130.12.182.98

{
    "bytes_in": 9,
    "payload_entropy": 1.4466166676282082,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": null,
    "app_proto": null,
    "asn": 197769,
    "country": "SI",
    "dst_port": 3755,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 24,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "a459b06bc6020f3507b843137d1957aea61c8203",
    "event_fingerprint": "4e760de754a3def141e42000f34ed9fc852b7105",
    "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0.08,
    "classification_confidence": 0.08,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 24,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6266f12abef0bbe34ce5d154de5a6068",
        "path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
    },
    "target_context": {
        "dst_port": 3755,
        "risk_score": 24
    },
    "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "request_sample": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "payload_snippet": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "evidence": {
        "request_sample": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "payload_snippet": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "ced3abd4c68d56e56203f358d3f45140cd4be3bd",
    "protocol_details": {
        "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "port": 3755
    },
    "evidence_snippet": "\ufffd",
    "attack_vector": "proxy probe \u00b7 port 3755 \u00b7 (sonde \/ probe)",
    "target_port_label": "3755",
    "confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 8,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 24,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 24,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 3755,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
            "port": 3755
        },
        "attack_vector": "proxy probe \u00b7 port 3755 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd",
        "target_port_label": "3755",
        "emulator_service": null,
        "confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "3755"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "http",
        "port:11324",
        "port:3755"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "socks4_greeting"
    ],
    "asn_dc_heuristic": true
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": null,
    "app_proto": null,
    "asn": 197769,
    "country": "SI",
    "dst_port": 3755,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 33,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "d415c26a776c6f3784473549943fd5741102b707",
    "event_fingerprint": "df8adf7f3740c1146e5296c554e17c6c8b19e7e9",
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0.08,
    "classification_confidence": 0.08,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 33,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 3755,
        "risk_score": 33
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "49af8d3af26e9e5684d94f5996c97e8415ba95a8",
    "protocol_details": {
        "port": 3755
    },
    "attack_vector": "Sonde port \u00b7 port 3755 \u00b7 (sonde \/ probe)",
    "target_port_label": "3755",
    "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 33\/100",
        "confidence_pct": 8,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 33,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 33,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 3755,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "port": 3755
        },
        "attack_vector": "Sonde port \u00b7 port 3755 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "3755",
        "emulator_service": null,
        "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
        "confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "3755"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "http",
        "port:11324",
        "port:3755"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true
}

{
    "http_header_count": 1,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "1:443",
    "http_ua_hash": null,
    "http_host_hash": "409629a08b9b3f3be610b8832cc28822f964410f",
    "http_target_hash": "5850ce82c78a3e186a6478d03d6f62e37ab9fa44",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 47,
    "payload_entropy": 3.912028011761936,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 197769,
    "country": "SI",
    "dst_port": 11324,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 0
    },
    "risk_score": 40,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "c1d4f3bf5c3235fbe5100656bb281c9f652a1702",
    "event_fingerprint": "cf80f2a21ab82c23413b1c3712bbe0db6f8779b5",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "eca058040bfea8cad9218ced7d8b12d9",
        "path_pattern_hash": "d517fa0b3424c1ce3eedeabc3acb2cb4"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 11324,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
    "method": "CONNECT",
    "path": "1.1.1.1:443",
    "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
    "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
    "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
    "evidence": {
        "method": "CONNECT",
        "path": "1.1.1.1:443",
        "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
        "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
        "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 0,
        "risk_score": 40,
        "correlation_boost": 8
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.82,
    "classification_confidence": 0.82,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "025b65b361d07ee4e54f33f3d81f1a309beedcaf",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "1.1.1.1:443",
        "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
        "port": 11324,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:11324 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443",
    "target_port_label": "11324 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 82,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 40,
            "protocol": 35,
            "novelty": 0,
            "risk_score": 40,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 11324,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "1.1.1.1:443",
            "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
            "port": 11324,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:11324 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443",
        "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
        "target_port_label": "11324 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "11324"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:11324"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua"
    ],
    "asn_dc_heuristic": true
}

{
    "bytes_in": 9,
    "payload_entropy": 1.4466166676282082,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": null,
    "app_proto": null,
    "asn": 197769,
    "country": "SI",
    "dst_port": 11324,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 24,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "dd1b62711575e879ec7f9ea71a0e68cf2fb8d7f7",
    "event_fingerprint": "0e0405fd426c9f943431b715aba55d314cedf899",
    "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 24
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6266f12abef0bbe34ce5d154de5a6068",
        "path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
    },
    "target_context": {
        "dst_port": 11324,
        "risk_score": 24
    },
    "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "request_sample": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "payload_snippet": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "evidence": {
        "request_sample": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "payload_snippet": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3c570eb727ff3fe7de4889d27cd42df2b29265ac",
    "protocol_details": {
        "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "port": 11324
    },
    "evidence_snippet": "\ufffd",
    "attack_vector": "proxy probe \u00b7 port 11324 \u00b7 (sonde \/ probe)",
    "target_port_label": "11324",
    "confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 24
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 24,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 11324,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
            "port": 11324
        },
        "attack_vector": "proxy probe \u00b7 port 11324 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd",
        "target_port_label": "11324",
        "emulator_service": null,
        "confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "11324"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "socks4_greeting"
    ],
    "asn_dc_heuristic": true
}

{
    "bytes_in": 4,
    "payload_entropy": 1.5,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": null,
    "app_proto": null,
    "asn": 197769,
    "country": "SI",
    "dst_port": 11324,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "cf0d7f60530bafff8a7c82b10fe5279958fb52b0",
    "event_fingerprint": "d7bc131505ffcf00bb86bf5af8d1cfff3e901cf4",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8",
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 11324,
        "risk_score": 44
    },
    "payload_preview": "\u0005\u0002\u0000\u0002",
    "request_sample": "\u0005\u0002\u0000\u0002",
    "payload_snippet": "\u0005\u0002\u0000\u0002",
    "evidence": {
        "request_sample": "\u0005\u0002\u0000\u0002",
        "payload_snippet": "\u0005\u0002\u0000\u0002",
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c22da497d6fd809899e427989e7a70b6888660a2",
    "protocol_details": {
        "payload_preview": "\u0005\u0002\u0000\u0002",
        "port": 11324
    },
    "attack_vector": "Sonde port \u00b7 port 11324 \u00b7 (sonde \/ probe)",
    "target_port_label": "11324",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 11324,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0005\u0002\u0000\u0002",
            "port": 11324
        },
        "attack_vector": "Sonde port \u00b7 port 11324 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "11324",
        "emulator_service": null,
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "11324"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": null,
    "app_proto": null,
    "asn": 197769,
    "country": "SI",
    "dst_port": 11324,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "cf0d7f60530bafff8a7c82b10fe5279958fb52b0",
    "event_fingerprint": "d7bc131505ffcf00bb86bf5af8d1cfff3e901cf4",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 11324,
        "risk_score": 44
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "4ede4c4b1ac0726af0cad0a25a2b75e7d5c3044d",
    "protocol_details": {
        "port": 11324
    },
    "attack_vector": "Sonde port \u00b7 port 11324 \u00b7 (sonde \/ probe)",
    "target_port_label": "11324",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 11324,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "port": 11324
        },
        "attack_vector": "Sonde port \u00b7 port 11324 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "11324",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "11324"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true
}

{
    "http_header_count": 1,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "1:443",
    "http_ua_hash": null,
    "http_host_hash": "409629a08b9b3f3be610b8832cc28822f964410f",
    "http_target_hash": "5850ce82c78a3e186a6478d03d6f62e37ab9fa44",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 47,
    "payload_entropy": 3.912028011761936,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 197769,
    "country": "SI",
    "dst_port": 11324,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 2.5,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 0
    },
    "risk_score": 40,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "c1d4f3bf5c3235fbe5100656bb281c9f652a1702",
    "event_fingerprint": "cf80f2a21ab82c23413b1c3712bbe0db6f8779b5",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "eca058040bfea8cad9218ced7d8b12d9",
        "path_pattern_hash": "d517fa0b3424c1ce3eedeabc3acb2cb4"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 11324,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
