{"ip":"13.140.200.70","exported_at":"2026-11-06T14:09:32+00:00","period_days":30,"metrics":{"events7d":93,"distinct_ports":19,"distinct_classifications":15,"max_severity":10,"last_sensor_id":"paris-1","max_waf_score":31,"max_risk_score":61,"attack_stage":"probe","attack_chain_stage":"discovery","threat_family":["spam_abuse"],"recommended_action":"monitor","confidence":0.08,"risk_breakdown":{"waf":8,"classification":35,"behavior":0,"geo":0,"protocol":43,"novelty":15},"mitre_tactics":["TA0007","TA0001"],"mitre_technique":"TA0007","top_mitre_technique":"T1046","top_mitre_count":43,"executive_one_liner_fr":"Activit\u00e9 suspecte","campaign_hint_fr":null,"confidence_breakdown":{"waf":8,"classification":35,"behavior":0,"geo":0,"protocol":43,"novelty":15,"risk_score":26,"correlation_boost":8},"persona_hostname":"mail.sensor-1.internal","correlation_flags":["multi_protocol_correlation"],"correlation_flags_labels_fr":["Multi-protocole corr\u00e9l\u00e9 (5 min)"],"confidence_pct":8,"confidence_hint_fr":"Corr\u00e9lation +8","sensor_role_label_fr":"Renseignement menaces","tags_summary_labels_fr":[],"tags_summary":[],"attack_vector":"bot scraper \u00b7 via HTTP:4001 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/version","protocol_details":{"http_method":"GET","http_path":"\/version","request_line":"GET \/version HTTP\/1.1","http_user_agent":"Python-urllib\/3.12","port":4001,"service":"http","service_label_fr":"HTTP"},"protocol_summary_fr":"GET \/version \u00b7 UA Python-urllib\/3.12 \u00b7 HTTP:4001","evidence_snippet":"GET \/version HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:4001\r\nUser-Agent: Python-urllib\/3.12\r\nConnection: close","target_port_label":"4001 \u00b7 HTTP","emulator_service":"http","confidence_reason":"Confiance 0 % \u2014 2 signal(aux) capteur","classification_reason":"User-Agent bot \/ scraper SEO \u00b7 confiance 0%","classification_reason_label_fr":"User-Agent bot \/ scraper SEO \u00b7 confiance 0%","confidence_factors_fr":"Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8","payload_preview":"GET \/version HTTP\/1.1\r\nAccept-Encoding: identity\r\nHost: 62.3.50.33:4001\r\nUser-Agent: Python-urllib\/3.12\r\nConnection: close","open_intel":{"source":"Emerging Threats open","status":"ok","matched":false,"label_fr":null,"detail_fr":null},"open_intel_ipsum":{"source":"IPsum","status":"ok","matched":false,"label_fr":null,"detail_fr":null},"open_intel_cins":{"source":"CINS Army","status":"ok","matched":false,"label_fr":null,"detail_fr":null}},"dnsbl":{"query":"70.200.140.13.dnsbl.blacklistip.com","listed":false,"available":false,"response":null,"meaning":null,"label":null},"events":[{"id":14029619,"ip":"13.140.200.70","ts":"2026-11-06 11:53:33.000000","proto":"tcp","src_port":50336,"dst_port":4001,"service":"http","classification":"bot_scraper","waf_score":0,"waf_tags":"[]","http_method":"GET","http_target":"\/version","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 4, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u0022fc80c19f3f342ce942ceb53bc08d72180f8cfb19\u0022, \u0022http_host_hash\u0022: \u0022b6f0b7c4875aa152f8d0c92c0a7d2156f0affced\u0022, \u0022http_target_hash\u0022: \u002276c5a6fe5f8bec907b8dcab1abdf135058b50bc3\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: false, \u0022bytes_in\u0022: 126, \u0022payload_entropy\u0022: 4.970286869295239, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 51167, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 4001, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 35.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 1.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 35.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 26, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002237bd9e11b3ddb803830bedfaa31ae9d3a9a7bbee\u0022, \u0022event_fingerprint\u0022: \u00229364d06b9df9928816a01ee68f1d65ca716b1ba4\u0022, \u0022classification_reason\u0022: \u0022User-Agent bot \/ scraper SEO \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.08, \u0022classification_confidence\u0022: 0.08, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 35.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 26, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 51167, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u002225792c7c28d7d6f3f717cd3fbabbf9bf\u0022, \u0022payload_hash\u0022: \u00223ae403354a02fdeefd29201c42d2c09a\u0022, \u0022path_pattern_hash\u0022: \u0022c77d9d7f66686362a33d6f2622fa5690\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 4001, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 26}, \u0022payload_preview\u0022: \u0022GET \/version HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33:4001\\r\\nUser-Agent: Python-urllib\/3.12\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/version\u0022, \u0022user_agent\u0022: \u0022Python-urllib\/3.12\u0022, \u0022request_line\u0022: \u0022GET \/version HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/version HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33:4001\\r\\nUser-Agent: Python-urllib\/3.12\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/version HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33:4001\\r\\nUser-Agent: Python-urllib\/3.12\\r\\nConnection: close\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/version\u0022, \u0022user_agent\u0022: \u0022Python-urllib\/3.12\u0022, \u0022request_line\u0022: \u0022GET \/version HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/version HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33:4001\\r\\nUser-Agent: Python-urllib\/3.12\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/version HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33:4001\\r\\nUser-Agent: Python-urllib\/3.12\\r\\nConnection: close\u0022, \u0022classification_reason\u0022: \u0022User-Agent bot \/ scraper SEO \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022spam_abuse\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022ef69a7581d2bfb7cb1b372d4a27c52217bf00baa\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/version\u0022, \u0022request_line\u0022: \u0022GET \/version HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Python-urllib\/3.12\u0022, \u0022port\u0022: 4001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/version HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33:4001\\r\\nUser-Agent: Python-urllib\/3.12\\r\\nConnection: close\u0022, \u0022attack_vector\u0022: \u0022bot scraper \u00b7 via HTTP:4001 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/version\u0022, \u0022target_port_label\u0022: \u00224001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 2 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022User-Agent bot \/ scraper SEO \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022User-Agent bot \/ scraper SEO \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 8, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 35.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 26, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 26, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 4001, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/version\u0022, \u0022request_line\u0022: \u0022GET \/version HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Python-urllib\/3.12\u0022, \u0022port\u0022: 4001, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022bot scraper \u00b7 via HTTP:4001 \u00b7 (sonde \/ probe) \u00b7 \u2192 \/version\u0022, \u0022evidence_snippet\u0022: \u0022GET \/version HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33:4001\\r\\nUser-Agent: Python-urllib\/3.12\\r\\nConnection: close\u0022, \u0022target_port_label\u0022: \u00224001 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 2 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00224001\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022nomad-http\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_ua_bot_scraper\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:4001","http_user_agent":"Python-urllib\/3.12","http_referer":null,"tags":"[\u0022http_ua_bot_scraper\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":4,"bytes_in":126},{"id":14029618,"ip":"13.140.200.70","ts":"2026-11-06 11:53:33.000000","proto":"tcp","src_port":50334,"dst_port":4001,"service":"nomad-http","classification":"consul_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022port_inferred_service\u0022: true, \u0022bytes_in\u0022: 0, \u0022payload_entropy\u0022: 0.0, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022service\u0022: \u0022nomad-http\u0022, \u0022app_proto\u0022: \u0022nomad-http\u0022, \u0022asn\u0022: 51167, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 4001, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 56.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 1.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 21, \u0022tag_count\u0022: 2, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00224f06ac3a1f1402a6c8f3767c7570d2bd665f1c04\u0022, \u0022event_fingerprint\u0022: \u0022ea33d941311f2d31d6aa1a1459ed41db704f3413\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 21}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022nomad-http\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 51167, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022path_pattern_hash\u0022: \u0022903d4a7efff645522f88fc15d7a1b2c2\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 4001, \u0022service\u0022: \u0022nomad-http\u0022, \u0022service_name\u0022: \u0022nomad-http\u0022, \u0022risk_score\u0022: 21}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002274167540200823a75ba41d02116afe268b8e2c6d\u0022, \u0022protocol_details\u0022: {\u0022port\u0022: 4001, \u0022service\u0022: \u0022nomad-http\u0022, \u0022service_label_fr\u0022: \u0022NOMAD HTTP\u0022}, \u0022attack_vector\u0022: \u0022consul probe \u00b7 via NOMAD HTTP:4001 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00224001 \u00b7 NOMAD HTTP\u0022, \u0022emulator_service\u0022: \u0022nomad-http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 2 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab consul_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 56.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 21}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 21, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022nomad-http\u0022, \u0022service_label_fr\u0022: \u0022NOMAD HTTP\u0022, \u0022dst_port\u0022: 4001, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-nomad-http\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022port\u0022: 4001, \u0022service\u0022: \u0022nomad-http\u0022, \u0022service_label_fr\u0022: \u0022NOMAD HTTP\u0022}, \u0022attack_vector\u0022: \u0022consul probe \u00b7 via NOMAD HTTP:4001 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: null, \u0022target_port_label\u0022: \u00224001 \u00b7 NOMAD HTTP\u0022, \u0022emulator_service\u0022: \u0022nomad-http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 2 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022nomad_http\u0022, \u0022service_banner\u0022: \u0022honeypot-nomad-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00224001\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_consul_probe\u0022, \u0022nomad_http_emulated\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_consul_probe\u0022, \u0022nomad_http_emulated\u0022]","anomalies":"[]","severity":5,"bytes_in":0},{"id":14027003,"ip":"13.140.200.70","ts":"2026-11-06 11:45:24.000000","proto":"tcp","src_port":38956,"dst_port":2379,"service":"etcd","classification":"etcd_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2034340d0a0d0a7b2265746364736572766572223a22332e352e39222c2265746364636c7573746572223a22332e352e39227d\u0022, \u0022emulator_response_len\u0022: 115, \u0022bytes_in\u0022: 274, \u0022payload_entropy\u0022: 5.358022423761826, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022service\u0022: \u0022etcd\u0022, \u0022app_proto\u0022: \u0022etcd\u0022, \u0022asn\u0022: 51167, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 2379, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 57.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.1, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 57.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 36, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022927fca03e39cfebdd55f21eff31aedeba53e89b3\u0022, \u0022event_fingerprint\u0022: \u0022e3e5a577e878182161957ca16d73f5615461512d\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab etcd_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 87, \u0022precision_signals\u0022: [\u0022INT-INFRA-etcd-keys\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-INFRA-etcd-keys\u0022, \u0022INT-upstream\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 57.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 36}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022etcd\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 51167, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022f46eb02438df72bc233d78c103d7ff77\u0022, \u0022path_pattern_hash\u0022: \u002285fc08d618f735ae9baa3e32428d3d02\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2379, \u0022service\u0022: \u0022etcd\u0022, \u0022service_name\u0022: \u0022etcd\u0022, \u0022risk_score\u0022: 36}, \u0022payload_preview\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 91\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\u0022, \u0022request_sample\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 91\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\\r\\nContent-Type: application\/json\\r\\nConnection: close\\r\\n\\r\\n{\\\u0022key\\\u0022: \\\u0022L3JlZ2lzdHJ5L21pbmlvbnMv\\\u0022, \\\u0022range_end\\\u0022: \\\u0022L3JlZ2lzdHJ5L21pbmlvbnM\u0022, \u0022payload_snippet\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 91\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 91\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\\r\\nContent-Type: application\/json\\r\\nConnection: close\\r\\n\\r\\n{\\\u0022key\\\u0022: \\\u0022L3JlZ2lzdHJ5L21pbmlvbnMv\\\u0022, \\\u0022range_end\\\u0022: \\\u0022L3JlZ2lzdHJ5L21pbmlvbnM\u0022, \u0022payload_snippet\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 91\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab etcd_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022526d90c18a989b0b1bb80efc621d7fccb80223b6\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 91\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\u0022, \u0022port\u0022: 2379, \u0022service\u0022: \u0022etcd\u0022, \u0022service_label_fr\u0022: \u0022ETCD\u0022}, \u0022evidence_snippet\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 91\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\u0022, \u0022attack_vector\u0022: \u0022etcd probe \u00b7 via ETCD:2379 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00222379 \u00b7 ETCD\u0022, \u0022emulator_service\u0022: \u0022etcd\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab etcd_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab etcd_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 36\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 57.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 36}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 36, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022etcd\u0022, \u0022service_label_fr\u0022: \u0022ETCD\u0022, \u0022dst_port\u0022: 2379, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022INT-INFRA-etcd-keys\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Infra Etcd Keys\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-etcd\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 91\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\u0022, \u0022port\u0022: 2379, \u0022service\u0022: \u0022etcd\u0022, \u0022service_label_fr\u0022: \u0022ETCD\u0022}, \u0022attack_vector\u0022: \u0022etcd probe \u00b7 via ETCD:2379 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 91\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\u0022, \u0022target_port_label\u0022: \u00222379 \u00b7 ETCD\u0022, \u0022emulator_service\u0022: \u0022etcd\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022etcd\u0022, \u0022service_banner\u0022: \u0022honeypot-etcd\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222379\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022etcd_emulated\u0022, \u0022etcd_payload\u0022, \u0022etcd_probe\u0022, \u0022net_etcd_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022etcd_emulated\u0022, \u0022etcd_payload\u0022, \u0022etcd_probe\u0022, \u0022net_etcd_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":274},{"id":14027002,"ip":"13.140.200.70","ts":"2026-11-06 11:45:24.000000","proto":"tcp","src_port":38952,"dst_port":2379,"service":"etcd","classification":"etcd_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2034340d0a0d0a7b2265746364736572766572223a22332e352e39222c2265746364636c7573746572223a22332e352e39227d\u0022, \u0022emulator_response_len\u0022: 115, \u0022bytes_in\u0022: 282, \u0022payload_entropy\u0022: 5.498987412654985, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022service\u0022: \u0022etcd\u0022, \u0022app_proto\u0022: \u0022etcd\u0022, \u0022asn\u0022: 51167, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 2379, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 57.