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00223bdad4fa2dec6d53410a38983c6a90082777e092\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\ufffd\ufffdxK\ufffdgD\ufffdO\ufffd\\u0006A.U\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdbx\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffd\ufffd\ufffd\ufffdxK\ufffdgD\ufffdO\ufffdA.U\ufffdb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdbx\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\ufffd\ufffdxK\ufffdgD\ufffdO\ufffd\\u0006A.U\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdbx\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffd\ufffd\ufffd\ufffdxK\ufffdgD\ufffdO\ufffdA.U\ufffdb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdbx\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":5784265,"ip":"122.121.153.136","ts":"2026-10-21 06:26:28.000000","proto":"tcp","src_port":57224,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.60915693333611, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 3462, \u0022country\u0022: \u0022TW\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022TW\u0022, \u0022asn\u0022: 3462, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00222b3600e998f6349b026496792f1fd8a0\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000x\\u0013\ufffd\ufffd\ufffdA\\u0010C\ufffd\ufffd\\u000f\\f\\u0006\\f\ufffd\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdbw\\u0002\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000x\\u0013\ufffd\ufffd\ufffdA\\u0010C\ufffd\ufffd\\u000f\\f\\u0006\\f\ufffd\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdbw\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000x\\u0013\ufffd\ufffd\ufffdA\\u0010C\ufffd\ufffd\\u000f\\f\\u0006\\f\ufffd\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdbw\\u0002\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000x\\u0013\ufffd\ufffd\ufffdA\\u0010C\ufffd\ufffd\\u000f\\f\\u0006\\f\ufffd\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdbw\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000x\\u0013\ufffd\ufffd\ufffdA\\u0010C\ufffd\ufffd\\u000f\\f\\u0006\\f\ufffd\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdbw\\u0002\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022cd2b97344b4a23b8fcf805bcda5af55f1e8935cc\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000x\\u0013\ufffd\ufffd\ufffdA\\u0010C\ufffd\ufffd\\u000f\\f\\u0006\\f\ufffd\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdbw\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffdx\ufffd\ufffd\ufffdAC\ufffd\ufffd\ufffd\ufffdb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdbw\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000x\\u0013\ufffd\ufffd\ufffdA\\u0010C\ufffd\ufffd\\u000f\\f\\u0006\\f\ufffd\ufffd\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdbw\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffdx\ufffd\ufffd\ufffdAC\ufffd\ufffd\ufffd\ufffdb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdbw\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94},{"id":5784261,"ip":"122.121.153.136","ts":"2026-10-21 06:26:27.000000","proto":"tcp","src_port":56933,"dst_port":1433,"service":"mssql","classification":"mssql_tds","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022001f00001a00060000000000000000000000000000000000000000000000000000\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 94, \u0022payload_entropy\u0022: 4.6677715610417145, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022service\u0022: \u0022mssql\u0022, \u0022app_proto\u0022: \u0022mssql\u0022, \u0022asn\u0022: 3462, \u0022country\u0022: \u0022TW\u0022, \u0022dst_port\u0022: 1433, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 35, \u0022tag_count\u0022: 6, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221b5274bcdfdb9dd2dc06bbc4c62acae0466636e8\u0022, \u0022event_fingerprint\u0022: \u002224635733bde8ab881cad2aa5e51b4b5bf5e45e9f\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 83, \u0022precision_signals\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022matched_pattern_names\u0022: [\u0022MSSQL TDS prelogin\u0022, \u0022STUN binding\u0022, \u0022Minecraft varint handshake\u0022, \u0022TFTP RRQ\u0022], \u0022pattern_ids\u0022: [\u0022pat-0519\u0022, \u0022pat-0771\u0022, \u0022pat-0554\u0022, \u0022pat-0536\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022TW\u0022, \u0022asn\u0022: 3462, \u0022org\u0022: \u0022Data Communication Business Group\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022dd7d73ee58b403afe0b0c7ee067b4d4d\u0022, \u0022path_pattern_hash\u0022: \u0022285321e27377a1f85e5a231ca6cbffb2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022risk_score\u0022: 35}, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u001e\ufffd@\ufffd\ufffd\ufffdF\ufffd]\ufffd\\u001f\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdbv\\u0002\\u0000\\u0000\\u0001\u0022, \u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u001e\ufffd@\ufffd\ufffd\ufffdF\ufffd]\ufffd\\u001f\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdbv\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u001e\ufffd@\ufffd\ufffd\ufffdF\ufffd]\ufffd\\u001f\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdbv\\u0002\\u0000\\u0000\\u0001\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u001e\ufffd@\ufffd\ufffd\ufffdF\ufffd]\ufffd\\u001f\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdbv\\u0002\\u0000\\u0000\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u001e\ufffd@\ufffd\ufffd\ufffdF\ufffd]\ufffd\\u001f\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdbv\\u0002\\u0000\\u0000\\u0001\u0022, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022database_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002217d5f7610e05cb7b3d159abaec66677b56fe8de9\u0022, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u001e\ufffd@\ufffd\ufffd\ufffdF\ufffd]\ufffd\\u001f\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdbv\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd@\ufffd\ufffd\ufffdF\ufffd]\ufffdb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdbv\u0022, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Rafale d\u0027authentification SSH \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 35\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 35}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 35, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022, \u0022dst_port\u0022: 1433, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022pat-0519\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022pat-0519\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022mssql_tds_fr\u0022: \u0022Connexion TDS Microsoft SQL Server\u0022, \u0022payload_preview\u0022: \u0022\\u0012\\u0001\\u0000^\\u0000\\u0000\\u0001\\u0000\\u0000\\u0000$\\u0000\\u0006\\u0001\\u0000*\\u0000\\u0001\\u0002\\u0000+\\u0000\\u0001\\u0003\\u0000,\\u0000\\u0004\\u0004\\u00000\\u0000\\u0001\\u0005\\u00001\\u0000$\\u0006\\u0000U\\u0000\\u0001\ufffd\\u0004\\b#\ufffd\\u0000\\u0000\\u0000\\u0000\\u0000\\u0000(\ufffd\\u0000\ufffd\ufffd\ufffd\ufffd\ufffd\\u001e\ufffd@\ufffd\ufffd\ufffdF\ufffd]\ufffd\\u001f\\f\\bb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdbv\\u0002\\u0000\\u0000\\u0001\u0022, \u0022port\u0022: 1433, \u0022service\u0022: \u0022mssql\u0022, \u0022service_label_fr\u0022: \u0022MSSQL\u0022}, \u0022attack_vector\u0022: \u0022mssql tds \u00b7 via MSSQL:1433 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022^$*+,01$U\ufffd#\ufffd(\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd@\ufffd\ufffd\ufffdF\ufffd]\ufffdb*k\ufffd\ufffdF\ufffd\ufffd\ufffd;\ufffd\ufffd\ufffdbv\u0022, \u0022target_port_label\u0022: \u00221433 \u00b7 MSSQL\u0022, \u0022emulator_service\u0022: \u0022mssql\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022mssql\u0022, \u0022service_banner\u0022: \u0022honeypot-mssql\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00221433\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022mssql_emulated\u0022, \u0022mssql_payload\u0022, \u0022mssql_probe\u0022, \u0022mssql_tds\u0022, \u0022net_bruteforce_burst\u0022, \u0022net_mssql_tds\u0022]","anomalies":"[]","severity":6,"bytes_in":94}],"total_events":655}