    "method": "CONNECT",
    "path": "1.1.1.1:443",
    "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
    "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
    "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
    "evidence": {
        "method": "CONNECT",
        "path": "1.1.1.1:443",
        "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
        "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
        "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 0,
        "risk_score": 40,
        "correlation_boost": 8
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.82,
    "classification_confidence": 0.82,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "025b65b361d07ee4e54f33f3d81f1a309beedcaf",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "1.1.1.1:443",
        "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
        "port": 11324,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:11324 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443",
    "target_port_label": "11324 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 82,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 40,
            "protocol": 35,
            "novelty": 0,
            "risk_score": 40,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 11324,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "1.1.1.1:443",
            "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
            "port": 11324,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:11324 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443",
        "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
        "target_port_label": "11324 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "11324"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "http",
        "port:11324",
        "port:3755"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua"
    ],
    "asn_dc_heuristic": true
}

{
    "bytes_in": 4,
    "payload_entropy": 1.5,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": null,
    "app_proto": null,
    "asn": 197769,
    "country": "SI",
    "dst_port": 11324,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "cf0d7f60530bafff8a7c82b10fe5279958fb52b0",
    "event_fingerprint": "d7bc131505ffcf00bb86bf5af8d1cfff3e901cf4",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44,
        "correlation_boost": 8
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8",
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 11324,
        "risk_score": 44
    },
    "payload_preview": "\u0005\u0002\u0000\u0002",
    "request_sample": "\u0005\u0002\u0000\u0002",
    "payload_snippet": "\u0005\u0002\u0000\u0002",
    "evidence": {
        "request_sample": "\u0005\u0002\u0000\u0002",
        "payload_snippet": "\u0005\u0002\u0000\u0002",
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "c22da497d6fd809899e427989e7a70b6888660a2",
    "protocol_details": {
        "payload_preview": "\u0005\u0002\u0000\u0002",
        "port": 11324
    },
    "attack_vector": "Sonde port \u00b7 port 11324 \u00b7 (sonde \/ probe)",
    "target_port_label": "11324",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 11324,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0005\u0002\u0000\u0002",
            "port": 11324
        },
        "attack_vector": "Sonde port \u00b7 port 11324 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "11324",
        "emulator_service": null,
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "11324"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "http",
        "port:11324",
        "port:3755"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true
}

{
    "bytes_in": 9,
    "payload_entropy": 1.4466166676282082,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": null,
    "app_proto": null,
    "asn": 197769,
    "country": "SI",
    "dst_port": 11324,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 24,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "dd1b62711575e879ec7f9ea71a0e68cf2fb8d7f7",
    "event_fingerprint": "0e0405fd426c9f943431b715aba55d314cedf899",
    "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0.08,
    "classification_confidence": 0.08,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 24,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6266f12abef0bbe34ce5d154de5a6068",
        "path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
    },
    "target_context": {
        "dst_port": 11324,
        "risk_score": 24
    },
    "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "request_sample": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "payload_snippet": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "evidence": {
        "request_sample": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "payload_snippet": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3c570eb727ff3fe7de4889d27cd42df2b29265ac",
    "protocol_details": {
        "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "port": 11324
    },
    "evidence_snippet": "\ufffd",
    "attack_vector": "proxy probe \u00b7 port 11324 \u00b7 (sonde \/ probe)",
    "target_port_label": "11324",
    "confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 8,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 24,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 24,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 11324,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
            "port": 11324
        },
        "attack_vector": "proxy probe \u00b7 port 11324 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd",
        "target_port_label": "11324",
        "emulator_service": null,
        "confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
        "confidence_factors_fr": "Confiance 8 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "11324"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "http",
        "port:11324",
        "port:3755"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "socks4_greeting"
    ],
    "asn_dc_heuristic": true
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": null,
    "app_proto": null,
    "asn": 197769,
    "country": "SI",
    "dst_port": 11324,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.4,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "cf0d7f60530bafff8a7c82b10fe5279958fb52b0",
    "event_fingerprint": "d7bc131505ffcf00bb86bf5af8d1cfff3e901cf4",
    "classification_confidence": 0.58,
    "confidence": 0.58,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44,
        "correlation_boost": 8
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 11324,
        "risk_score": 44
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "4ede4c4b1ac0726af0cad0a25a2b75e7d5c3044d",
    "protocol_details": {
        "port": 11324
    },
    "attack_vector": "Sonde port \u00b7 port 11324 \u00b7 (sonde \/ probe)",
    "target_port_label": "11324",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 58,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 11324,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "port": 11324
        },
        "attack_vector": "Sonde port \u00b7 port 11324 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "11324",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 58 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "11324"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 3,
    "multi_protocol_sample": [
        "http",
        "port:11324",
        "port:3755"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true
}

{
    "bytes_in": 9,
    "payload_entropy": 1.4466166676282082,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": null,
    "app_proto": null,
    "asn": 197769,
    "country": "SI",
    "dst_port": 3755,
    "risk_waf": 8,
    "risk_classification": 32,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 24,
    "tag_count": 1,
    "anomaly_count": 0,
    "campaign_key": "a459b06bc6020f3507b843137d1957aea61c8203",
    "event_fingerprint": "4e760de754a3def141e42000f34ed9fc852b7105",
    "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 32,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 24
    },
    "named_classification_skipped": false,
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6266f12abef0bbe34ce5d154de5a6068",
        "path_pattern_hash": "b6d4fb956dc4d23d1c2c3eccd7f8e7e3"
    },
    "target_context": {
        "dst_port": 3755,
        "risk_score": 24
    },
    "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "request_sample": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "payload_snippet": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
    "evidence": {
        "request_sample": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "payload_snippet": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "ced3abd4c68d56e56203f358d3f45140cd4be3bd",
    "protocol_details": {
        "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
        "port": 3755
    },
    "evidence_snippet": "\ufffd",
    "attack_vector": "proxy probe \u00b7 port 3755 \u00b7 (sonde \/ probe)",
    "target_port_label": "3755",
    "confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab proxy_probe \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 32,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 24
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 24,
        "risk_label": "Faible",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 3755,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "payload_preview": "\u0004\u0001\u0001\ufffd\u0001\u0001\u0001\u0001\u0000",
            "port": 3755
        },
        "attack_vector": "proxy probe \u00b7 port 3755 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "\ufffd",
        "target_port_label": "3755",
        "emulator_service": null,
        "confidence_reason": "Confiance 0 % \u2014 1 signal(aux) capteur",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "3755"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "socks4_greeting"
    ],
    "asn_dc_heuristic": true
}

{
    "http_header_count": 1,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "1:443",
    "http_ua_hash": null,
    "http_host_hash": "409629a08b9b3f3be610b8832cc28822f964410f",
    "http_target_hash": "5850ce82c78a3e186a6478d03d6f62e37ab9fa44",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 47,
    "payload_entropy": 3.912028011761936,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 197769,
    "country": "SI",
    "dst_port": 3755,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 35,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 1.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 0
    },
    "risk_score": 40,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "512c8fe5a890946e4196d7cbb1dd93c0bc9a805c",
    "event_fingerprint": "a287e6f415f9c31bf352741b29404781017591cc",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "eca058040bfea8cad9218ced7d8b12d9",
        "path_pattern_hash": "d517fa0b3424c1ce3eedeabc3acb2cb4"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 3755,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
    "method": "CONNECT",
    "path": "1.1.1.1:443",
    "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
    "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
    "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
    "evidence": {
        "method": "CONNECT",
        "path": "1.1.1.1:443",
        "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
        "request_sample": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1\r\n\r\n",
        "payload_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 35,
        "novelty": 0,
        "risk_score": 40,
        "correlation_boost": 8
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.82,
    "classification_confidence": 0.82,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "cf52afd05391825b7f0919a28c552910cfb89a90",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "1.1.1.1:443",
        "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
        "port": 3755,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:3755 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443",
    "target_port_label": "3755 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 74%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 82,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 40,