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.1, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 57.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 36, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022927fca03e39cfebdd55f21eff31aedeba53e89b3\u0022, \u0022event_fingerprint\u0022: \u0022e3e5a577e878182161957ca16d73f5615461512d\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab etcd_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 87, \u0022precision_signals\u0022: [\u0022INT-INFRA-etcd-keys\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-INFRA-etcd-keys\u0022, \u0022INT-upstream\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 57.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 36}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022etcd\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 51167, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00228a1b8547dce26406d73ccc6c1cf24198\u0022, \u0022path_pattern_hash\u0022: \u002285fc08d618f735ae9baa3e32428d3d02\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2379, \u0022service\u0022: \u0022etcd\u0022, \u0022service_name\u0022: \u0022etcd\u0022, \u0022risk_score\u0022: 36}, \u0022payload_preview\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 99\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\u0022, \u0022request_sample\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 99\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\\r\\nContent-Type: application\/json\\r\\nConnection: close\\r\\n\\r\\n{\\\u0022key\\\u0022: \\\u0022L3JlZ2lzdHJ5L25hbWVzcGFjZXMv\\\u0022, \\\u0022range_end\\\u0022: \\\u0022L3JlZ2lzdHJ5L25hbWV\u0022, \u0022payload_snippet\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 99\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 99\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\\r\\nContent-Type: application\/json\\r\\nConnection: close\\r\\n\\r\\n{\\\u0022key\\\u0022: \\\u0022L3JlZ2lzdHJ5L25hbWVzcGFjZXMv\\\u0022, \\\u0022range_end\\\u0022: \\\u0022L3JlZ2lzdHJ5L25hbWV\u0022, \u0022payload_snippet\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 99\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab etcd_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022c7f82dbc45e5cc520cc7ed4c53826ac3619ba482\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 99\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\u0022, \u0022port\u0022: 2379, \u0022service\u0022: \u0022etcd\u0022, \u0022service_label_fr\u0022: \u0022ETCD\u0022}, \u0022evidence_snippet\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 99\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\u0022, \u0022attack_vector\u0022: \u0022etcd probe \u00b7 via ETCD:2379 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00222379 \u00b7 ETCD\u0022, \u0022emulator_service\u0022: \u0022etcd\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab etcd_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab etcd_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 36\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 57.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 36}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 36, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022etcd\u0022, \u0022service_label_fr\u0022: \u0022ETCD\u0022, \u0022dst_port\u0022: 2379, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022INT-INFRA-etcd-keys\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Infra Etcd Keys\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-etcd\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 99\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\u0022, \u0022port\u0022: 2379, \u0022service\u0022: \u0022etcd\u0022, \u0022service_label_fr\u0022: \u0022ETCD\u0022}, \u0022attack_vector\u0022: \u0022etcd probe \u00b7 via ETCD:2379 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 99\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\u0022, \u0022target_port_label\u0022: \u00222379 \u00b7 ETCD\u0022, \u0022emulator_service\u0022: \u0022etcd\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022etcd\u0022, \u0022service_banner\u0022: \u0022honeypot-etcd\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222379\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022etcd_emulated\u0022, \u0022etcd_payload\u0022, \u0022etcd_probe\u0022, \u0022net_etcd_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022etcd_emulated\u0022, \u0022etcd_payload\u0022, \u0022etcd_probe\u0022, \u0022net_etcd_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":282},{"id":14027000,"ip":"13.140.200.70","ts":"2026-11-06 11:45:24.000000","proto":"tcp","src_port":38944,"dst_port":2379,"service":"etcd","classification":"etcd_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2034340d0a0d0a7b2265746364736572766572223a22332e352e39222c2265746364636c7573746572223a22332e352e39227d\u0022, \u0022emulator_response_len\u0022: 115, \u0022bytes_in\u0022: 307, \u0022payload_entropy\u0022: 5.499076987050499, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022service\u0022: \u0022etcd\u0022, \u0022app_proto\u0022: \u0022etcd\u0022, \u0022asn\u0022: 51167, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 2379, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 57.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.1, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 57.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 36, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022927fca03e39cfebdd55f21eff31aedeba53e89b3\u0022, \u0022event_fingerprint\u0022: \u0022e3e5a577e878182161957ca16d73f5615461512d\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab etcd_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 87, \u0022precision_signals\u0022: [\u0022INT-INFRA-etcd-keys\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-INFRA-etcd-keys\u0022, \u0022INT-upstream\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 57.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 36}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022etcd\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 51167, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002274f504d5e5546e224f84ecb5e153735a\u0022, \u0022path_pattern_hash\u0022: \u002285fc08d618f735ae9baa3e32428d3d02\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2379, \u0022service\u0022: \u0022etcd\u0022, \u0022service_name\u0022: \u0022etcd\u0022, \u0022risk_score\u0022: 36}, \u0022payload_preview\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 123\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.1\u0022, \u0022request_sample\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 123\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\\r\\nContent-Type: application\/json\\r\\nConnection: close\\r\\n\\r\\n{\\\u0022key\\\u0022: \\\u0022L3JlZ2lzdHJ5L2NsdXN0ZXJyb2xlYmluZGluZ3Mv\\\u0022, \\\u0022range_end\\\u0022: \\\u0022L3JlZ2\u0022, \u0022payload_snippet\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 123\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.1\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 123\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\\r\\nContent-Type: application\/json\\r\\nConnection: close\\r\\n\\r\\n{\\\u0022key\\\u0022: \\\u0022L3JlZ2lzdHJ5L2NsdXN0ZXJyb2xlYmluZGluZ3Mv\\\u0022, \\\u0022range_end\\\u0022: \\\u0022L3JlZ2\u0022, \u0022payload_snippet\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 123\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.1\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab etcd_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022f57c6406aa4223fd52010f2f6b97e9401db05617\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 123\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.1\u0022, \u0022port\u0022: 2379, \u0022service\u0022: \u0022etcd\u0022, \u0022service_label_fr\u0022: \u0022ETCD\u0022}, \u0022evidence_snippet\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 123\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.1\u0022, \u0022attack_vector\u0022: \u0022etcd probe \u00b7 via ETCD:2379 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00222379 \u00b7 ETCD\u0022, \u0022emulator_service\u0022: \u0022etcd\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab etcd_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab etcd_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 36\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 57.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 36}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 36, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022etcd\u0022, \u0022service_label_fr\u0022: \u0022ETCD\u0022, \u0022dst_port\u0022: 2379, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022INT-INFRA-etcd-keys\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Infra Etcd Keys\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-etcd\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 123\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.1\u0022, \u0022port\u0022: 2379, \u0022service\u0022: \u0022etcd\u0022, \u0022service_label_fr\u0022: \u0022ETCD\u0022}, \u0022attack_vector\u0022: \u0022etcd probe \u00b7 via ETCD:2379 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 123\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.1\u0022, \u0022target_port_label\u0022: \u00222379 \u00b7 ETCD\u0022, \u0022emulator_service\u0022: \u0022etcd\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022etcd\u0022, \u0022service_banner\u0022: \u0022honeypot-etcd\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222379\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022etcd_emulated\u0022, \u0022etcd_payload\u0022, \u0022etcd_probe\u0022, \u0022net_etcd_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022etcd_emulated\u0022, \u0022etcd_payload\u0022, \u0022etcd_probe\u0022, \u0022net_etcd_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":307},{"id":14026999,"ip":"13.140.200.70","ts":"2026-11-06 11:45:24.000000","proto":"tcp","src_port":38936,"dst_port":2379,"service":"etcd","classification":"etcd_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2034340d0a0d0a7b2265746364736572766572223a22332e352e39222c2265746364636c7573746572223a22332e352e39227d\u0022, \u0022emulator_response_len\u0022: 115, \u0022bytes_in\u0022: 299, \u0022payload_entropy\u0022: 5.4594396578198205, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022service\u0022: \u0022etcd\u0022, \u0022app_proto\u0022: \u0022etcd\u0022, \u0022asn\u0022: 51167, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 2379, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 57.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.1, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 57.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 36, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022927fca03e39cfebdd55f21eff31aedeba53e89b3\u0022, \u0022event_fingerprint\u0022: \u0022e3e5a577e878182161957ca16d73f5615461512d\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab etcd_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 87, \u0022precision_signals\u0022: [\u0022INT-INFRA-etcd-keys\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-INFRA-etcd-keys\u0022, \u0022INT-upstream\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 57.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 36}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022etcd\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 51167, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022af70d51697e5d69223e07647c68e825d\u0022, \u0022path_pattern_hash\u0022: \u002285fc08d618f735ae9baa3e32428d3d02\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2379, \u0022service\u0022: \u0022etcd\u0022, \u0022service_name\u0022: \u0022etcd\u0022, \u0022risk_score\u0022: 36}, \u0022payload_preview\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 115\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.1\u0022, \u0022request_sample\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 115\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\\r\\nContent-Type: application\/json\\r\\nConnection: close\\r\\n\\r\\n{\\\u0022key\\\u0022: \\\u0022L3JlZ2lzdHJ5L3NlcnZpY2VhY2NvdW50cy8=\\\u0022, \\\u0022range_end\\\u0022: \\\u0022L3JlZ2lzdH\u0022, \u0022payload_snippet\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 115\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.1\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 115\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\\r\\nContent-Type: application\/json\\r\\nConnection: close\\r\\n\\r\\n{\\\u0022key\\\u0022: \\\u0022L3JlZ2lzdHJ5L3NlcnZpY2VhY2NvdW50cy8=\\\u0022, \\\u0022range_end\\\u0022: \\\u0022L3JlZ2lzdH\u0022, \u0022payload_snippet\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 115\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.1\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab etcd_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002277c61ac4b3c3423fdeff7bdeeb2bbd483c6ab427\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 115\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.1\u0022, \u0022port\u0022: 2379, \u0022service\u0022: \u0022etcd\u0022, \u0022service_label_fr\u0022: \u0022ETCD\u0022}, \u0022evidence_snippet\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 115\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.1\u0022, \u0022attack_vector\u0022: \u0022etcd probe \u00b7 via ETCD:2379 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00222379 \u00b7 ETCD\u0022, \u0022emulator_service\u0022: \u0022etcd\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab etcd_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab etcd_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 36\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 57.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 36}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 36, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022etcd\u0022, \u0022service_label_fr\u0022: \u0022ETCD\u0022, \u0022dst_port\u0022: 2379, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022INT-INFRA-etcd-keys\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Infra Etcd Keys\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-etcd\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 115\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.1\u0022, \u0022port\u0022: 2379, \u0022service\u0022: \u0022etcd\u0022, \u0022service_label_fr\u0022: \u0022ETCD\u0022}, \u0022attack_vector\u0022: \u0022etcd probe \u00b7 via ETCD:2379 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 115\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.1\u0022, \u0022target_port_label\u0022: \u00222379 \u00b7 ETCD\u0022, \u0022emulator_service\u0022: \u0022etcd\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022etcd\u0022, \u0022service_banner\u0022: \u0022honeypot-etcd\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222379\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022etcd_emulated\u0022, \u0022etcd_payload\u0022, \u0022etcd_probe\u0022, \u0022net_etcd_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022etcd_emulated\u0022, \u0022etcd_payload\u0022, \u0022etcd_probe\u0022, \u0022net_etcd_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":299},{"id":14026998,"ip":"13.140.200.70","ts":"2026-11-06 11:45:24.000000","proto":"tcp","src_port":38924,"dst_port":2379,"service":"etcd","classification":"etcd_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2034340d0a0d0a7b2265746364736572766572223a22332e352e39222c2265746364636c7573746572223a22332e352e39227d\u0022, \u0022emulator_response_len\u0022: 115, \u0022bytes_in\u0022: 307, \u0022payload_entropy\u0022: 5.472250644900529, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022service\u0022: \u0022etcd\u0022, \u0022app_proto\u0022: \u0022etcd\u0022, \u0022asn\u0022: 51167, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 2379, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 57.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.1, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 57.