            "protocol": 35,
            "novelty": 0,
            "risk_score": 40,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 3755,
        "protocol_emulated": null,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "1.1.1.1:443",
            "request_line": "CONNECT 1.1.1.1:443 HTTP\/1.1",
            "port": 3755,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:3755 \u00b7 (sonde \/ probe) \u00b7 \u2192 1.1.1.1:443",
        "evidence_snippet": "CONNECT 1.1.1.1:443 HTTP\/1.0\r\nHost: 1.1.1.1",
        "target_port_label": "3755 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 74 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 82 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "3755"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "port:3755"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua"
    ],
    "asn_dc_heuristic": true
}

{
    "bytes_in": 4,
    "payload_entropy": 1.5,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": null,
    "app_proto": null,
    "asn": 197769,
    "country": "SI",
    "dst_port": 3755,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "d415c26a776c6f3784473549943fd5741102b707",
    "event_fingerprint": "df8adf7f3740c1146e5296c554e17c6c8b19e7e9",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "pat-0554"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "6ce5e83bce8f65c890fae2bc4bd3a7a8",
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 3755,
        "risk_score": 44
    },
    "payload_preview": "\u0005\u0002\u0000\u0002",
    "request_sample": "\u0005\u0002\u0000\u0002",
    "payload_snippet": "\u0005\u0002\u0000\u0002",
    "evidence": {
        "request_sample": "\u0005\u0002\u0000\u0002",
        "payload_snippet": "\u0005\u0002\u0000\u0002",
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6d9302905aad8b7923cecd569b969eec12309516",
    "protocol_details": {
        "payload_preview": "\u0005\u0002\u0000\u0002",
        "port": 3755
    },
    "attack_vector": "Sonde port \u00b7 port 3755 \u00b7 (sonde \/ probe)",
    "target_port_label": "3755",
    "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 3755,
        "protocol_emulated": null,
        "tags_summary": [
            "pat-0554"
        ],
        "tags_summary_labels_fr": [
            "pat-0554"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "\u0005\u0002\u0000\u0002",
            "port": 3755
        },
        "attack_vector": "Sonde port \u00b7 port 3755 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "3755",
        "emulator_service": null,
        "confidence_reason": "Confiance 50 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "3755"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true
}

{
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": null,
    "app_proto": null,
    "asn": 197769,
    "country": "SI",
    "dst_port": 3755,
    "risk_waf": 8,
    "risk_classification": 48,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 0,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 0.6,
    "risk_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0
    },
    "risk_score": 44,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "d415c26a776c6f3784473549943fd5741102b707",
    "event_fingerprint": "df8adf7f3740c1146e5296c554e17c6c8b19e7e9",
    "classification_confidence": 0.5,
    "confidence": 0.5,
    "precision_signals": [
        "INT-FP-port-probe-noise",
        "INT-single-port"
    ],
    "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 48,
        "behavior": 0,
        "geo": 40,
        "protocol": 0,
        "novelty": 0,
        "risk_score": 44
    },
    "risk_confidence_factor": 50,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "49ebffbc8eed300cf9429db1ba4cf66d"
    },
    "target_context": {
        "dst_port": 3755,
        "risk_score": 44
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "49af8d3af26e9e5684d94f5996c97e8415ba95a8",
    "protocol_details": {
        "port": 3755
    },
    "attack_vector": "Sonde port \u00b7 port 3755 \u00b7 (sonde \/ probe)",
    "target_port_label": "3755",
    "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "classification_reason_label_fr": "Type \u00ab port_probe \u00bb (signaux protocolaires) \u00b7 confiance 50%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 44\/100",
        "confidence_pct": 50,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 48,
            "behavior": 0,
            "geo": 40,
            "protocol": 0,
            "novelty": 0,
            "risk_score": 44
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 44,
        "risk_label": "Moyen",
        "service_name": null,
        "service_label_fr": null,
        "dst_port": 3755,
        "protocol_emulated": null,
        "tags_summary": [
            "INT-FP-port-probe-noise",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "Fp Port Probe Noise",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "port": 3755
        },
        "attack_vector": "Sonde port \u00b7 port 3755 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "3755",
        "emulator_service": null,
        "confidence_reason": "Confiance mod\u00e9r\u00e9e (50 %) \u2014 signal principal unique",
        "confidence_factors_fr": "Confiance 50 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "generic",
        "service_banner": "honeypot",
        "service_os": "linux",
        "dst_port": "3755"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "splunk-hec",
    "app_proto": "splunk-hec",
    "asn": 197769,
    "country": "SI",
    "dst_port": 8889,
    "risk_waf": 8,
    "risk_classification": 0,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 22,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 40,
        "protocol": 22,
        "novelty": 0
    },
    "risk_score": 2,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "b14acd2a8dc0382bfe05a3c819a0ec2a86f38315",
    "event_fingerprint": "714a7f33a66a9fd197795d3501d25b4e27e582d3",
    "classification_reason": "Type \u00ab splunk-hec \u00bb (signaux protocolaires) \u00b7 confiance 0%",
    "confidence": 0,
    "classification_confidence": 0,
    "precision_score": 0,
    "precision_signals": [],
    "kb_rule_ids": [],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 0,
        "behavior": 0,
        "geo": 40,
        "protocol": 22,
        "novelty": 0,
        "risk_score": 2
    },
    "named_classification_skipped": false,
    "service_name": "splunk-hec",
    "risk_confidence_factor": 0,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "d465d01b5922f4732130a3af79309a94"
    },
    "target_context": {
        "dst_port": 8889,
        "service": "splunk-hec",
        "service_name": "splunk-hec",
        "risk_score": 2
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "unknown"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "841a47586b72c058e68d6154f46376eb451784d4",
    "protocol_details": {
        "port": 8889,
        "service": "splunk-hec",
        "service_label_fr": "SPLUNK HEC"
    },
    "attack_vector": "splunk-hec \u00b7 via SPLUNK HEC:8889 \u00b7 (sonde \/ probe)",
    "target_port_label": "8889 \u00b7 SPLUNK HEC",
    "emulator_service": "splunk-hec",
    "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab splunk-hec \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "classification_reason_label_fr": "Type \u00ab splunk-hec \u00bb (signaux protocolaires) \u00b7 confiance 0%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte",
        "confidence_pct": 0,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 0,
            "behavior": 0,
            "geo": 40,
            "protocol": 22,
            "novelty": 0,
            "risk_score": 2
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 2,
        "risk_label": "Faible",
        "service_name": "splunk-hec",
        "service_label_fr": "SPLUNK HEC",
        "dst_port": 8889,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-splunk-hec",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "port": 8889,
            "service": "splunk-hec",
            "service_label_fr": "SPLUNK HEC"
        },
        "attack_vector": "splunk-hec \u00b7 via SPLUNK HEC:8889 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "8889 \u00b7 SPLUNK HEC",
        "emulator_service": "splunk-hec",
        "confidence_reason": "Confiance faible (0 %) \u2014 classification prudente",
        "confidence_factors_fr": null,
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "splunk_hec",
        "service_banner": "honeypot-splunk-hec",
        "service_os": "linux",
        "dst_port": "8889"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "98:80",
    "http_ua_hash": null,
    "http_host_hash": "47ff1c54158454896ce0c029bfa7ac9397ab6a7a",
    "http_target_hash": "47ff1c54158454896ce0c029bfa7ac9397ab6a7a",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 108,
    "payload_entropy": 5.220954604730613,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 197769,
    "country": "SI",
    "dst_port": 8889,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "1302b249ff52abcdd8ecd74296e5a1540da29ed5",
    "event_fingerprint": "e9a7b8509f5ab1edb27a85f77ef2ae8b0025df06",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "7ec79b28973de642cab869eee15d9a70",
        "path_pattern_hash": "6dea86b00adf6715f6c6c1e11db802e4"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 8889,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic dGhvbWFzOjEyMzQ1Ng==\r\n",
    "method": "CONNECT",
    "path": "130.12.182.98:80",
    "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
    "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic dGhvbWFzOjEyMzQ1Ng==\r\n",
    "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic dGhvbWFzOjEyMzQ1Ng==",
    "evidence": {
        "method": "CONNECT",
        "path": "130.12.182.98:80",
        "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
        "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic dGhvbWFzOjEyMzQ1Ng==\r\n",
        "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic dGhvbWFzOjEyMzQ1Ng==",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 40
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "0da524bbfc611d0130af8d9045af39da5a54e293",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "130.12.182.98:80",
        "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
        "port": 8889,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic dGhvbWFzOjEyMzQ1Ng==",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.98:80",
    "target_port_label": "8889 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8889,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "130.12.182.98:80",
            "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
            "port": 8889,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.98:80",
        "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic dGhvbWFzOjEyMzQ1Ng==",
        "target_port_label": "8889 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8889"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua",
        "net_web_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "98:80",
    "http_ua_hash": null,
    "http_host_hash": "47ff1c54158454896ce0c029bfa7ac9397ab6a7a",
    "http_target_hash": "47ff1c54158454896ce0c029bfa7ac9397ab6a7a",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 104,
    "payload_entropy": 5.168552820283871,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 197769,
    "country": "SI",
    "dst_port": 8889,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "1302b249ff52abcdd8ecd74296e5a1540da29ed5",
    "event_fingerprint": "e9a7b8509f5ab1edb27a85f77ef2ae8b0025df06",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "7be3028028bef9526a7e6f5e35e22824",
        "path_pattern_hash": "6dea86b00adf6715f6c6c1e11db802e4"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 8889,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDphYmNkZWZn\r\n",
    "method": "CONNECT",
    "path": "130.12.182.98:80",
    "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
    "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDphYmNkZWZn\r\n",
    "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDphYmNkZWZn",
    "evidence": {
        "method": "CONNECT",
        "path": "130.12.182.98:80",
        "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
        "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDphYmNkZWZn\r\n",
        "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDphYmNkZWZn",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 40
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "fa4062d3a7a3119c0b6c6cfa4bbd65f383891676",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "130.12.182.98:80",
        "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
        "port": 8889,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDphYmNkZWZn",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.98:80",
    "target_port_label": "8889 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8889,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "130.12.182.98:80",
            "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
            "port": 8889,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.98:80",
        "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDphYmNkZWZn",
        "target_port_label": "8889 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8889"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua",
        "net_web_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "98:80",
    "http_ua_hash": null,
    "http_host_hash": "47ff1c54158454896ce0c029bfa7ac9397ab6a7a",
    "http_target_hash": "47ff1c54158454896ce0c029bfa7ac9397ab6a7a",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 108,
    "payload_entropy": 5.1376540267458966,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 197769,
    "country": "SI",
    "dst_port": 8889,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "1302b249ff52abcdd8ecd74296e5a1540da29ed5",
    "event_fingerprint": "e9a7b8509f5ab1edb27a85f77ef2ae8b0025df06",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "374f1c637ae6ab2a669d7b889f459b05",
        "path_pattern_hash": "6dea86b00adf6715f6c6c1e11db802e4"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 8889,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4xMjM=\r\n",
    "method": "CONNECT",
    "path": "130.12.182.98:80",
    "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
    "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4xMjM=\r\n",
    "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4xMjM=",
    "evidence": {
        "method": "CONNECT",
        "path": "130.12.182.98:80",
        "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
        "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4xMjM=\r\n",
        "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4xMjM=",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 40
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "d7d762db7ea1bdf07583497d0e56482e2745c7b6",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "130.12.182.98:80",
        "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
        "port": 8889,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4xMjM=",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.98:80",
    "target_port_label": "8889 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8889,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "130.12.182.98:80",
            "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
            "port": 8889,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.98:80",
        "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4xMjM=",
        "target_port_label": "8889 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8889"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua",
        "net_web_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "98:80",
    "http_ua_hash": null,
    "http_host_hash": "47ff1c54158454896ce0c029bfa7ac9397ab6a7a",
    "http_target_hash": "47ff1c54158454896ce0c029bfa7ac9397ab6a7a",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 128,
    "payload_entropy": 5.379381324737771,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 197769,
    "country": "SI",
    "dst_port": 8889,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "1302b249ff52abcdd8ecd74296e5a1540da29ed5",
    "event_fingerprint": "e9a7b8509f5ab1edb27a85f77ef2ae8b0025df06",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "fb73888b5b1840106173e57e79ab28b5",
        "path_pattern_hash": "6dea86b00adf6715f6c6c1e11db802e4"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 8889,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDoxMjNARWxtYXNzZWN1cml0eWNvbXBhbnk=\r\n",
    "method": "CONNECT",
    "path": "130.12.182.98:80",
    "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
    "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDoxMjNARWxtYXNzZWN1cml0eWNvbXBhbnk=\r\n",
    "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDoxMjNARWxtYXNzZWN1cml0eWNvbXBhbnk=",
    "evidence": {
        "method": "CONNECT",
        "path": "130.12.182.98:80",
        "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
        "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDoxMjNARWxtYXNzZWN1cml0eWNvbXBhbnk=\r\n",
        "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDoxMjNARWxtYXNzZWN1cml0eWNvbXBhbnk=",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 40
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "8e6b6519ccfa9832e7f83b299171edec92640168",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "130.12.182.98:80",
        "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
        "port": 8889,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDoxMjNARWxtYXNzZWN1cml0eWNvbXBhbnk=",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.98:80",
    "target_port_label": "8889 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8889,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "130.12.182.98:80",
            "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
            "port": 8889,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.98:80",
        "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDoxMjNARWxtYXNzZWN1cml0eWNvbXBhbnk=",
        "target_port_label": "8889 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8889"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua",
        "net_web_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "98:80",
    "http_ua_hash": null,
    "http_host_hash": "47ff1c54158454896ce0c029bfa7ac9397ab6a7a",
    "http_target_hash": "47ff1c54158454896ce0c029bfa7ac9397ab6a7a",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 130,
    "payload_entropy": 5.2540563030748295,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 197769,
    "country": "SI",
    "dst_port": 8889,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "1302b249ff52abcdd8ecd74296e5a1540da29ed5",
    "event_fingerprint": "e9a7b8509f5ab1edb27a85f77ef2ae8b0025df06",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "539950758533788cfc26b8a46dd69f65",
        "path_pattern_hash": "6dea86b00adf6715f6c6c1e11db802e4"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 8889,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDo4d3gzN2J0NTRid2U3NGdyY2I3cmdlc2Y=\r\n",
    "method": "CONNECT",
    "path": "130.12.182.98:80",
    "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
    "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDo4d3gzN2J0NTRid2U3NGdyY2I3cmdlc2Y=\r\n\r\n",
    "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDo4d3gzN2J0NTRid2U3NGdyY2I3cmdlc2Y=",
    "evidence": {
        "method": "CONNECT",
        "path": "130.12.182.98:80",
        "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
        "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDo4d3gzN2J0NTRid2U3NGdyY2I3cmdlc2Y=\r\n\r\n",
        "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDo4d3gzN2J0NTRid2U3NGdyY2I3cmdlc2Y=",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 40
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "6557f5d99e82086426d2ec2a28d0bb00220eb7e7",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "130.12.182.98:80",
        "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
        "port": 8889,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDo4d3gzN2J0NTRid2U3NGdyY2I3cmdlc2Y=",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.98:80",
    "target_port_label": "8889 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8889,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "130.12.182.98:80",
            "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
            "port": 8889,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.98:80",
        "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDo4d3gzN2J0NTRid2U3NGdyY2I3cmdlc2Y=",
        "target_port_label": "8889 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8889"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua",
        "net_web_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "98:80",
    "http_ua_hash": null,
    "http_host_hash": "47ff1c54158454896ce0c029bfa7ac9397ab6a7a",
    "http_target_hash": "47ff1c54158454896ce0c029bfa7ac9397ab6a7a",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 100,
    "payload_entropy": 5.074597411258848,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 197769,
    "country": "SI",
    "dst_port": 8889,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "1302b249ff52abcdd8ecd74296e5a1540da29ed5",
    "event_fingerprint": "e9a7b8509f5ab1edb27a85f77ef2ae8b0025df06",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "145d4531b3d0aa0f9afd810c4b07c860",
        "path_pattern_hash": "6dea86b00adf6715f6c6c1e11db802e4"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 8889,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic YXNhZDphc2Fk\r\n",
    "method": "CONNECT",
    "path": "130.12.182.98:80",
    "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
    "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic YXNhZDphc2Fk\r\n",
    "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic YXNhZDphc2Fk",
    "evidence": {
        "method": "CONNECT",
        "path": "130.12.182.98:80",
        "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
        "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic YXNhZDphc2Fk\r\n",
        "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic YXNhZDphc2Fk",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 40
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "55546193a49035c573e69d0a289cb6b22cc6ca20",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "130.12.182.98:80",
        "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
        "port": 8889,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic YXNhZDphc2Fk",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.98:80",
    "target_port_label": "8889 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8889,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "130.12.182.98:80",
            "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
            "port": 8889,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.98:80",
        "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic YXNhZDphc2Fk",
        "target_port_label": "8889 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8889"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua",
        "net_web_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "98:80",
    "http_ua_hash": null,
    "http_host_hash": "47ff1c54158454896ce0c029bfa7ac9397ab6a7a",
    "http_target_hash": "47ff1c54158454896ce0c029bfa7ac9397ab6a7a",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 108,
    "payload_entropy": 5.134039586694384,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 197769,
    "country": "SI",
    "dst_port": 8889,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 5.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "1302b249ff52abcdd8ecd74296e5a1540da29ed5",
    "event_fingerprint": "e9a7b8509f5ab1edb27a85f77ef2ae8b0025df06",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "b4cf6e7046e7c575f77df7e1e72744e2",
        "path_pattern_hash": "6dea86b00adf6715f6c6c1e11db802e4"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 8889,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=\r\n",
    "method": "CONNECT",
    "path": "130.12.182.98:80",
    "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