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 36, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022927fca03e39cfebdd55f21eff31aedeba53e89b3\u0022, \u0022event_fingerprint\u0022: \u0022e3e5a577e878182161957ca16d73f5615461512d\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab etcd_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 87, \u0022precision_signals\u0022: [\u0022INT-INFRA-etcd-keys\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-INFRA-etcd-keys\u0022, \u0022INT-upstream\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 57.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 36}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022etcd\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 51167, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022575f768aa6721fd0ce754e2fb5205c7e\u0022, \u0022path_pattern_hash\u0022: \u002285fc08d618f735ae9baa3e32428d3d02\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2379, \u0022service\u0022: \u0022etcd\u0022, \u0022service_name\u0022: \u0022etcd\u0022, \u0022risk_score\u0022: 36}, \u0022payload_preview\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 123\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.1\u0022, \u0022request_sample\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 123\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\\r\\nContent-Type: application\/json\\r\\nConnection: close\\r\\n\\r\\n{\\\u0022key\\\u0022: \\\u0022L3JlZ2lzdHJ5L3NlY3JldHMva3ViZS1zeXN0ZW0v\\\u0022, \\\u0022range_end\\\u0022: \\\u0022L3JlZ2\u0022, \u0022payload_snippet\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 123\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.1\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 123\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\\r\\nContent-Type: application\/json\\r\\nConnection: close\\r\\n\\r\\n{\\\u0022key\\\u0022: \\\u0022L3JlZ2lzdHJ5L3NlY3JldHMva3ViZS1zeXN0ZW0v\\\u0022, \\\u0022range_end\\\u0022: \\\u0022L3JlZ2\u0022, \u0022payload_snippet\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 123\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.1\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab etcd_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002226c876864c2758042ec6c0536e52884a82b5c03d\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 123\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.1\u0022, \u0022port\u0022: 2379, \u0022service\u0022: \u0022etcd\u0022, \u0022service_label_fr\u0022: \u0022ETCD\u0022}, \u0022evidence_snippet\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 123\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.1\u0022, \u0022attack_vector\u0022: \u0022etcd probe \u00b7 via ETCD:2379 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00222379 \u00b7 ETCD\u0022, \u0022emulator_service\u0022: \u0022etcd\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab etcd_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab etcd_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 36\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 57.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 36}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 36, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022etcd\u0022, \u0022service_label_fr\u0022: \u0022ETCD\u0022, \u0022dst_port\u0022: 2379, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022INT-INFRA-etcd-keys\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Infra Etcd Keys\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-etcd\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 123\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.1\u0022, \u0022port\u0022: 2379, \u0022service\u0022: \u0022etcd\u0022, \u0022service_label_fr\u0022: \u0022ETCD\u0022}, \u0022attack_vector\u0022: \u0022etcd probe \u00b7 via ETCD:2379 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 123\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.1\u0022, \u0022target_port_label\u0022: \u00222379 \u00b7 ETCD\u0022, \u0022emulator_service\u0022: \u0022etcd\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022etcd\u0022, \u0022service_banner\u0022: \u0022honeypot-etcd\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222379\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022etcd_emulated\u0022, \u0022etcd_payload\u0022, \u0022etcd_probe\u0022, \u0022net_etcd_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022etcd_emulated\u0022, \u0022etcd_payload\u0022, \u0022etcd_probe\u0022, \u0022net_etcd_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":307},{"id":14026997,"ip":"13.140.200.70","ts":"2026-11-06 11:45:24.000000","proto":"tcp","src_port":38918,"dst_port":2379,"service":"etcd","classification":"etcd_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2034340d0a0d0a7b2265746364736572766572223a22332e352e39222c2265746364636c7573746572223a22332e352e39227d\u0022, \u0022emulator_response_len\u0022: 115, \u0022bytes_in\u0022: 158, \u0022payload_entropy\u0022: 4.981653671908812, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022service\u0022: \u0022etcd\u0022, \u0022app_proto\u0022: \u0022etcd\u0022, \u0022asn\u0022: 51167, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 2379, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 57.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 40.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 57.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 40.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 22, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022f28999cd4e519191c1a21a3b595f8ef5d3e4aefc\u0022, \u0022event_fingerprint\u0022: \u0022e3e5a577e878182161957ca16d73f5615461512d\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab etcd_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 57.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 40.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 22}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022etcd\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 51167, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022affb424d1fb333d77807446324290262\u0022, \u0022path_pattern_hash\u0022: \u002285fc08d618f735ae9baa3e32428d3d02\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2379, \u0022service\u0022: \u0022etcd\u0022, \u0022service_name\u0022: \u0022etcd\u0022, \u0022risk_score\u0022: 22}, \u0022payload_preview\u0022: \u0022GET \/version HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\\r\\nContent-Type: applicati\u0022, \u0022request_sample\u0022: \u0022GET \/version HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\\r\\nContent-Type: application\/json\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/version HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\\r\\nContent-Type: applicati\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022GET \/version HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\\r\\nContent-Type: application\/json\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/version HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\\r\\nContent-Type: applicati\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab etcd_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022cca8b8dad4e0f51a950651da9b43cb8f398374d3\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022GET \/version HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\\r\\nContent-Type: applicati\u0022, \u0022port\u0022: 2379, \u0022service\u0022: \u0022etcd\u0022, \u0022service_label_fr\u0022: \u0022ETCD\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/version HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\\r\\nContent-Type: applicati\u0022, \u0022attack_vector\u0022: \u0022etcd probe \u00b7 via ETCD:2379 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00222379 \u00b7 ETCD\u0022, \u0022emulator_service\u0022: \u0022etcd\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 5 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab etcd_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab etcd_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 57.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 40.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 22}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 22, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022etcd\u0022, \u0022service_label_fr\u0022: \u0022ETCD\u0022, \u0022dst_port\u0022: 2379, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-etcd\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022GET \/version HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\\r\\nContent-Type: applicati\u0022, \u0022port\u0022: 2379, \u0022service\u0022: \u0022etcd\u0022, \u0022service_label_fr\u0022: \u0022ETCD\u0022}, \u0022attack_vector\u0022: \u0022etcd probe \u00b7 via ETCD:2379 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/version HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\\r\\nContent-Type: applicati\u0022, \u0022target_port_label\u0022: \u00222379 \u00b7 ETCD\u0022, \u0022emulator_service\u0022: \u0022etcd\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 5 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022etcd\u0022, \u0022service_banner\u0022: \u0022honeypot-etcd\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222379\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022etcd_emulated\u0022, \u0022etcd_payload\u0022, \u0022etcd_probe\u0022, \u0022http_get_probe\u0022, \u0022net_etcd_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022etcd_emulated\u0022, \u0022etcd_payload\u0022, \u0022etcd_probe\u0022, \u0022http_get_probe\u0022, \u0022net_etcd_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":158},{"id":14024935,"ip":"13.140.200.70","ts":"2026-11-06 11:38:57.000000","proto":"tcp","src_port":41566,"dst_port":2379,"service":"etcd","classification":"etcd_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2034340d0a0d0a7b2265746364736572766572223a22332e352e39222c2265746364636c7573746572223a22332e352e39227d\u0022, \u0022emulator_response_len\u0022: 115, \u0022bytes_in\u0022: 182, \u0022payload_entropy\u0022: 5.061500645451568, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022service\u0022: \u0022etcd\u0022, \u0022app_proto\u0022: \u0022etcd\u0022, \u0022asn\u0022: 51167, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 2379, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 57.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 40.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 57.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 40.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 36, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022f28999cd4e519191c1a21a3b595f8ef5d3e4aefc\u0022, \u0022event_fingerprint\u0022: \u0022e3e5a577e878182161957ca16d73f5615461512d\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab etcd_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 87, \u0022precision_signals\u0022: [\u0022INT-INFRA-etcd-keys\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-INFRA-etcd-keys\u0022, \u0022INT-upstream\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 57.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 40.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 36}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022etcd\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 51167, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00228bc494ec4187a54ca7ab133825711a0e\u0022, \u0022path_pattern_hash\u0022: \u002285fc08d618f735ae9baa3e32428d3d02\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2379, \u0022service\u0022: \u0022etcd\u0022, \u0022service_name\u0022: \u0022etcd\u0022, \u0022risk_score\u0022: 36}, \u0022payload_preview\u0022: \u0022GET \/v2\/keys\/registry?recursive=true HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\\r\u0022, \u0022request_sample\u0022: \u0022GET \/v2\/keys\/registry?recursive=true HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\\r\\nContent-Type: application\/json\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/v2\/keys\/registry?recursive=true HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022GET \/v2\/keys\/registry?recursive=true HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\\r\\nContent-Type: application\/json\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/v2\/keys\/registry?recursive=true HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab etcd_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022eb45d819913ea6e48506bbf3fc7c01cc6b8556ce\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022GET \/v2\/keys\/registry?recursive=true HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\u0022, \u0022port\u0022: 2379, \u0022service\u0022: \u0022etcd\u0022, \u0022service_label_fr\u0022: \u0022ETCD\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/v2\/keys\/registry?recursive=true HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\u0022, \u0022attack_vector\u0022: \u0022etcd probe \u00b7 via ETCD:2379 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00222379 \u00b7 ETCD\u0022, \u0022emulator_service\u0022: \u0022etcd\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab etcd_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab etcd_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 36\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 57.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 40.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 36}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 36, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022etcd\u0022, \u0022service_label_fr\u0022: \u0022ETCD\u0022, \u0022dst_port\u0022: 2379, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022INT-INFRA-etcd-keys\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Infra Etcd Keys\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-etcd\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022GET \/v2\/keys\/registry?recursive=true HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\u0022, \u0022port\u0022: 2379, \u0022service\u0022: \u0022etcd\u0022, \u0022service_label_fr\u0022: \u0022ETCD\u0022}, \u0022attack_vector\u0022: \u0022etcd probe \u00b7 via ETCD:2379 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/v2\/keys\/registry?recursive=true HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\u0022, \u0022target_port_label\u0022: \u00222379 \u00b7 ETCD\u0022, \u0022emulator_service\u0022: \u0022etcd\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022etcd\u0022, \u0022service_banner\u0022: \u0022honeypot-etcd\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222379\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022etcd_emulated\u0022, \u0022etcd_payload\u0022, \u0022etcd_probe\u0022, \u0022http_get_probe\u0022, \u0022net_etcd_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022etcd_emulated\u0022, \u0022etcd_payload\u0022, \u0022etcd_probe\u0022, \u0022http_get_probe\u0022, \u0022net_etcd_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":182},{"id":14024934,"ip":"13.140.200.70","ts":"2026-11-06 11:38:57.000000","proto":"tcp","src_port":41562,"dst_port":2379,"service":"etcd","classification":"etcd_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2034340d0a0d0a7b2265746364736572766572223a22332e352e39222c2265746364636c7573746572223a22332e352e39227d\u0022, \u0022emulator_response_len\u0022: 115, \u0022bytes_in\u0022: 260, \u0022payload_entropy\u0022: 5.366931395649336, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022service\u0022: \u0022etcd\u0022, \u0022app_proto\u0022: \u0022etcd\u0022, \u0022asn\u0022: 51167, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 2379, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 57.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 30.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.1, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 57.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 36, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022927fca03e39cfebdd55f21eff31aedeba53e89b3\u0022, \u0022event_fingerprint\u0022: \u0022e3e5a577e878182161957ca16d73f5615461512d\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab etcd_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022confidence\u0022: 0.95, \u0022classification_confidence\u0022: 0.95, \u0022precision_score\u0022: 87, \u0022precision_signals\u0022: [\u0022INT-INFRA-etcd-keys\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022INT-INFRA-etcd-keys\u0022, \u0022INT-upstream\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 57.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 36}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022etcd\u0022, \u0022risk_confidence_factor\u0022: 95.