    "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=\r\n",
    "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=",
    "evidence": {
        "method": "CONNECT",
        "path": "130.12.182.98:80",
        "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
        "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=\r\n",
        "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 40
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3de2b25aba0f86727ab26ae6e393b1a0672fe3a1",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "130.12.182.98:80",
        "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
        "port": 8889,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.98:80",
    "target_port_label": "8889 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8889,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "130.12.182.98:80",
            "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
            "port": 8889,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:8889 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.98:80",
        "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic dHVyYm86dHVyYm8xMjM=",
        "target_port_label": "8889 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8889"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua",
        "net_web_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "port_inferred_service": true,
    "bytes_in": 0,
    "payload_entropy": 0,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "https",
    "app_proto": "https",
    "asn": 197769,
    "country": "SI",
    "dst_port": 9443,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 3.7,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 0
    },
    "risk_score": 40,
    "tag_count": 2,
    "anomaly_count": 0,
    "campaign_key": "9e051dab14e664422e109355079a354ee45b9a69",
    "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 66%",
    "confidence": 0.66,
    "classification_confidence": 0.66,
    "precision_score": 74,
    "precision_signals": [
        "pat-0600",
        "INT-single-port"
    ],
    "kb_rule_ids": [
        "pat-0600",
        "INT-single-port"
    ],
    "matched_patterns": [
        "pat-0600"
    ],
    "matched_pattern_names": [
        "HTTPS alt 9443 probe"
    ],
    "pattern_ids": [
        "pat-0600"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 0,
        "risk_score": 40
    },
    "named_classification_skipped": false,
    "service_name": "https",
    "risk_confidence_factor": 66,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "path_pattern_hash": "4154520a4208b3f021f35a6cc1dd98ae"
    },
    "target_context": {
        "dst_port": 9443,
        "service": "https",
        "service_name": "https",
        "risk_score": 40
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "0c7f0116ad39c58f5f8a2af0ad69e91ad61e933f",
    "protocol_details": {
        "port": 9443,
        "service": "https",
        "service_label_fr": "HTTPS"
    },
    "attack_vector": "Sonde HTTP \u00b7 via HTTPS:9443 \u00b7 (sonde \/ probe)",
    "target_port_label": "9443 \u00b7 HTTPS",
    "emulator_service": "https",
    "confidence_reason": "Confiance 66 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 66%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 66%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 66,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 0,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "https",
        "service_label_fr": "HTTPS",
        "dst_port": 9443,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0600",
            "INT-single-port"
        ],
        "tags_summary_labels_fr": [
            "pat-0600",
            "Single Port"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-https",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "port": 9443,
            "service": "https",
            "service_label_fr": "HTTPS"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTPS:9443 \u00b7 (sonde \/ probe)",
        "evidence_snippet": null,
        "target_port_label": "9443 \u00b7 HTTPS",
        "emulator_service": "https",
        "confidence_reason": "Confiance 66 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 66 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "https",
        "service_banner": "honeypot-https",
        "service_os": "linux",
        "dst_port": "9443"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_alt_port",
        "net_web_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 35,
    "payload_entropy": 4.0360069453309535,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "https",
    "app_proto": "https",
    "asn": 197769,
    "country": "SI",
    "dst_port": 9443,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 0
    },
    "risk_score": 46,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0",
    "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0418",
        "pat-0559",
        "pat-0568",
        "pat-0600"
    ],
    "matched_pattern_names": [
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy",
        "HTTPS alt 9443 probe"
    ],
    "pattern_ids": [
        "pat-0418",
        "pat-0559",
        "pat-0568",
        "pat-0600"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 0,
        "risk_score": 46
    },
    "named_classification_skipped": false,
    "service_name": "https",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "083a05a86d21e1db9da52b7a11d78afe",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 9443,
        "service": "https",
        "service_name": "https",
        "risk_score": 46
    },
    "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\n",
    "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\n",
    "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0",
    "evidence": {
        "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\n",
        "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a28b7b685cb42abc636fed5c1a698db80c11b561",
    "protocol_details": {
        "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0",
        "port": 9443,
        "service": "https",
        "service_label_fr": "HTTPS"
    },
    "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0",
    "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
    "target_port_label": "9443 \u00b7 HTTPS",
    "emulator_service": "https",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 0,
            "risk_score": 46
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "https",
        "service_label_fr": "HTTPS",
        "dst_port": 9443,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-https",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0",
            "port": 9443,
            "service": "https",
            "service_label_fr": "HTTPS"
        },
        "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0",
        "target_port_label": "9443 \u00b7 HTTPS",
        "emulator_service": "https",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "https",
        "service_banner": "honeypot-https",
        "service_os": "linux",
        "dst_port": "9443"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_alt_port",
        "net_web_probe",
        "websphere_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 100,
    "payload_entropy": 5.042306410590517,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "https",
    "app_proto": "https",
    "asn": 197769,
    "country": "SI",
    "dst_port": 9443,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0",
    "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568",
        "pat-0600"
    ],
    "matched_pattern_names": [
        "Cred Basic auth spray",
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy",
        "HTTPS alt 9443 probe"
    ],
    "pattern_ids": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568",
        "pat-0600"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15,
        "risk_score": 46
    },
    "named_classification_skipped": false,
    "service_name": "https",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "7f267b189bef4633d8969fabf802c7de",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 9443,
        "service": "https",
        "service_name": "https",
        "risk_score": 46
    },
    "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic MTIzOjQ1Ng==\r\n",
    "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic MTIzOjQ1Ng==\r\n",
    "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic MTIzOjQ1Ng==",
    "evidence": {
        "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic MTIzOjQ1Ng==\r\n",
        "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic MTIzOjQ1Ng==",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "4cd04446d15d3c6c57f78295368d84dfc2336e63",
    "protocol_details": {
        "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic MTIzOjQ1Ng==",
        "port": 9443,
        "service": "https",
        "service_label_fr": "HTTPS"
    },
    "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic MTIzOjQ1Ng==",
    "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
    "target_port_label": "9443 \u00b7 HTTPS",
    "emulator_service": "https",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 15,
            "risk_score": 46
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "https",
        "service_label_fr": "HTTPS",
        "dst_port": 9443,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-https",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic MTIzOjQ1Ng==",
            "port": 9443,
            "service": "https",
            "service_label_fr": "HTTPS"
        },
        "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic MTIzOjQ1Ng==",
        "target_port_label": "9443 \u00b7 HTTPS",
        "emulator_service": "https",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "https",
        "service_banner": "honeypot-https",
        "service_os": "linux",
        "dst_port": "9443"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_alt_port",
        "net_web_probe",
        "websphere_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 108,
    "payload_entropy": 5.298255674597248,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "https",
    "app_proto": "https",
    "asn": 197769,
    "country": "SI",
    "dst_port": 9443,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0",
    "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568",
        "pat-0600"
    ],
    "matched_pattern_names": [
        "Cred Basic auth spray",
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy",
        "HTTPS alt 9443 probe"
    ],
    "pattern_ids": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568",
        "pat-0600"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15,
        "risk_score": 46
    },
    "named_classification_skipped": false,
    "service_name": "https",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "4d422bdea287af0564250264873021b1",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 9443,
        "service": "https",
        "service_name": "https",
        "risk_score": 46
    },
    "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic enJvb3Q6ZGVmYXVsdA==\r\n",
    "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic enJvb3Q6ZGVmYXVsdA==\r\n",
    "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic enJvb3Q6ZGVmYXVsdA==",
    "evidence": {
        "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic enJvb3Q6ZGVmYXVsdA==\r\n",
        "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic enJvb3Q6ZGVmYXVsdA==",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "fc57b7c113750494d864aa3d5650cde885401d0b",
    "protocol_details": {
        "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic enJvb3Q6ZGVmYXVsdA==",
        "port": 9443,
        "service": "https",
        "service_label_fr": "HTTPS"
    },
    "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic enJvb3Q6ZGVmYXVsdA==",
    "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
    "target_port_label": "9443 \u00b7 HTTPS",
    "emulator_service": "https",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 15,
            "risk_score": 46
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "https",
        "service_label_fr": "HTTPS",
        "dst_port": 9443,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-https",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic enJvb3Q6ZGVmYXVsdA==",
            "port": 9443,
            "service": "https",
            "service_label_fr": "HTTPS"
        },
        "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic enJvb3Q6ZGVmYXVsdA==",
        "target_port_label": "9443 \u00b7 HTTPS",
        "emulator_service": "https",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "https",
        "service_banner": "honeypot-https",
        "service_os": "linux",
        "dst_port": "9443"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_alt_port",
        "net_web_probe",
        "websphere_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 104,
    "payload_entropy": 5.122832748147682,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "https",
    "app_proto": "https",
    "asn": 197769,
    "country": "SI",
    "dst_port": 9443,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0",
    "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568",
        "pat-0600"
    ],
    "matched_pattern_names": [
        "Cred Basic auth spray",
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy",
        "HTTPS alt 9443 probe"
    ],
    "pattern_ids": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568",
        "pat-0600"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15,
        "risk_score": 46
    },
    "named_classification_skipped": false,
    "service_name": "https",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "eeba15f1558f8d0992d1e626d725c58c",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 9443,
        "service": "https",
        "service_name": "https",
        "risk_score": 46
    },
    "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=\r\n",
    "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=\r\n",
    "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=",
    "evidence": {
        "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=\r\n",
        "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "865f9d45fbb2843e4a24211e64ded0cfd640a677",
    "protocol_details": {
        "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=",
        "port": 9443,
        "service": "https",
        "service_label_fr": "HTTPS"
    },
    "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=",
    "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
    "target_port_label": "9443 \u00b7 HTTPS",
    "emulator_service": "https",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 15,
            "risk_score": 46
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "https",
        "service_label_fr": "HTTPS",
        "dst_port": 9443,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-https",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=",
            "port": 9443,
            "service": "https",
            "service_label_fr": "HTTPS"
        },
        "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic dXNlcjE6cGFzczE=",
        "target_port_label": "9443 \u00b7 HTTPS",
        "emulator_service": "https",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "https",
        "service_banner": "honeypot-https",
        "service_os": "linux",
        "dst_port": "9443"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_alt_port",
        "net_web_probe",
        "websphere_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 100,
    "payload_entropy": 5.042306410590517,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "https",
    "app_proto": "https",
    "asn": 197769,
    "country": "SI",
    "dst_port": 9443,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0",
    "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568",
        "pat-0600"
    ],
    "matched_pattern_names": [
        "Cred Basic auth spray",
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy",
        "HTTPS alt 9443 probe"
    ],
    "pattern_ids": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568",
        "pat-0600"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15,
        "risk_score": 46
    },
    "named_classification_skipped": false,
    "service_name": "https",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "7f267b189bef4633d8969fabf802c7de",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 9443,
        "service": "https",
        "service_name": "https",
        "risk_score": 46
    },
    "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic MTIzOjQ1Ng==\r\n",
    "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic MTIzOjQ1Ng==\r\n",
    "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic MTIzOjQ1Ng==",
    "evidence": {
        "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic MTIzOjQ1Ng==\r\n",
        "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic MTIzOjQ1Ng==",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "4cd04446d15d3c6c57f78295368d84dfc2336e63",
    "protocol_details": {
        "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic MTIzOjQ1Ng==",
        "port": 9443,
        "service": "https",
        "service_label_fr": "HTTPS"
    },
    "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic MTIzOjQ1Ng==",
    "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
    "target_port_label": "9443 \u00b7 HTTPS",
    "emulator_service": "https",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 15,
            "risk_score": 46
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "https",
        "service_label_fr": "HTTPS",
        "dst_port": 9443,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-https",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic MTIzOjQ1Ng==",
            "port": 9443,
            "service": "https",
            "service_label_fr": "HTTPS"
        },
        "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic MTIzOjQ1Ng==",
        "target_port_label": "9443 \u00b7 HTTPS",
        "emulator_service": "https",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "https",
        "service_banner": "honeypot-https",
        "service_os": "linux",
        "dst_port": "9443"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_alt_port",
        "net_web_probe",
        "websphere_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 35,
    "payload_entropy": 4.0360069453309535,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "https",
    "app_proto": "https",
    "asn": 197769,
    "country": "SI",
    "dst_port": 9443,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 0
    },
    "risk_score": 46,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0",
    "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0418",
        "pat-0559",
        "pat-0568",
        "pat-0600"
    ],
    "matched_pattern_names": [
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy",
        "HTTPS alt 9443 probe"
    ],
    "pattern_ids": [
        "pat-0418",
        "pat-0559",
        "pat-0568",
        "pat-0600"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 0,
        "risk_score": 46
    },
    "named_classification_skipped": false,
    "service_name": "https",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "083a05a86d21e1db9da52b7a11d78afe",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 9443,
        "service": "https",
        "service_name": "https",
        "risk_score": 46
    },
    "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\n",
    "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\n",
    "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0",
    "evidence": {
        "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\n",
        "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a28b7b685cb42abc636fed5c1a698db80c11b561",
    "protocol_details": {
        "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0",
        "port": 9443,
        "service": "https",
        "service_label_fr": "HTTPS"
    },
    "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0",
    "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
    "target_port_label": "9443 \u00b7 HTTPS",
    "emulator_service": "https",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 0,
            "risk_score": 46
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "https",
        "service_label_fr": "HTTPS",
        "dst_port": 9443,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-https",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0",
            "port": 9443,
            "service": "https",
            "service_label_fr": "HTTPS"
        },
        "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0",
        "target_port_label": "9443 \u00b7 HTTPS",
        "emulator_service": "https",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "https",
        "service_banner": "honeypot-https",
        "service_os": "linux",
        "dst_port": "9443"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_alt_port",
        "net_web_probe",
        "websphere_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 112,
    "payload_entropy": 5.179356820398628,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "https",
    "app_proto": "https",
    "asn": 197769,
    "country": "SI",
    "dst_port": 9443,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0",
    "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568",
        "pat-0600"
    ],
    "matched_pattern_names": [
        "Cred Basic auth spray",
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy",
        "HTTPS alt 9443 probe"
    ],
    "pattern_ids": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568",
        "pat-0600"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15,
        "risk_score": 46
    },
    "named_classification_skipped": false,
    "service_name": "https",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "b1bc0b845c4d5467729c2d23ebd4ddf6",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 9443,
        "service": "https",
        "service_name": "https",
        "risk_score": 46
    },
    "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cnVuY2xvdWQ6cnVuY2xvdWQ=\r\n",
    "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cnVuY2xvdWQ6cnVuY2xvdWQ=\r\n",
    "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cnVuY2xvdWQ6cnVuY2xvdWQ=",
    "evidence": {
        "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cnVuY2xvdWQ6cnVuY2xvdWQ=\r\n",
        "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cnVuY2xvdWQ6cnVuY2xvdWQ=",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "938574cc56749ca94981f675070d840aad705441",
    "protocol_details": {
        "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cnVuY2xvdWQ6cnVuY2xvdWQ=",
        "port": 9443,
        "service": "https",
        "service_label_fr": "HTTPS"
    },
    "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cnVuY2xvdWQ6cnVuY2xvdWQ=",
    "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
    "target_port_label": "9443 \u00b7 HTTPS",
    "emulator_service": "https",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 15,
            "risk_score": 46
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "https",
        "service_label_fr": "HTTPS",
        "dst_port": 9443,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-https",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cnVuY2xvdWQ6cnVuY2xvdWQ=",
            "port": 9443,
            "service": "https",
            "service_label_fr": "HTTPS"
        },
        "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cnVuY2xvdWQ6cnVuY2xvdWQ=",
        "target_port_label": "9443 \u00b7 HTTPS",
        "emulator_service": "https",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "https",
        "service_banner": "honeypot-https",
        "service_os": "linux",
        "dst_port": "9443"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_alt_port",
        "net_web_probe",
        "websphere_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 100,
    "payload_entropy": 5.083305065291617,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "https",
    "app_proto": "https",
    "asn": 197769,
    "country": "SI",
    "dst_port": 9443,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0",
    "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568",
        "pat-0600"
    ],
    "matched_pattern_names": [