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 51167, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022232cb4a68e8798287fd63c4a9cb57710\u0022, \u0022path_pattern_hash\u0022: \u002285fc08d618f735ae9baa3e32428d3d02\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2379, \u0022service\u0022: \u0022etcd\u0022, \u0022service_name\u0022: \u0022etcd\u0022, \u0022risk_score\u0022: 36}, \u0022payload_preview\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 77\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\u0022, \u0022request_sample\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 77\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\\r\\nContent-Type: application\/json\\r\\nConnection: close\\r\\n\\r\\n{\\\u0022key\\\u0022: \\\u0022L3JlZ2lzdHJ5Lw==\\\u0022, \\\u0022range_end\\\u0022: \\\u0022L3JlZ2lzdHJ5MA==\\\u0022, \\\u0022limit\\\u0022: \\\u002230\u0022, \u0022payload_snippet\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 77\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 77\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\\r\\nContent-Type: application\/json\\r\\nConnection: close\\r\\n\\r\\n{\\\u0022key\\\u0022: \\\u0022L3JlZ2lzdHJ5Lw==\\\u0022, \\\u0022range_end\\\u0022: \\\u0022L3JlZ2lzdHJ5MA==\\\u0022, \\\u0022limit\\\u0022: \\\u002230\u0022, \u0022payload_snippet\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 77\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab etcd_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002211e07bf71b9791f18643f0088548b26c26c53078\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 77\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\u0022, \u0022port\u0022: 2379, \u0022service\u0022: \u0022etcd\u0022, \u0022service_label_fr\u0022: \u0022ETCD\u0022}, \u0022evidence_snippet\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 77\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\u0022, \u0022attack_vector\u0022: \u0022etcd probe \u00b7 via ETCD:2379 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00222379 \u00b7 ETCD\u0022, \u0022emulator_service\u0022: \u0022etcd\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab etcd_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab etcd_probe \u00bb (signaux protocolaires) \u00b7 confiance 95%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 36\/100\u0022, \u0022confidence_pct\u0022: 95, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 57.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 30.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 36}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 36, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022etcd\u0022, \u0022service_label_fr\u0022: \u0022ETCD\u0022, \u0022dst_port\u0022: 2379, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022INT-INFRA-etcd-keys\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022Infra Etcd Keys\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-etcd\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 77\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\u0022, \u0022port\u0022: 2379, \u0022service\u0022: \u0022etcd\u0022, \u0022service_label_fr\u0022: \u0022ETCD\u0022}, \u0022attack_vector\u0022: \u0022etcd probe \u00b7 via ETCD:2379 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022POST \/v3\/kv\/range HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nContent-Length: 77\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\u0022, \u0022target_port_label\u0022: \u00222379 \u00b7 ETCD\u0022, \u0022emulator_service\u0022: \u0022etcd\u0022, \u0022confidence_reason\u0022: \u0022Confiance 95 % \u2014 Motif catalogue confirm\u00e9\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 95 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022etcd\u0022, \u0022service_banner\u0022: \u0022honeypot-etcd\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222379\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022etcd_emulated\u0022, \u0022etcd_payload\u0022, \u0022etcd_probe\u0022, \u0022net_etcd_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022etcd_emulated\u0022, \u0022etcd_payload\u0022, \u0022etcd_probe\u0022, \u0022net_etcd_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":260},{"id":14024933,"ip":"13.140.200.70","ts":"2026-11-06 11:38:57.000000","proto":"tcp","src_port":41558,"dst_port":2379,"service":"etcd","classification":"etcd_probe","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a436f6e74656e742d547970653a206170706c69636174696f6e2f6a736f6e0d0a436f6e74656e742d4c656e6774683a2034340d0a0d0a7b2265746364736572766572223a22332e352e39222c2265746364636c7573746572223a22332e352e39227d\u0022, \u0022emulator_response_len\u0022: 115, \u0022bytes_in\u0022: 158, \u0022payload_entropy\u0022: 4.981653671908812, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022service\u0022: \u0022etcd\u0022, \u0022app_proto\u0022: \u0022etcd\u0022, \u0022asn\u0022: 51167, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 2379, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 57.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 40.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 57.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 40.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 22, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022f28999cd4e519191c1a21a3b595f8ef5d3e4aefc\u0022, \u0022event_fingerprint\u0022: \u0022e3e5a577e878182161957ca16d73f5615461512d\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab etcd_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022confidence\u0022: 0.0, \u0022classification_confidence\u0022: 0.0, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 57.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 40.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 22}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022etcd\u0022, \u0022risk_confidence_factor\u0022: 0.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 51167, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022affb424d1fb333d77807446324290262\u0022, \u0022path_pattern_hash\u0022: \u002285fc08d618f735ae9baa3e32428d3d02\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 2379, \u0022service\u0022: \u0022etcd\u0022, \u0022service_name\u0022: \u0022etcd\u0022, \u0022risk_score\u0022: 22}, \u0022payload_preview\u0022: \u0022GET \/version HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\\r\\nContent-Type: applicati\u0022, \u0022request_sample\u0022: \u0022GET \/version HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\\r\\nContent-Type: application\/json\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/version HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\\r\\nContent-Type: applicati\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022GET \/version HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\\r\\nContent-Type: application\/json\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/version HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\\r\\nContent-Type: applicati\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab etcd_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022cloud_infra_scan\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022cca8b8dad4e0f51a950651da9b43cb8f398374d3\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022GET \/version HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\\r\\nContent-Type: applicati\u0022, \u0022port\u0022: 2379, \u0022service\u0022: \u0022etcd\u0022, \u0022service_label_fr\u0022: \u0022ETCD\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/version HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\\r\\nContent-Type: applicati\u0022, \u0022attack_vector\u0022: \u0022etcd probe \u00b7 via ETCD:2379 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00222379 \u00b7 ETCD\u0022, \u0022emulator_service\u0022: \u0022etcd\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 5 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab etcd_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab etcd_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte\u0022, \u0022confidence_pct\u0022: 0, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 57.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 40.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 22}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 22, \u0022risk_label\u0022: \u0022Faible\u0022, \u0022service_name\u0022: \u0022etcd\u0022, \u0022service_label_fr\u0022: \u0022ETCD\u0022, \u0022dst_port\u0022: 2379, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-etcd\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022GET \/version HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\\r\\nContent-Type: applicati\u0022, \u0022port\u0022: 2379, \u0022service\u0022: \u0022etcd\u0022, \u0022service_label_fr\u0022: \u0022ETCD\u0022}, \u0022attack_vector\u0022: \u0022etcd probe \u00b7 via ETCD:2379 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/version HTTP\/1.1\\r\\nAccept-Encoding: identity\\r\\nHost: 62.3.50.33:2379\\r\\nUser-Agent: Python-urllib\/3.12\\r\\nContent-Type: applicati\u0022, \u0022target_port_label\u0022: \u00222379 \u00b7 ETCD\u0022, \u0022emulator_service\u0022: \u0022etcd\u0022, \u0022confidence_reason\u0022: \u0022Confiance 0 % \u2014 5 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: null, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022etcd\u0022, \u0022service_banner\u0022: \u0022honeypot-etcd\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00222379\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022etcd_emulated\u0022, \u0022etcd_payload\u0022, \u0022etcd_probe\u0022, \u0022http_get_probe\u0022, \u0022net_etcd_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022etcd_emulated\u0022, \u0022etcd_payload\u0022, \u0022etcd_probe\u0022, \u0022http_get_probe\u0022, \u0022net_etcd_probe\u0022]","anomalies":"[]","severity":5,"bytes_in":158},{"id":14018045,"ip":"13.140.200.70","ts":"2026-11-06 11:17:32.000000","proto":"tcp","src_port":44698,"dst_port":6380,"service":null,"classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 13, \u0022payload_entropy\u0022: 3.5465935642949384, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022service\u0022: null, \u0022app_proto\u0022: null, \u0022asn\u0022: 51167, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 6380, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 0.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022956f5641ce67b766b2b73721b112294b6f767fde\u0022, \u0022event_fingerprint\u0022: \u0022c4d7259339c845704731a4d62f99554d03c4c5a2\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 231, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: false, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 51167, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00220d93a2ea5bf121af8563c122d94345da\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6380, \u0022risk_score\u0022: 42}, \u0022payload_preview\u0022: \u0022MODULE LIST\\r\\n\u0022, \u0022request_sample\u0022: \u0022MODULE LIST\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022MODULE LIST\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022MODULE LIST\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022MODULE LIST\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022e81ea34d1f0fdb390cda3e821709c60f49c4ab01\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022MODULE LIST\u0022, \u0022port\u0022: 6380}, \u0022evidence_snippet\u0022: \u0022MODULE LIST\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 port 6380 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00226380\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 42\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 multi-protocole (3 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: null, \u0022service_label_fr\u0022: null, \u0022dst_port\u0022: 6380, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022MODULE LIST\u0022, \u0022port\u0022: 6380}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 port 6380 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022MODULE LIST\u0022, \u0022target_port_label\u0022: \u00226380\u0022, \u0022emulator_service\u0022: null, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 1 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022generic\u0022, \u0022service_banner\u0022: \u0022honeypot\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226380\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 3, \u0022multi_protocol_sample\u0022: [\u0022port:16379\u0022, \u0022port:6380\u0022, \u0022redis\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022redis_module_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022redis_module_probe\u0022]","anomalies":"[]","severity":6,"bytes_in":13},{"id":14017899,"ip":"13.140.200.70","ts":"2026-11-06 11:17:03.000000","proto":"tcp","src_port":45476,"dst_port":6379,"service":"redis","classification":"port_6379_tcp","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u00222d45525220756e6b6e6f776e20636f6d6d616e642027686f6e6579706f74270d0a\u0022, \u0022emulator_response_len\u0022: 33, \u0022bytes_in\u0022: 13, \u0022payload_entropy\u0022: 3.5465935642949384, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022service\u0022: \u0022redis\u0022, \u0022app_proto\u0022: \u0022redis\u0022, \u0022asn\u0022: 51167, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 6379, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 38.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 36.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022e4161306bf7f2e577438105f6ce56d93270c1aa8\u0022, \u0022event_fingerprint\u0022: \u00229c536ce82edfb6f83700eeb7934e9ac49a41747b\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_6379_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022confidence\u0022: 0.63, \u0022classification_confidence\u0022: 0.63, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022named_classification_skipped\u0022: true, \u0022named_candidate\u0022: \u0022redis_probe\u0022, \u0022service_name\u0022: \u0022redis\u0022, \u0022risk_confidence_factor\u0022: 55.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 51167, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00220d93a2ea5bf121af8563c122d94345da\u0022, \u0022path_pattern_hash\u0022: \u002242eb67f6877c6439dbde87dd6ec1f324\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 6379, \u0022service\u0022: \u0022redis\u0022, \u0022service_name\u0022: \u0022redis\u0022, \u0022risk_score\u0022: 42}, \u0022payload_preview\u0022: \u0022MODULE LIST\\r\\n\u0022, \u0022request_sample\u0022: \u0022MODULE LIST\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022MODULE LIST\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022MODULE LIST\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022MODULE LIST\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_6379_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00225caf64e9e2ff83ba62ed65073a9b59efb709c9ef\u0022, \u0022protocol_details\u0022: {\u0022redis_command_fr\u0022: \u0022Sonde protocole Redis\u0022, \u0022payload_preview\u0022: \u0022MODULE LIST\u0022, \u0022port\u0022: 6379, \u0022service\u0022: \u0022redis\u0022, \u0022service_label_fr\u0022: \u0022REDIS\u0022}, \u0022evidence_snippet\u0022: \u0022MODULE LIST\u0022, \u0022attack_vector\u0022: \u0022port 6379 tcp \u00b7 via REDIS:6379 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u00226379 \u00b7 REDIS\u0022, \u0022emulator_service\u0022: \u0022redis\u0022, \u0022confidence_reason\u0022: \u0022Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_6379_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_6379_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 42\/100\u0022, \u0022confidence_pct\u0022: 63, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 36.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42, \u0022correlation_boost\u0022: 8}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022redis\u0022, \u0022service_label_fr\u0022: \u0022REDIS\u0022, \u0022dst_port\u0022: 6379, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022Redis 7.0\u0022, \u0022correlation_flags\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +8\u0022, \u0022protocol_details\u0022: {\u0022redis_command_fr\u0022: \u0022Sonde protocole Redis\u0022, \u0022payload_preview\u0022: \u0022MODULE LIST\u0022, \u0022port\u0022: 6379, \u0022service\u0022: \u0022redis\u0022, \u0022service_label_fr\u0022: \u0022REDIS\u0022}, \u0022attack_vector\u0022: \u0022port 6379 tcp \u00b7 via REDIS:6379 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022MODULE LIST\u0022, \u0022target_port_label\u0022: \u00226379 \u00b7 REDIS\u0022, \u0022emulator_service\u0022: \u0022redis\u0022, \u0022confidence_reason\u0022: \u0022Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 63 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022redis\u0022, \u0022service_banner\u0022: \u0022Redis 7.0\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00226379\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022port:16379\u0022, \u0022redis\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 8, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022net_redis_probe\u0022, \u0022redis_emulated\u0022, \u0022redis_module_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022net_redis_probe\u0022, \u0022redis_emulated\u0022, \u0022redis_module_probe\u0022]","anomalies":"[]","severity":6,"bytes_in":13},{"id":14017784,"ip":"13.140.200.70","ts":"2026-11-06 11:16:41.000000","proto":"tcp","src_port":38976,"dst_port":16379,"service":null,"classification":"port_16379_tcp","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022bytes_in\u0022: 13, \u0022payload_entropy\u0022: 3.5465935642949384, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022service\u0022: null, \u0022app_proto\u0022: null, \u0022asn\u0022: 51167, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 16379, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 38.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 0.0, \u0022risk_novelty\u0022: 0.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.1, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0}, \u0022risk_score\u0022: 42, \u0022tag_count\u0022: 1, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022a62c7b3677d421fbfa34467c988c6cd71488c4ad\u0022, \u0022event_fingerprint\u0022: \u0022460b7e86a6f665d93b298752702d62094244a245\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_16379_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022confidence\u0022: 0.55, \u0022classification_confidence\u0022: 0.55, \u0022precision_score\u0022: 0, \u0022precision_signals\u0022: [], \u0022kb_rule_ids\u0022: [], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42}, \u0022named_classification_skipped\u0022: true, \u0022named_candidate\u0022: \u0022redis_probe\u0022, \u0022risk_confidence_factor\u0022: 55.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 51167, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00220d93a2ea5bf121af8563c122d94345da\u0022, \u0022path_pattern_hash\u0022: \u002227f990003fa17adfc67edd0792a16375\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 16379, \u0022risk_score\u0022: 42}, \u0022payload_preview\u0022: \u0022MODULE LIST\\r\\n\u0022, \u0022request_sample\u0022: \u0022MODULE LIST\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022MODULE LIST\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022MODULE LIST\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022MODULE LIST\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_16379_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022mitre_tactics\u0022: [\u0022TA0007\u0022, \u0022TA0001\u0022], \u0022mitre\u0022: \u0022TA0007\u0022, \u0022threat_family\u0022: [\u0022unknown\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b15dc0edf8ee61d649524c219233b0949532c54e\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022MODULE LIST\u0022, \u0022port\u0022: 16379}, \u0022evidence_snippet\u0022: \u0022MODULE LIST\u0022, \u0022attack_vector\u0022: \u0022port 16379 tcp \u00b7 port 16379 \u00b7 (sonde \/ probe)\u0022, \u0022target_port_label\u0022: \u002216379\u0022, \u0022confidence_reason\u0022: \u0022Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_16379_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_16379_tcp \u00bb (signaux protocolaires) \u00b7 confiance 55%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u00b7 risque 42\/100\u0022, \u0022confidence_pct\u0022: 55, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 38.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 0.0, \u0022novelty\u0022: 0.0, \u0022risk_score\u0022: 42}, \u0022attack_stage\u0022: \u0022probe\u0022, \u0022attack_stage_label\u0022: \u0022Sonde \/ probe\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022risk_score\u0022: 42, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: null, \u0022service_label_fr\u0022: null, \u0022dst_port\u0022: 16379, \u0022protocol_emulated\u0022: null, \u0022tags_summary\u0022: null, \u0022tags_summary_labels_fr\u0022: null, \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0007\u0022, \u0022mitre_technique\u0022: \u0022TA0007\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022MODULE LIST\u0022, \u0022port\u0022: 16379}, \u0022attack_vector\u0022: \u0022port 16379 tcp \u00b7 port 16379 \u00b7 (sonde \/ probe)\u0022, \u0022evidence_snippet\u0022: \u0022MODULE LIST\u0022, \u0022target_port_label\u0022: \u002216379\u0022, \u0022emulator_service\u0022: null, \u0022confidence_reason\u0022: \u0022Confiance 55 % \u2014 Classification nomm\u00e9e non retenue \u2014 preuves insuffisantes\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 55 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022discovery\u0022, \u0022label_fr\u0022: \u0022D\u00e9couverte\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022generic\u0022, \u0022service_banner\u0022: \u0022honeypot\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u002216379\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022discovery\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022redis_module_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022redis_module_probe\u0022]","anomalies":"[]","severity":6,"bytes_in":13},{"id":13898336,"ip":"13.140.200.70","ts":"2026-11-06 05:04:06.000000","proto":"tcp","src_port":39558,"dst_port":8008,"service":"http","classification":"port_scan_syn","waf_score":13,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022]","http_method":"GET","http_target":"\/debug","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002262135c89cfc57ad1cd1215aa151c8e89d70dd9e0\u0022, \u0022http_host_hash\u0022: \u00222f04469f58c087671b6a6ba85c59ddf7574837ab\u0022, \u0022http_target_hash\u0022: \u00220a3fc2492b54ce52e7747ae5b318f781247a1e0e\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 190, \u0022payload_entropy\u0022: 5.389465397327021, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 51167, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 8008, \u0022risk_waf\u0022: 60.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.4, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 60.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 45, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022adc3860b3dfcb683d895afd054b429287741d685\u0022, \u0022event_fingerprint\u0022: \u0022cb45bbf85a49ef0137bf683d56ff5a73db78f8fc\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 60.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 18}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 51167, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00226034df114244a52a96c79625492287ec\u0022, \u0022payload_hash\u0022: \u00229d0fdc403c7a67c342395d097fff2f31\u0022, \u0022path_pattern_hash\u0022: \u00229e3e949c710fad428560652e60467343\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8008, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 45}, \u0022payload_preview\u0022: \u0022GET \/debug HTTP\/1.1\\r\\nHost: 62.3.50.33:8008\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\\r\\nA\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/debug\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/debug HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/debug HTTP\/1.1\\r\\nHost: 62.3.50.33:8008\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip, deflate, br, zstd\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/debug HTTP\/1.1\\r\\nHost: 62.3.50.33:8008\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\\r\\nA\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/debug\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/debug HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/debug HTTP\/1.1\\r\\nHost: 62.3.50.33:8008\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip, deflate, br, zstd\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/debug HTTP\/1.1\\r\\nHost: 62.3.50.33:8008\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\\r\\nA\u0022, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022ca599d9e47ed3924f14034e97c6e8c6e4568f8cc\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/debug\u0022, \u0022request_line\u0022: \u0022GET \/debug HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\u0022, \u0022port\u0022: 8008, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/debug HTTP\/1.1\\r\\nHost: 62.3.50.33:8008\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\\r\\nA\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8008 \u00b7 (reconnaissance) \u00b7 \u2192 \/debug\u0022, \u0022target_port_label\u0022: \u00228008 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Sonde fichier sensible \/ config \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 45\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 60.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 45, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 45, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8008, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/debug\u0022, \u0022request_line\u0022: \u0022GET \/debug HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\u0022, \u0022port\u0022: 8008, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8008 \u00b7 (reconnaissance) \u00b7 \u2192 \/debug\u0022, \u0022evidence_snippet\u0022: \u0022GET \/debug HTTP\/1.1\\r\\nHost: 62.3.50.33:8008\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\\r\\nA\u0022, \u0022target_port_label\u0022: \u00228008 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228008\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 6, \u0022port_scan_ports_sample\u0022: [3000, 5000, 8000, 8008, 8080, 8081], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 6, \u0022scan_velocity_ports_per_s\u0022: 60.0, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022sap-icm\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022http_probe_debug\u0022, \u0022http_sensitive_path\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8008","http_user_agent":"Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022http_probe_debug\u0022, \u0022http_sensitive_path\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":190},{"id":13898335,"ip":"13.140.200.70","ts":"2026-11-06 05:04:06.000000","proto":"tcp","src_port":32924,"dst_port":8081,"service":"http","classification":"port_scan_syn","waf_score":13,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022]","http_method":"GET","http_target":"\/files","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002262135c89cfc57ad1cd1215aa151c8e89d70dd9e0\u0022, \u0022http_host_hash\u0022: \u00221994c0ff95f3f16c5fa9177d852edc4f1a4a8a24\u0022, \u0022http_target_hash\u0022: \u0022afa55bb6c6e3322f5a470e86634a812ad043889b\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 190, \u0022payload_entropy\u0022: 5.366935529234948, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 51167, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 8081, \u0022risk_waf\u0022: 60.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 60.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 47, \u0022tag_count\u0022: 4, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022b208d04e236a4f95e84bcba017542f09d367582d\u0022, \u0022event_fingerprint\u0022: \u0022a19c862bbb490ce6b92060835f172bf20d23d545\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 60.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 47, \u0022correlation_boost\u0022: 18}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 51167, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00226034df114244a52a96c79625492287ec\u0022, \u0022payload_hash\u0022: \u00222056d82d37c362c045ade614b8c63229\u0022, \u0022path_pattern_hash\u0022: \u0022f4aa79e429af3c4da5700e4561167336\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 47}, \u0022payload_preview\u0022: \u0022GET \/files HTTP\/1.1\\r\\nHost: 62.3.50.33:8081\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\\r\\nA\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/files\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/files HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/files HTTP\/1.1\\r\\nHost: 62.3.50.33:8081\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip, deflate, br, zstd\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/files HTTP\/1.1\\r\\nHost: 62.3.50.33:8081\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\\r\\nA\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/files\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/files HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/files HTTP\/1.1\\r\\nHost: 62.3.50.33:8081\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip, deflate, br, zstd\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/files HTTP\/1.1\\r\\nHost: 62.3.50.33:8081\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\\r\\nA\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022a4d4b351df560a48bcad48213efa270b6d94b14b\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/files\u0022, \u0022request_line\u0022: \u0022GET \/files HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/files HTTP\/1.1\\r\\nHost: 62.3.50.33:8081\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\\r\\nA\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8081 \u00b7 (reconnaissance) \u00b7 \u2192 \/files\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 60.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 47, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 47, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8081, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/files\u0022, \u0022request_line\u0022: \u0022GET \/files HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8081 \u00b7 (reconnaissance) \u00b7 \u2192 \/files\u0022, \u0022evidence_snippet\u0022: \u0022GET \/files HTTP\/1.1\\r\\nHost: 62.3.50.33:8081\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\\r\\nA\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228081\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 6, \u0022port_scan_ports_sample\u0022: [3000, 5000, 8000, 8008, 8080, 8081], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 5, \u0022scan_velocity_ports_per_s\u0022: 50.0, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022sap-icm\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022http_probe_files\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8081","http_user_agent":"Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022http_probe_files\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":190},{"id":13898334,"ip":"13.140.200.70","ts":"2026-11-06 05:04:06.000000","proto":"tcp","src_port":46798,"dst_port":8080,"service":"http","classification":"port_scan_syn","waf_score":13,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022]","http_method":"GET","http_target":"\/info","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 81, \u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002262135c89cfc57ad1cd1215aa151c8e89d70dd9e0\u0022, \u0022http_host_hash\u0022: \u0022c9908f9a31aefa5902e21ee9fa132cbe056c536d\u0022, \u0022http_target_hash\u0022: \u00225338ec2703ace1fbfb779d6e11e562e8cf7fc325\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 189, \u0022payload_entropy\u0022: 5.368128206217824, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 51167, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 8080, \u0022risk_waf\u0022: 60.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.2, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 60.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 46, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002257f088a40ee12788bdcf96d0d3ffc1707c32a99e\u0022, \u0022event_fingerprint\u0022: \u002203885bb080d863357a76b735e56d1771251aafaa\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 60.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 46, \u0022correlation_boost\u0022: 18}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 51167, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00226034df114244a52a96c79625492287ec\u0022, \u0022payload_hash\u0022: \u00223a83350a99f5120f3ae3b6e8cceb7efe\u0022, \u0022path_pattern_hash\u0022: \u002252b3cc6e4f000c70a79583bf814cc5de\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 46}, \u0022payload_preview\u0022: \u0022GET \/info HTTP\/1.1\\r\\nHost: 62.3.50.33:8080\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAc\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/info\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/info HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/info HTTP\/1.1\\r\\nHost: 62.3.50.33:8080\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip, deflate, br, zstd\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/info HTTP\/1.1\\r\\nHost: 62.3.50.33:8080\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAc\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/info\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/info HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/info HTTP\/1.1\\r\\nHost: 62.3.50.33:8080\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip, deflate, br, zstd\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/info HTTP\/1.1\\r\\nHost: 62.3.50.33:8080\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAc\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002256c35d2b411d761737965105e133b992e89fcdcf\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/info\u0022, \u0022request_line\u0022: \u0022GET \/info HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/info HTTP\/1.1\\r\\nHost: 62.3.50.33:8080\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAc\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance) \u00b7 \u2192 \/info\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 60.