        "Cred Basic auth spray",
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy",
        "HTTPS alt 9443 probe"
    ],
    "pattern_ids": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568",
        "pat-0600"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15,
        "risk_score": 46
    },
    "named_classification_skipped": false,
    "service_name": "https",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "adf178b5a2e6ee1c2b1248c34e8175e7",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 9443,
        "service": "https",
        "service_name": "https",
        "risk_score": 46
    },
    "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic dWJudDp1Ym50\r\n",
    "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic dWJudDp1Ym50\r\n",
    "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic dWJudDp1Ym50",
    "evidence": {
        "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic dWJudDp1Ym50\r\n",
        "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic dWJudDp1Ym50",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a941a904ecbfe1c2eb65a7af76fcb63857388956",
    "protocol_details": {
        "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic dWJudDp1Ym50",
        "port": 9443,
        "service": "https",
        "service_label_fr": "HTTPS"
    },
    "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic dWJudDp1Ym50",
    "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
    "target_port_label": "9443 \u00b7 HTTPS",
    "emulator_service": "https",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 15,
            "risk_score": 46
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "https",
        "service_label_fr": "HTTPS",
        "dst_port": 9443,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-https",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic dWJudDp1Ym50",
            "port": 9443,
            "service": "https",
            "service_label_fr": "HTTPS"
        },
        "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic dWJudDp1Ym50",
        "target_port_label": "9443 \u00b7 HTTPS",
        "emulator_service": "https",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "https",
        "service_banner": "honeypot-https",
        "service_os": "linux",
        "dst_port": "9443"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_alt_port",
        "net_web_probe",
        "websphere_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 108,
    "payload_entropy": 5.298255674597248,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "https",
    "app_proto": "https",
    "asn": 197769,
    "country": "SI",
    "dst_port": 9443,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0",
    "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.49,
    "classification_confidence": 0.49,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568",
        "pat-0600"
    ],
    "matched_pattern_names": [
        "Cred Basic auth spray",
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy",
        "HTTPS alt 9443 probe"
    ],
    "pattern_ids": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568",
        "pat-0600"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15,
        "risk_score": 46
    },
    "named_classification_skipped": false,
    "service_name": "https",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "4d422bdea287af0564250264873021b1",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 9443,
        "service": "https",
        "service_name": "https",
        "risk_score": 46
    },
    "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic enJvb3Q6ZGVmYXVsdA==\r\n",
    "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic enJvb3Q6ZGVmYXVsdA==\r\n",
    "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic enJvb3Q6ZGVmYXVsdA==",
    "evidence": {
        "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic enJvb3Q6ZGVmYXVsdA==\r\n",
        "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic enJvb3Q6ZGVmYXVsdA==",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "fc57b7c113750494d864aa3d5650cde885401d0b",
    "protocol_details": {
        "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic enJvb3Q6ZGVmYXVsdA==",
        "port": 9443,
        "service": "https",
        "service_label_fr": "HTTPS"
    },
    "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic enJvb3Q6ZGVmYXVsdA==",
    "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
    "target_port_label": "9443 \u00b7 HTTPS",
    "emulator_service": "https",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 49 % \u2014 via HTTPS",
        "confidence_pct": 49,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 15,
            "risk_score": 46
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "https",
        "service_label_fr": "HTTPS",
        "dst_port": 9443,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-https",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Confiance mod\u00e9r\u00e9e \u2014 signal unique",
        "protocol_details": {
            "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic enJvb3Q6ZGVmYXVsdA==",
            "port": 9443,
            "service": "https",
            "service_label_fr": "HTTPS"
        },
        "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic enJvb3Q6ZGVmYXVsdA==",
        "target_port_label": "9443 \u00b7 HTTPS",
        "emulator_service": "https",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 49 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "https",
        "service_banner": "honeypot-https",
        "service_os": "linux",
        "dst_port": "9443"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_alt_port",
        "net_web_probe",
        "websphere_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 35,
    "payload_entropy": 4.0360069453309535,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "https",
    "app_proto": "https",
    "asn": 197769,
    "country": "SI",
    "dst_port": 9443,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 4.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 0
    },
    "risk_score": 46,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0",
    "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.57,
    "classification_confidence": 0.57,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0418",
        "pat-0559",
        "pat-0568",
        "pat-0600"
    ],
    "matched_pattern_names": [
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy",
        "HTTPS alt 9443 probe"
    ],
    "pattern_ids": [
        "pat-0418",
        "pat-0559",
        "pat-0568",
        "pat-0600"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 0,
        "risk_score": 46,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "https",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "083a05a86d21e1db9da52b7a11d78afe",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 9443,
        "service": "https",
        "service_name": "https",
        "risk_score": 46
    },
    "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\n",
    "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\n",
    "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0",
    "evidence": {
        "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\n",
        "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "a28b7b685cb42abc636fed5c1a698db80c11b561",
    "protocol_details": {
        "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0",
        "port": 9443,
        "service": "https",
        "service_label_fr": "HTTPS"
    },
    "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0",
    "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
    "target_port_label": "9443 \u00b7 HTTPS",
    "emulator_service": "https",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 57 % \u2014 via HTTPS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 57,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 0,
            "risk_score": 46,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "https",
        "service_label_fr": "HTTPS",
        "dst_port": 9443,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-https",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0",
            "port": 9443,
            "service": "https",
            "service_label_fr": "HTTPS"
        },
        "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0",
        "target_port_label": "9443 \u00b7 HTTPS",
        "emulator_service": "https",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "https",
        "service_banner": "honeypot-https",
        "service_os": "linux",
        "dst_port": "9443"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "https",
        "ssh"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_alt_port",
        "net_web_probe",
        "websphere_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f382e3470312044656269616e2d352b646562313175330d0a",
    "emulator_response_len": 40,
    "bytes_in": 1159,
    "payload_entropy": 4.8356187668221065,
    "port_category": "well_known",
    "org": "VPS Dedicated LLC",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 197769,
    "country": "SI",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 195,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "pat-0392",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "pat-0392",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0392",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "libssh banner",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0392",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "e67375d7f59cea7c1c55f5c051fe3246",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdIW\ufffd\ufffdr\u0003\ufffd\u0015\ufffd\ufffd@\u001d|+\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
    "request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdIW\ufffd\ufffdr\u0003\ufffd\u0015\ufffd\ufffd@\u001d|+\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie",
    "payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdIW\ufffd\ufffdr\u0003\ufffd\u0015\ufffd\ufffd@\u001d|+\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
    "evidence": {
        "request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdIW\ufffd\ufffdr\u0003\ufffd\u0015\ufffd\ufffd@\u001d|+\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie",
        "payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdIW\ufffd\ufffdr\u0003\ufffd\u0015\ufffd\ufffd@\u001d|+\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "22f1e42617d6121abe47f5c715a92fc33032d772",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdIW\ufffd\ufffdr\u0003\ufffd\u0015\ufffd\ufffd@\u001d|+\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
        "payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdIW\ufffd\ufffdr\u0003\ufffd\u0015\ufffd\ufffd@\u001d|+\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nl\ufffdIW\ufffd\ufffdr\ufffd\ufffd\ufffd@|+\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 40,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50,
            "correlation_boost": 8
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "pat-0392",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "pat-0392",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdIW\ufffd\ufffdr\u0003\ufffd\u0015\ufffd\ufffd@\u001d|+\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
            "payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014\ufffdIW\ufffd\ufffdr\u0003\ufffd\u0015\ufffd\ufffd@\u001d|+\ufffd\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nl\ufffdIW\ufffd\ufffdr\ufffd\ufffd\ufffd@|+\ufffdhcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "https",
        "ssh"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 102,
    "payload_entropy": 4.886435240506549,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "https",
    "app_proto": "https",
    "asn": 197769,
    "country": "SI",
    "dst_port": 9443,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 33,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.1,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 3,
    "anomaly_count": 0,
    "campaign_key": "80c828df2c78c8e2ac4c1c341013d811b61f83b0",
    "event_fingerprint": "5b8d9bc7bcb6d0b9bee3faac4a80649a400d4176",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.57,