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 46, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 46, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8080, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/info\u0022, \u0022request_line\u0022: \u0022GET \/info HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance) \u00b7 \u2192 \/info\u0022, \u0022evidence_snippet\u0022: \u0022GET \/info HTTP\/1.1\\r\\nHost: 62.3.50.33:8080\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAc\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +18 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228080\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 6, \u0022port_scan_ports_sample\u0022: [3000, 5000, 8000, 8008, 8080, 8081], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 4, \u0022scan_velocity_ports_per_s\u0022: 40.0, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022sap-icm\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8080","http_user_agent":"Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":189},{"id":13898333,"ip":"13.140.200.70","ts":"2026-11-06 05:04:06.000000","proto":"tcp","src_port":48218,"dst_port":8000,"service":"sap-icm","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a205341502049434d0d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2036300d0a0d0a3c68746d6c3e3c626f64793e53415020496e7465726e657420436f6d6d756e69636174696f6e204d616e616765723c\u0022, \u0022emulator_response_len\u0022: 141, \u0022bytes_in\u0022: 201, \u0022payload_entropy\u0022: 5.376489927232847, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022service\u0022: \u0022sap-icm\u0022, \u0022app_proto\u0022: \u0022sap-icm\u0022, \u0022asn\u0022: 51167, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 8000, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 48.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 20, \u0022risk_granularity\u0022: 2.1, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 48.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 47, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022f4d3bfae803bd07fc62331c16ac15c5323341684\u0022, \u0022event_fingerprint\u0022: \u002240ac2e001fc92fc4c26729171b1b914e26c42c6a\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 48.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 47, \u0022correlation_boost\u0022: 18}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022sap-icm\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 51167, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022a66afa6665b161e00f233da778fbc66f\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8000, \u0022service\u0022: \u0022sap-icm\u0022, \u0022service_name\u0022: \u0022sap-icm\u0022, \u0022risk_score\u0022: 47}, \u0022payload_preview\u0022: \u0022GET \/api\/v2.0\/version HTTP\/1.1\\r\\nHost: 62.3.50.33:8000\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAcc\u0022, \u0022request_sample\u0022: \u0022GET \/api\/v2.0\/version HTTP\/1.1\\r\\nHost: 62.3.50.33:8000\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip, deflate, br, zstd\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/v2.0\/version HTTP\/1.1\\r\\nHost: 62.3.50.33:8000\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAcc\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022GET \/api\/v2.0\/version HTTP\/1.1\\r\\nHost: 62.3.50.33:8000\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip, deflate, br, zstd\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/v2.0\/version HTTP\/1.1\\r\\nHost: 62.3.50.33:8000\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAcc\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022d4e2dabf0f0974ee3e6dd167535786a4e048ced1\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022GET \/api\/v2.0\/version HTTP\/1.1\\r\\nHost: 62.3.50.33:8000\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAcc\u0022, \u0022port\u0022: 8000, \u0022service\u0022: \u0022sap-icm\u0022, \u0022service_label_fr\u0022: \u0022SAP ICM\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/v2.0\/version HTTP\/1.1\\r\\nHost: 62.3.50.33:8000\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAcc\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via SAP ICM:8000 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00228000 \u00b7 SAP ICM\u0022, \u0022emulator_service\u0022: \u0022sap-icm\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SAP ICM \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 48.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 47, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 47, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022sap-icm\u0022, \u0022service_label_fr\u0022: \u0022SAP ICM\u0022, \u0022dst_port\u0022: 8000, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-sap-icm\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022GET \/api\/v2.0\/version HTTP\/1.1\\r\\nHost: 62.3.50.33:8000\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAcc\u0022, \u0022port\u0022: 8000, \u0022service\u0022: \u0022sap-icm\u0022, \u0022service_label_fr\u0022: \u0022SAP ICM\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via SAP ICM:8000 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/v2.0\/version HTTP\/1.1\\r\\nHost: 62.3.50.33:8000\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAcc\u0022, \u0022target_port_label\u0022: \u00228000 \u00b7 SAP ICM\u0022, \u0022emulator_service\u0022: \u0022sap-icm\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022sap_icm\u0022, \u0022service_banner\u0022: \u0022honeypot-sap-icm\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228000\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 6, \u0022port_scan_ports_sample\u0022: [3000, 5000, 8000, 8008, 8080, 8081], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 3, \u0022scan_velocity_ports_per_s\u0022: 30.0, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022sap-icm\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_get_probe\u0022, \u0022mozi_pattern\u0022, \u0022net_sap_web_probe\u0022, \u0022sap_icm_emulated\u0022, \u0022sap_icm_payload\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_get_probe\u0022, \u0022mozi_pattern\u0022, \u0022net_sap_web_probe\u0022, \u0022sap_icm_emulated\u0022, \u0022sap_icm_payload\u0022]","anomalies":"[]","severity":7,"bytes_in":201},{"id":13898332,"ip":"13.140.200.70","ts":"2026-11-06 05:04:06.000000","proto":"tcp","src_port":59384,"dst_port":5000,"service":"http","classification":"port_scan_syn","waf_score":19,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950601:k8s-metrics\u0022, \u0022950610:prometheus-metrics\u0022]","http_method":"GET","http_target":"\/metrics","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a20746578742f706c61696e3b2076657273696f6e3d302e302e340d0a436f6e74656e742d4c656e6774683a2033330d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a232048454c5020\u0022, \u0022emulator_response_len\u0022: 154, \u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002262135c89cfc57ad1cd1215aa151c8e89d70dd9e0\u0022, \u0022http_host_hash\u0022: \u0022b3fecad1903fbad7bf672cc5a25c971b97553846\u0022, \u0022http_target_hash\u0022: \u00227edfc244708a7b5c7d4b4385c178aa8e03afde7f\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 192, \u0022payload_entropy\u0022: 5.356098948349666, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 51167, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 5000, \u0022risk_waf\u0022: 84.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 3.9, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 84.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 49, \u0022tag_count\u0022: 7, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00225e1ec8dbf7ac01489d43bfdb782ffd366e35c3a0\u0022, \u0022event_fingerprint\u0022: \u00225d8dcced09a592d06459bc22cb74d0da181cff0f\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence\u0022: 0.64, \u0022classification_confidence\u0022: 0.64, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 84.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 49, \u0022correlation_boost\u0022: 14}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 51167, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00226034df114244a52a96c79625492287ec\u0022, \u0022payload_hash\u0022: \u0022bf3c082fb1a158ef689ae33a5e279386\u0022, \u0022path_pattern_hash\u0022: \u0022b4bbca6caf5247626ee41b68231d40e1\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 5000, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 49}, \u0022payload_preview\u0022: \u0022GET \/metrics HTTP\/1.1\\r\\nHost: 62.3.50.33:5000\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\\r\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/metrics\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950601:k8s-metrics\u0022, \u0022950610:prometheus-metrics\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022k8s-metrics\u0022, \u0022prometheus-metrics\u0022], \u0022request_line\u0022: \u0022GET \/metrics HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/metrics HTTP\/1.1\\r\\nHost: 62.3.50.33:5000\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip, deflate, br, zstd\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/metrics HTTP\/1.1\\r\\nHost: 62.3.50.33:5000\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/metrics\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950601:k8s-metrics\u0022, \u0022950610:prometheus-metrics\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022k8s-metrics\u0022, \u0022prometheus-metrics\u0022], \u0022request_line\u0022: \u0022GET \/metrics HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/metrics HTTP\/1.1\\r\\nHost: 62.3.50.33:5000\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip, deflate, br, zstd\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/metrics HTTP\/1.1\\r\\nHost: 62.3.50.33:5000\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre\u0022: \u0022TA0043\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022d0d82ce5dd6dc2ada33e7cce5c0a51aebbad9195\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/metrics\u0022, \u0022request_line\u0022: \u0022GET \/metrics HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\u0022, \u0022port\u0022: 5000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/metrics HTTP\/1.1\\r\\nHost: 62.3.50.33:5000\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:5000 \u00b7 (reconnaissance) \u00b7 \u2192 \/metrics\u0022, \u0022target_port_label\u0022: \u00225000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 49\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 64 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 64, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 84.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 49, \u0022correlation_boost\u0022: 14}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 49, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 5000, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022TA0043\u0022, \u0022mitre_technique\u0022: \u0022TA0043\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022campagne_ports\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Campagne multi-ports\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +14\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/metrics\u0022, \u0022request_line\u0022: \u0022GET \/metrics HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\u0022, \u0022port\u0022: 5000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:5000 \u00b7 (reconnaissance) \u00b7 \u2192 \/metrics\u0022, \u0022evidence_snippet\u0022: \u0022GET \/metrics HTTP\/1.1\\r\\nHost: 62.3.50.33:5000\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\u0022, \u0022target_port_label\u0022: \u00225000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 64 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +14 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00225000\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 6, \u0022port_scan_ports_sample\u0022: [3000, 5000, 8000, 8008, 8080, 8081], \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022sap-icm\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 14, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950601:k8s-metrics\u0022, \u0022950610:prometheus-metrics\u0022, \u0022http_probe_metrics\u0022, \u0022http_prometheus_probe\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:5000","http_user_agent":"Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950601:k8s-metrics\u0022, \u0022950610:prometheus-metrics\u0022, \u0022http_probe_metrics\u0022, \u0022http_prometheus_probe\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":9,"bytes_in":192},{"id":13898331,"ip":"13.140.200.70","ts":"2026-11-06 05:04:06.000000","proto":"tcp","src_port":45896,"dst_port":3000,"service":"http","classification":"port_scan_syn","waf_score":19,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950601:k8s-metrics\u0022, \u0022950610:prometheus-metrics\u0022]","http_method":"GET","http_target":"\/metrics","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d547970653a20746578742f706c61696e3b2076657273696f6e3d302e302e340d0a436f6e74656e742d4c656e6774683a2033330d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a232048454c5020\u0022, \u0022emulator_response_len\u0022: 154, \u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002262135c89cfc57ad1cd1215aa151c8e89d70dd9e0\u0022, \u0022http_host_hash\u0022: \u002246f5955a67387b75de712e640b0687c888a438e5\u0022, \u0022http_target_hash\u0022: \u00227edfc244708a7b5c7d4b4385c178aa8e03afde7f\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 192, \u0022payload_entropy\u0022: 5.352687375266053, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 51167, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 3000, \u0022risk_waf\u0022: 84.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 6.3, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 84.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 7, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00224685f3564bd6ed31c85879316712049b4d308f32\u0022, \u0022event_fingerprint\u0022: \u0022d9e048676a9da5db45f71426ecaa181a144ff6a3\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022confidence\u0022: 0.64, \u0022classification_confidence\u0022: 0.64, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 84.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 51, \u0022correlation_boost\u0022: 14}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 50.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 51167, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00226034df114244a52a96c79625492287ec\u0022, \u0022payload_hash\u0022: \u0022f8f87e7f02f8d152c056ab69d1567390\u0022, \u0022path_pattern_hash\u0022: \u0022b4bbca6caf5247626ee41b68231d40e1\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 3000, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 51}, \u0022payload_preview\u0022: \u0022GET \/metrics HTTP\/1.1\\r\\nHost: 62.3.50.33:3000\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\\r\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/metrics\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950601:k8s-metrics\u0022, \u0022950610:prometheus-metrics\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022k8s-metrics\u0022, \u0022prometheus-metrics\u0022], \u0022request_line\u0022: \u0022GET \/metrics HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/metrics HTTP\/1.1\\r\\nHost: 62.3.50.33:3000\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip, deflate, br, zstd\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/metrics HTTP\/1.1\\r\\nHost: 62.3.50.33:3000\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/metrics\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950601:k8s-metrics\u0022, \u0022950610:prometheus-metrics\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022k8s-metrics\u0022, \u0022prometheus-metrics\u0022], \u0022request_line\u0022: \u0022GET \/metrics HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/metrics HTTP\/1.1\\r\\nHost: 62.3.50.33:3000\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip, deflate, br, zstd\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/metrics HTTP\/1.1\\r\\nHost: 62.3.50.33:3000\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre\u0022: \u0022TA0043\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002219e5d7d0918c0b92abe77dfc425e231fa3217337\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/metrics\u0022, \u0022request_line\u0022: \u0022GET \/metrics HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\u0022, \u0022port\u0022: 3000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/metrics HTTP\/1.1\\r\\nHost: 62.3.50.33:3000\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/metrics\u0022, \u0022target_port_label\u0022: \u00223000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 4 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 50%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE TA0043 \u2014 confiance 64 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 64, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 84.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 51, \u0022correlation_boost\u0022: 14}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 3000, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022TA0043\u0022, \u0022mitre_technique\u0022: \u0022TA0043\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022campagne_ports\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Campagne multi-ports\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +14\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/metrics\u0022, \u0022request_line\u0022: \u0022GET \/metrics HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\u0022, \u0022port\u0022: 3000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:3000 \u00b7 (reconnaissance) \u00b7 \u2192 \/metrics\u0022, \u0022evidence_snippet\u0022: \u0022GET \/metrics HTTP\/1.1\\r\\nHost: 62.3.50.33:3000\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\u0022, \u0022target_port_label\u0022: \u00223000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 50 % \u2014 4 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 64 % \u2014 Score WAF 84 \u00b7 Bonus corr\u00e9lation +14 \u00b7 4 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00223000\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 6, \u0022port_scan_ports_sample\u0022: [3000, 5000, 8000, 8008, 8080, 8081], \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022sap-icm\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 14, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950601:k8s-metrics\u0022, \u0022950610:prometheus-metrics\u0022, \u0022http_probe_metrics\u0022, \u0022http_prometheus_probe\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:3000","http_user_agent":"Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022950601:k8s-metrics\u0022, \u0022950610:prometheus-metrics\u0022, \u0022http_probe_metrics\u0022, \u0022http_prometheus_probe\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":9,"bytes_in":192},{"id":13898298,"ip":"13.140.200.70","ts":"2026-11-06 05:03:56.000000","proto":"tcp","src_port":48288,"dst_port":8081,"service":"http","classification":"port_scan_syn","waf_score":31,"waf_tags":"[\u0022950316:lfi-14\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950600:k8s-api\u0022]","http_method":"GET","http_target":"\/api\/v2.0\/version","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: \u00220\/version\u0022, \u0022http_ua_hash\u0022: \u002262135c89cfc57ad1cd1215aa151c8e89d70dd9e0\u0022, \u0022http_host_hash\u0022: \u00221994c0ff95f3f16c5fa9177d852edc4f1a4a8a24\u0022, \u0022http_target_hash\u0022: \u002244f3ef0791f830644afb89f79592c674e4dd43ae\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 201, \u0022payload_entropy\u0022: 5.380742429582466, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 51167, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 8081, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 61, \u0022tag_count\u0022: 7, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002234a5241ab8e17f39a0ce4a86703f1da058b24799\u0022, \u0022event_fingerprint\u0022: \u002263d74092613f9a506c1439c3558ab8f02515b57c\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 61, \u0022correlation_boost\u0022: 18}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 51167, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00226034df114244a52a96c79625492287ec\u0022, \u0022payload_hash\u0022: \u00229145f116ff5566b31204f40398f1a172\u0022, \u0022path_pattern_hash\u0022: \u00226f07ce0327b304a377c2a627d6ba1d75\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 61}, \u0022payload_preview\u0022: \u0022GET \/api\/v2.0\/version HTTP\/1.1\\r\\nHost: 62.3.50.33:8081\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAcc\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/v2.0\/version\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950316:lfi-14\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022lfi-14\u0022, \u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/v2.0\/version HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/v2.0\/version HTTP\/1.1\\r\\nHost: 62.3.50.33:8081\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip, deflate, br, zstd\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/v2.0\/version HTTP\/1.1\\r\\nHost: 62.3.50.33:8081\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAcc\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/v2.0\/version\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950316:lfi-14\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022lfi-14\u0022, \u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/v2.0\/version HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/v2.0\/version HTTP\/1.1\\r\\nHost: 62.3.50.33:8081\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip, deflate, br, zstd\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/v2.0\/version HTTP\/1.1\\r\\nHost: 62.3.50.33:8081\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAcc\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022ccdc0a556e01283e91d293ee6e6e2e85946de2ed\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/v2.0\/version\u0022, \u0022request_line\u0022: \u0022GET \/api\/v2.0\/version HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/v2.0\/version HTTP\/1.1\\r\\nHost: 62.3.50.33:8081\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAcc\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8081 \u00b7 (reconnaissance) \u00b7 \u2192 \/api\/v2.0\/version\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 61, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 61, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8081, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/v2.0\/version\u0022, \u0022request_line\u0022: \u0022GET \/api\/v2.0\/version HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\u0022, \u0022port\u0022: 8081, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8081 \u00b7 (reconnaissance) \u00b7 \u2192 \/api\/v2.0\/version\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/v2.0\/version HTTP\/1.1\\r\\nHost: 62.3.50.33:8081\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAcc\u0022, \u0022target_port_label\u0022: \u00228081 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228081\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 6, \u0022port_scan_ports_sample\u0022: [3000, 5000, 8000, 8008, 8080, 8081], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 6, \u0022scan_velocity_ports_per_s\u0022: 60.0, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022sap-icm\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950316:lfi-14\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8081","http_user_agent":"Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36","http_referer":null,"tags":"[\u0022950316:lfi-14\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":10,"bytes_in":201},{"id":13898297,"ip":"13.140.200.70","ts":"2026-11-06 05:03:56.000000","proto":"tcp","src_port":48206,"dst_port":8008,"service":"http","classification":"port_scan_syn","waf_score":31,"waf_tags":"[\u0022950316:lfi-14\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950600:k8s-api\u0022]","http_method":"GET","http_target":"\/api\/v2.0\/version","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: \u00220\/version\u0022, \u0022http_ua_hash\u0022: \u002262135c89cfc57ad1cd1215aa151c8e89d70dd9e0\u0022, \u0022http_host_hash\u0022: \u00222f04469f58c087671b6a6ba85c59ddf7574837ab\u0022, \u0022http_target_hash\u0022: \u002244f3ef0791f830644afb89f79592c674e4dd43ae\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 201, \u0022payload_entropy\u0022: 5.382187673639447, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 51167, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 8008, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 4.0, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 59, \u0022tag_count\u0022: 7, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u002244080ade112d029184b69f2699764a48f65e089a\u0022, \u0022event_fingerprint\u0022: \u0022e1cba1bd06e3a71818b6fddeb7737bfc861f8d14\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 59, \u0022correlation_boost\u0022: 18}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 51167, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00226034df114244a52a96c79625492287ec\u0022, \u0022payload_hash\u0022: \u00227732a24991eafaac9bacf79b38f0d93a\u0022, \u0022path_pattern_hash\u0022: \u00226f07ce0327b304a377c2a627d6ba1d75\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8008, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 59}, \u0022payload_preview\u0022: \u0022GET \/api\/v2.0\/version HTTP\/1.1\\r\\nHost: 62.3.50.33:8008\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAcc\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/v2.0\/version\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950316:lfi-14\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022lfi-14\u0022, \u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/v2.0\/version HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/v2.0\/version HTTP\/1.1\\r\\nHost: 62.3.50.33:8008\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip, deflate, br, zstd\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/v2.0\/version HTTP\/1.1\\r\\nHost: 62.3.50.33:8008\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAcc\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/v2.0\/version\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950316:lfi-14\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022lfi-14\u0022, \u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/v2.0\/version HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/v2.0\/version HTTP\/1.1\\r\\nHost: 62.3.50.33:8008\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip, deflate, br, zstd\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/v2.0\/version HTTP\/1.1\\r\\nHost: 62.3.50.33:8008\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAcc\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002223e279a478726c4c35f41cf2e39521c0f7614a93\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/v2.0\/version\u0022, \u0022request_line\u0022: \u0022GET \/api\/v2.0\/version HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\u0022, \u0022port\u0022: 8008, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/v2.0\/version HTTP\/1.1\\r\\nHost: 62.3.50.33:8008\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAcc\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8008 \u00b7 (reconnaissance) \u00b7 \u2192 \/api\/v2.0\/version\u0022, \u0022target_port_label\u0022: \u00228008 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 59\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 59, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 59, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8008, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/v2.0\/version\u0022, \u0022request_line\u0022: \u0022GET \/api\/v2.0\/version HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\u0022, \u0022port\u0022: 8008, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8008 \u00b7 (reconnaissance) \u00b7 \u2192 \/api\/v2.0\/version\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/v2.0\/version HTTP\/1.1\\r\\nHost: 62.3.50.33:8008\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAcc\u0022, \u0022target_port_label\u0022: \u00228008 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228008\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 6, \u0022port_scan_ports_sample\u0022: [3000, 5000, 8000, 8008, 8080, 8081], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 5, \u0022scan_velocity_ports_per_s\u0022: 50.0, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022sap-icm\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950316:lfi-14\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8008","http_user_agent":"Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36","http_referer":null,"tags":"[\u0022950316:lfi-14\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":10,"bytes_in":201},{"id":13898296,"ip":"13.140.200.70","ts":"2026-11-06 05:03:56.000000","proto":"tcp","src_port":36310,"dst_port":8080,"service":"http","classification":"port_scan_syn","waf_score":31,"waf_tags":"[\u0022950316:lfi-14\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950600:k8s-api\u0022]","http_method":"GET","http_target":"\/api\/v2.0\/version","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a206e67696e782f312e32342e300d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 81, \u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 3, \u0022http_path_ext\u0022: \u00220\/version\u0022, \u0022http_ua_hash\u0022: \u002262135c89cfc57ad1cd1215aa151c8e89d70dd9e0\u0022, \u0022http_host_hash\u0022: \u0022c9908f9a31aefa5902e21ee9fa132cbe056c536d\u0022, \u0022http_target_hash\u0022: \u002244f3ef0791f830644afb89f79592c674e4dd43ae\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 201, \u0022payload_entropy\u0022: 5.382187673639447, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 51167, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 8080, \u0022risk_waf\u0022: 100.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 43.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 5.7, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 61, \u0022tag_count\u0022: 7, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022224c870a1d0891fd707814748fef7a19ea43061f\u0022, \u0022event_fingerprint\u0022: \u0022f8cdc958381fa590cb1c51dc47a61c8329391986\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 61, \u0022correlation_boost\u0022: 18}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 51167, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00226034df114244a52a96c79625492287ec\u0022, \u0022payload_hash\u0022: \u00224de10be70cfb63952d8908fd310901a0\u0022, \u0022path_pattern_hash\u0022: \u00226f07ce0327b304a377c2a627d6ba1d75\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 61}, \u0022payload_preview\u0022: \u0022GET \/api\/v2.0\/version HTTP\/1.1\\r\\nHost: 62.3.50.33:8080\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAcc\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/v2.0\/version\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950316:lfi-14\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022lfi-14\u0022, \u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/v2.0\/version HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/v2.0\/version HTTP\/1.1\\r\\nHost: 62.3.50.33:8080\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip, deflate, br, zstd\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/v2.0\/version HTTP\/1.1\\r\\nHost: 62.3.50.33:8080\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAcc\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/api\/v2.0\/version\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950316:lfi-14\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950600:k8s-api\u0022], \u0022waf_rule_names\u0022: [\u0022lfi-14\u0022, \u0022rce-0\u0022, \u0022nosqli-3\u0022, \u0022k8s-api\u0022], \u0022request_line\u0022: \u0022GET \/api\/v2.0\/version HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/api\/v2.0\/version HTTP\/1.1\\r\\nHost: 62.3.50.33:8080\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip, deflate, br, zstd\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/v2.0\/version HTTP\/1.1\\r\\nHost: 62.3.50.33:8080\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAcc\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022287dc4070c927532b7daa850355dc885cc6c65b4\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/v2.0\/version\u0022, \u0022request_line\u0022: \u0022GET \/api\/v2.0\/version HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/v2.0\/version HTTP\/1.1\\r\\nHost: 62.3.50.33:8080\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAcc\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance) \u00b7 \u2192 \/api\/v2.0\/version\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 61\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 100.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 43.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 61, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 61, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 8080, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/api\/v2.0\/version\u0022, \u0022request_line\u0022: \u0022GET \/api\/v2.0\/version HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\u0022, \u0022port\u0022: 8080, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:8080 \u00b7 (reconnaissance) \u00b7 \u2192 \/api\/v2.0\/version\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/v2.0\/version HTTP\/1.1\\r\\nHost: 62.3.50.33:8080\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAcc\u0022, \u0022target_port_label\u0022: \u00228080 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 100 \u00b7 Bonus corr\u00e9lation +18 \u00b7 5 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228080\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 6, \u0022port_scan_ports_sample\u0022: [3000, 5000, 8000, 8008, 8080, 8081], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 4, \u0022scan_velocity_ports_per_s\u0022: 40.0, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022sap-icm\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022950316:lfi-14\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:8080","http_user_agent":"Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36","http_referer":null,"tags":"[\u0022950316:lfi-14\u0022, \u0022950326:rce-0\u0022, \u0022950468:nosqli-3\u0022, \u0022950470:nosqli-3\u0022, \u0022950600:k8s-api\u0022, \u0022http_probe_api\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":10,"bytes_in":201},{"id":13898295,"ip":"13.140.200.70","ts":"2026-11-06 05:03:56.000000","proto":"tcp","src_port":48912,"dst_port":8000,"service":"sap-icm","classification":"port_scan_syn","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a205341502049434d0d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2036300d0a0d0a3c68746d6c3e3c626f64793e53415020496e7465726e657420436f6d6d756e69636174696f6e204d616e616765723c\u0022, \u0022emulator_response_len\u0022: 141, \u0022bytes_in\u0022: 192, \u0022payload_entropy\u0022: 5.380089927391125, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022service\u0022: \u0022sap-icm\u0022, \u0022app_proto\u0022: \u0022sap-icm\u0022, \u0022asn\u0022: 51167, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 8000, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 48.0, \u0022risk_novelty\u0022: 25.0, \u0022risk_boost\u0022: 20, \u0022risk_granularity\u0022: 2.1, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 48.0, \u0022novelty\u0022: 25.0}, \u0022risk_score\u0022: 47, \u0022tag_count\u0022: 5, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022f4d3bfae803bd07fc62331c16ac15c5323341684\u0022, \u0022event_fingerprint\u0022: \u002240ac2e001fc92fc4c26729171b1b914e26c42c6a\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 48.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 47, \u0022correlation_boost\u0022: 18}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022sap-icm\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 51167, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022d46f00e19ba9375d83ee38c3ebdc2710\u0022, \u0022path_pattern_hash\u0022: \u00226a708bf69e8680803ad7dadb39e2e4d9\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 8000, \u0022service\u0022: \u0022sap-icm\u0022, \u0022service_name\u0022: \u0022sap-icm\u0022, \u0022risk_score\u0022: 47}, \u0022payload_preview\u0022: \u0022GET \/api\/v1\/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8000\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\\r\u0022, \u0022request_sample\u0022: \u0022GET \/api\/v1\/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8000\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip, deflate, br, zstd\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/v1\/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8000\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022GET \/api\/v1\/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8000\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip, deflate, br, zstd\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/api\/v1\/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8000\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022a40a4441bf81efc9304771a3302a405188d9900e\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022GET \/api\/v1\/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8000\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\u0022, \u0022port\u0022: 8000, \u0022service\u0022: \u0022sap-icm\u0022, \u0022service_label_fr\u0022: \u0022SAP ICM\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/api\/v1\/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8000\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via SAP ICM:8000 \u00b7 (reconnaissance)\u0022, \u0022target_port_label\u0022: \u00228000 \u00b7 SAP ICM\u0022, \u0022emulator_service\u0022: \u0022sap-icm\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 47\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SAP ICM \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 48.0, \u0022novelty\u0022: 25.0, \u0022risk_score\u0022: 47, \u0022correlation_boost\u0022: 18}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 47, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022sap-icm\u0022, \u0022service_label_fr\u0022: \u0022SAP ICM\u0022, \u0022dst_port\u0022: 8000, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-sap-icm\u0022, \u0022correlation_flags\u0022: [\u0022scan_rapide\u0022, \u0022campagne_ports\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Scan rapide multi-ports\u0022, \u0022Campagne multi-ports\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +18\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022GET \/api\/v1\/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8000\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\u0022, \u0022port\u0022: 8000, \u0022service\u0022: \u0022sap-icm\u0022, \u0022service_label_fr\u0022: \u0022SAP ICM\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via SAP ICM:8000 \u00b7 (reconnaissance)\u0022, \u0022evidence_snippet\u0022: \u0022GET \/api\/v1\/ HTTP\/1.1\\r\\nHost: 62.3.50.33:8000\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\u0022, \u0022target_port_label\u0022: \u00228000 \u00b7 SAP ICM\u0022, \u0022emulator_service\u0022: \u0022sap-icm\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 5 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +18\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022sap_icm\u0022, \u0022service_banner\u0022: \u0022honeypot-sap-icm\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228000\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 6, \u0022port_scan_ports_sample\u0022: [3000, 5000, 8000, 8008, 8080, 8081], \u0022rapid_port_scan\u0022: true, \u0022rapid_scan_distinct_ports\u0022: 3, \u0022scan_velocity_ports_per_s\u0022: 30.0, \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022sap-icm\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022rapid_port_scan\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 18, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022http_get_probe\u0022, \u0022mozi_pattern\u0022, \u0022net_sap_web_probe\u0022, \u0022sap_icm_emulated\u0022, \u0022sap_icm_payload\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_get_probe\u0022, \u0022mozi_pattern\u0022, \u0022net_sap_web_probe\u0022, \u0022sap_icm_emulated\u0022, \u0022sap_icm_payload\u0022]","anomalies":"[]","severity":7,"bytes_in":192},{"id":13898294,"ip":"13.140.200.70","ts":"2026-11-06 05:03:56.000000","proto":"tcp","src_port":36716,"dst_port":5000,"service":"http","classification":"port_scan_syn","waf_score":13,"waf_tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022]","http_method":"GET","http_target":"\/docs","sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a205765726b7a6575672f332e302e3120507974686f6e2f332e31320d0a436f6e74656e742d547970653a20746578742f68746d6c0d0a436f6e74656e742d4c656e6774683a2035380d0a0d0a3c21646f63747970652068746d6c3e3c7469746c653e466c61736b3c\u0022, \u0022emulator_response_len\u0022: 158, \u0022http_header_count\u0022: 5, \u0022http_query_params\u0022: 0, \u0022http_path_depth\u0022: 1, \u0022http_path_ext\u0022: null, \u0022http_ua_hash\u0022: \u002262135c89cfc57ad1cd1215aa151c8e89d70dd9e0\u0022, \u0022http_host_hash\u0022: \u0022b3fecad1903fbad7bf672cc5a25c971b97553846\u0022, \u0022http_target_hash\u0022: \u00221baff95c2d0e31059720a3716ad5b5a34b61a207\u0022, \u0022http_referer_hash\u0022: null, \u0022http_method\u0022: \u0022GET\u0022, \u0022http_ua_is_cli\u0022: false, \u0022http_ua_is_browser\u0022: true, \u0022bytes_in\u0022: 189, \u0022payload_entropy\u0022: 5.357239203624471, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022service\u0022: \u0022http\u0022, \u0022app_proto\u0022: \u0022http\u0022, \u0022asn\u0022: 51167, \u0022country\u0022: \u0022FR\u0022, \u0022dst_port\u0022: 5000, \u0022risk_waf\u0022: 60.0, \u0022risk_classification\u0022: 64.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.5, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 60.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 44, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u00221e51b1a6ebaa068d5d6711d2d4024983fa0fa384\u0022, \u0022event_fingerprint\u0022: \u0022144f670592051f04d93f95b110d1a8ff1c543ebc\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 293, \u0022precision_signals\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 60.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 44, \u0022correlation_boost\u0022: 14}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022FR\u0022, \u0022asn\u0022: 51167, \u0022org\u0022: \u0022Contabo GmbH\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022http_ua_hash\u0022: \u00226034df114244a52a96c79625492287ec\u0022, \u0022payload_hash\u0022: \u0022bfc3f984481ee341d4f0f6dfd3af692f\u0022, \u0022path_pattern_hash\u0022: \u0022a2557b8d5a9637c813b7d4a0495197d3\u0022}, \u0022target_context\u0022: {\u0022dst_port\u0022: 5000, \u0022service\u0022: \u0022http\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022risk_score\u0022: 44}, \u0022payload_preview\u0022: \u0022GET \/docs HTTP\/1.1\\r\\nHost: 62.3.50.33:5000\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAc\u0022, \u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/docs\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/docs HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/docs HTTP\/1.1\\r\\nHost: 62.3.50.33:5000\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip, deflate, br, zstd\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/docs HTTP\/1.1\\r\\nHost: 62.3.50.33:5000\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAc\u0022, \u0022evidence\u0022: {\u0022method\u0022: \u0022GET\u0022, \u0022path\u0022: \u0022\/docs\u0022, \u0022user_agent\u0022: \u0022Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\u0022, \u0022waf_tags\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022], \u0022waf_rule_names\u0022: [\u0022rce-0\u0022, \u0022nosqli-3\u0022], \u0022request_line\u0022: \u0022GET \/docs HTTP\/1.1\u0022, \u0022request_sample\u0022: \u0022GET \/docs HTTP\/1.1\\r\\nHost: 62.3.50.33:5000\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAccept-Encoding: gzip, deflate, br, zstd\\r\\nConnection: close\\r\\n\\r\\n\u0022, \u0022payload_snippet\u0022: \u0022GET \/docs HTTP\/1.1\\r\\nHost: 62.3.50.33:5000\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAc\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022mitre_tactics\u0022: [\u0022TA0043\u0022], \u0022mitre_techniques\u0022: [\u0022T1046\u0022], \u0022mitre\u0022: \u0022T1046\u0022, \u0022threat_family\u0022: [\u0022scanner\u0022], \u0022recommended_client_action\u0022: \u0022monitor\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022e36aefa41712151c50e286df8740798b54c77703\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/docs\u0022, \u0022request_line\u0022: \u0022GET \/docs HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\u0022, \u0022port\u0022: 5000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022evidence_snippet\u0022: \u0022GET \/docs HTTP\/1.1\\r\\nHost: 62.3.50.33:5000\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAc\u0022, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:5000 \u00b7 (reconnaissance) \u00b7 \u2192 \/docs\u0022, \u0022target_port_label\u0022: \u00225000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab port_scan_syn \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 44\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via HTTP \u2014 multi-protocole (2 protocoles \u00b7 5 min)\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 60.0, \u0022classification\u0022: 64.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 44, \u0022correlation_boost\u0022: 14}, \u0022attack_stage\u0022: \u0022recon\u0022, \u0022attack_stage_label\u0022: \u0022Reconnaissance\u0022, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Reconnaissance\u0022, \u0022risk_score\u0022: 44, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022, \u0022dst_port\u0022: 5000, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022INT-beh-scan-burst\u0022, \u0022INT-beh-multi-port-60s\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1046\u0022, \u0022SIGMA-net-port-scan\u0022, \u0022Beh Scan Burst\u0022, \u0022Beh Multi Port 60S\u0022], \u0022recommended_action\u0022: \u0022monitor\u0022, \u0022recommended_action_label\u0022: \u0022Surveiller\u0022, \u0022mitre\u0022: \u0022T1046\u0022, \u0022mitre_technique\u0022: \u0022T1046\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-http\u0022, \u0022correlation_flags\u0022: [\u0022campagne_ports\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_flags_labels_fr\u0022: [\u0022Campagne multi-ports\u0022, \u0022Multi-protocole corr\u00e9l\u00e9 (5 min)\u0022], \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: \u0022Corr\u00e9lation +14\u0022, \u0022protocol_details\u0022: {\u0022http_method\u0022: \u0022GET\u0022, \u0022http_path\u0022: \u0022\/docs\u0022, \u0022request_line\u0022: \u0022GET \/docs HTTP\/1.1\u0022, \u0022http_user_agent\u0022: \u0022Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\u0022, \u0022port\u0022: 5000, \u0022service\u0022: \u0022http\u0022, \u0022service_label_fr\u0022: \u0022HTTP\u0022}, \u0022attack_vector\u0022: \u0022port scan syn \u00b7 via HTTP:5000 \u00b7 (reconnaissance) \u00b7 \u2192 \/docs\u0022, \u0022evidence_snippet\u0022: \u0022GET \/docs HTTP\/1.1\\r\\nHost: 62.3.50.33:5000\\r\\nUser-Agent: Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36\\r\\nAccept: *\/*\\r\\nAc\u0022, \u0022target_port_label\u0022: \u00225000 \u00b7 HTTP\u0022, \u0022emulator_service\u0022: \u0022http\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 2 tag(s) WAF\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 60 \u00b7 Bonus corr\u00e9lation +14 \u00b7 2 tag(s) WAF\u0022, \u0022campaign_hint_fr\u0022: \u0022Campagne multi-ports d\u00e9tect\u00e9e sur une fen\u00eatre courte\u0022, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022reconnaissance\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022http\u0022, \u0022service_banner\u0022: \u0022honeypot-http\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00225000\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022port_scan_campaign\u0022: true, \u0022port_scan_distinct_ports\u0022: 6, \u0022port_scan_ports_sample\u0022: [3000, 5000, 8000, 8008, 8080, 8081], \u0022multi_protocol_correlation\u0022: true, \u0022multi_protocol_count\u0022: 2, \u0022multi_protocol_sample\u0022: [\u0022http\u0022, \u0022sap-icm\u0022], \u0022multi_protocol_window_s\u0022: 300, \u0022behavior_alerts\u0022: [\u0022port_scan_campaign\u0022, \u0022multi_protocol_correlation\u0022], \u0022correlation_confidence_boost\u0022: 14, \u0022attack_chain_stage\u0022: \u0022reconnaissance\u0022, \u0022matched_patterns\u0022: [], \u0022ban_policy\u0022: \u0022advisory_monitor\u0022, \u0022tags_list\u0022: [\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022net_web_probe\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":"HTTP\/1.1","http_host":"62.3.50.33:5000","http_user_agent":"Mozilla\/5.0 (X11; Linux x86_64) Chrome\/124 Safari\/537.36","http_referer":null,"tags":"[\u0022950326:rce-0\u0022, \u0022950470:nosqli-3\u0022, \u0022net_web_probe\u0022]","anomalies":"[]","severity":7,"bytes_in":189}],"total_events":93}