    "classification_confidence": 0.57,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568",
        "pat-0600"
    ],
    "matched_pattern_names": [
        "Cred Basic auth spray",
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy",
        "HTTPS alt 9443 probe"
    ],
    "pattern_ids": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568",
        "pat-0600"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 33,
        "novelty": 15,
        "risk_score": 46,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "https",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "df55f46817fab5079c78b1736d8c92d5",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 9443,
        "service": "https",
        "service_name": "https",
        "risk_score": 46
    },
    "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic MTExMToxMTEx\r\n\r\n",
    "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic MTExMToxMTEx\r\n\r\n",
    "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic MTExMToxMTEx",
    "evidence": {
        "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic MTExMToxMTEx\r\n\r\n",
        "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic MTExMToxMTEx",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "916f0df2c6dc4edd5aa6aa6af20613b6de33f07d",
    "protocol_details": {
        "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic MTExMToxMTEx",
        "port": 9443,
        "service": "https",
        "service_label_fr": "HTTPS"
    },
    "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic MTExMToxMTEx",
    "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
    "target_port_label": "9443 \u00b7 HTTPS",
    "emulator_service": "https",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 57 % \u2014 via HTTPS \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 57,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 33,
            "novelty": 15,
            "risk_score": 46,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "https",
        "service_label_fr": "HTTPS",
        "dst_port": 9443,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-https",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic MTExMToxMTEx",
            "port": 9443,
            "service": "https",
            "service_label_fr": "HTTPS"
        },
        "attack_vector": "http flood \u00b7 via HTTPS:9443 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic MTExMToxMTEx",
        "target_port_label": "9443 \u00b7 HTTPS",
        "emulator_service": "https",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "https",
        "service_banner": "honeypot-https",
        "service_os": "linux",
        "dst_port": "9443"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "https",
        "ssh"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_alt_port",
        "net_web_probe",
        "websphere_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "5353482d322e302d4f70656e5353485f392e3670312044656269616e2d310d0a",
    "emulator_response_len": 32,
    "bytes_in": 1159,
    "payload_entropy": 4.829811829846387,
    "port_category": "well_known",
    "org": "VPS Dedicated LLC",
    "service": "ssh",
    "app_proto": "ssh",
    "asn": 197769,
    "country": "SI",
    "dst_port": 22,
    "risk_waf": 8,
    "risk_classification": 50,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 36,
    "risk_novelty": 25,
    "risk_boost": 0,
    "risk_granularity": 5.3,
    "risk_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 25
    },
    "risk_score": 50,
    "tag_count": 5,
    "anomaly_count": 0,
    "campaign_key": "9a91c35ff8553fc24795f9eaf93692ffdae1839c",
    "event_fingerprint": "bc4e3fa786c83e0db7c1c892cb0c288f6b14388f",
    "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
    "confidence": 1,
    "classification_confidence": 1,
    "precision_score": 195,
    "precision_signals": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "pat-0392",
        "INT-upstream"
    ],
    "kb_rule_ids": [
        "INT-ssh-libssh-ua",
        "pat-0391",
        "pat-0392",
        "INT-upstream"
    ],
    "matched_patterns": [
        "pat-0391",
        "pat-0392",
        "pat-0536"
    ],
    "matched_pattern_names": [
        "SSH-2.0 banner RFC4253",
        "libssh banner",
        "TFTP RRQ"
    ],
    "pattern_ids": [
        "pat-0391",
        "pat-0392",
        "pat-0536"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 50,
        "behavior": 0,
        "geo": 40,
        "protocol": 36,
        "novelty": 25,
        "risk_score": 50
    },
    "named_classification_skipped": false,
    "service_name": "ssh",
    "risk_confidence_factor": 100,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "0fe31c816cceb8428a5a6a552f4e4069",
        "path_pattern_hash": "4368b1c212b6962fb95d1d1144451aca"
    },
    "target_context": {
        "dst_port": 22,
        "service": "ssh",
        "service_name": "ssh",
        "risk_score": 50
    },
    "payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014Ja\ufffd\ufffd\ufffd\ufffd,\ufffd>\ufffd\ufffd&\"\ufffd&\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
    "request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014Ja\ufffd\ufffd\ufffd\ufffd,\ufffd>\ufffd\ufffd&\"\ufffd&\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie",
    "payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014Ja\ufffd\ufffd\ufffd\ufffd,\ufffd>\ufffd\ufffd&\"\ufffd&\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
    "evidence": {
        "request_sample": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014Ja\ufffd\ufffd\ufffd\ufffd,\ufffd>\ufffd\ufffd&\"\ufffd&\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group18-sha512,diffie-hellman-group16-sha512,diffie-hellman-group-exchange-sha256,diffie",
        "payload_snippet": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014Ja\ufffd\ufffd\ufffd\ufffd,\ufffd>\ufffd\ufffd&\"\ufffd&\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%"
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre_techniques": [
        "T1046",
        "T1595"
    ],
    "mitre": "T1046",
    "threat_family": [
        "scanner"
    ],
    "recommended_client_action": "investigate",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "5b76efec5ffa20df507088b97658d52c15aba295",
    "protocol_details": {
        "ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014Ja\ufffd\ufffd\ufffd\ufffd,\ufffd>\ufffd\ufffd&\"\ufffd&\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
        "payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014Ja\ufffd\ufffd\ufffd\ufffd,\ufffd>\ufffd\ufffd&\"\ufffd&\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
        "port": 22,
        "service": "ssh",
        "service_label_fr": "SSH"
    },
    "evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nlJa\ufffd\ufffd\ufffd\ufffd,\ufffd>\ufffd\ufffd&\"\ufffd&hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
    "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
    "target_port_label": "22 \u00b7 SSH",
    "emulator_service": "ssh",
    "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "classification_reason_label_fr": "Banni\u00e8re client SSH re\u00e7ue \u00b7 confiance 100%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 50\/100 (Moyen) \u2014 MITRE T1046 \u2014 confiance 100 % \u2014 via SSH",
        "confidence_pct": 100,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 50,
            "behavior": 0,
            "geo": 40,
            "protocol": 36,
            "novelty": 25,
            "risk_score": 50
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 50,
        "risk_label": "Moyen",
        "service_name": "ssh",
        "service_label_fr": "SSH",
        "dst_port": 22,
        "protocol_emulated": true,
        "tags_summary": [
            "INT-ssh-libssh-ua",
            "pat-0391",
            "pat-0392",
            "INT-upstream"
        ],
        "tags_summary_labels_fr": [
            "Client SSH libssh\/paramiko (scanner)",
            "pat-0391",
            "pat-0392",
            "Upstream"
        ],
        "recommended_action": "investigate",
        "recommended_action_label": "Investiguer",
        "mitre": "T1046",
        "mitre_technique": "T1046",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "OpenSSH_8.9p1 Ubuntu",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "ssh_banner": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014Ja\ufffd\ufffd\ufffd\ufffd,\ufffd>\ufffd\ufffd&\"\ufffd&\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
            "payload_preview": "SSH-2.0-libssh_0.11.4\r\n\u0000\u0000\u0004l\u0006\u0014Ja\ufffd\ufffd\ufffd\ufffd,\ufffd>\ufffd\ufffd&\"\ufffd&\u0000\u0000\u0001hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
            "port": 22,
            "service": "ssh",
            "service_label_fr": "SSH"
        },
        "attack_vector": "Sonde SSH \u00b7 via SSH:22 \u00b7 (sonde \/ probe)",
        "evidence_snippet": "SSH-2.0-libssh_0.11.4\r\nlJa\ufffd\ufffd\ufffd\ufffd,\ufffd>\ufffd\ufffd&\"\ufffd&hcurve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nis",
        "target_port_label": "22 \u00b7 SSH",
        "emulator_service": "ssh",
        "confidence_reason": "Confiance 100 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 100 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "ssh",
        "service_banner": "OpenSSH_8.9p1 Ubuntu",
        "service_os": "linux",
        "dst_port": "22"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "ban_policy": "advisory_investigate",
    "tags_list": [
        "net_ssh_probe",
        "ssh_banner",
        "ssh_emulated",
        "ssh_kex_probe",
        "ssh_libssh"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "bytes_in": 110,
    "payload_entropy": 5.1252598012571635,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "http-alt-8090",
    "app_proto": "http-alt-8090",
    "asn": 197769,
    "country": "SI",
    "dst_port": 8090,
    "risk_waf": 8,
    "risk_classification": 80,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 22,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 4.8,
    "risk_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 22,
        "novelty": 15
    },
    "risk_score": 46,
    "tag_count": 0,
    "anomaly_count": 0,
    "campaign_key": "074fcf7b6621f792f12eafd4c85696050ae26041",
    "event_fingerprint": "73de1024b23993e40693db328fc9a5b5266e5167",
    "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
    "confidence": 0.57,
    "classification_confidence": 0.57,
    "precision_score": 58,
    "precision_signals": [
        "pat-0418"
    ],
    "kb_rule_ids": [
        "pat-0418"
    ],
    "matched_patterns": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "matched_pattern_names": [
        "Cred Basic auth spray",
        "HTTP CONNECT method",
        "ActiveMQ STOMP",
        "Squid HTTP proxy"
    ],
    "pattern_ids": [
        "pat-0463",
        "pat-0418",
        "pat-0559",
        "pat-0568"
    ],
    "confidence_breakdown": {
        "waf": 8,
        "classification": 80,
        "behavior": 0,
        "geo": 40,
        "protocol": 22,
        "novelty": 15,
        "risk_score": 46,
        "correlation_boost": 8
    },
    "named_classification_skipped": false,
    "service_name": "http-alt-8090",
    "risk_confidence_factor": 49,
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "5143dee7c6e862fe68a429be1560843a",
        "path_pattern_hash": "4d7cc3b45cbf3e5b6ce484f88d569789"
    },
    "target_context": {
        "dst_port": 8090,
        "service": "http-alt-8090",
        "service_name": "http-alt-8090",
        "risk_score": 46
    },
    "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDoxcTJ3M2U0cg==\r\n\r\n",
    "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDoxcTJ3M2U0cg==\r\n\r\n",
    "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDoxcTJ3M2U0cg==",
    "evidence": {
        "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDoxcTJ3M2U0cg==\r\n\r\n",
        "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDoxcTJ3M2U0cg==",
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%"
    },
    "attack_stage": "exploit_attempt",
    "mitre_tactics": [
        "TA0001",
        "TA0002"
    ],
    "mitre": "TA0001",
    "threat_family": [
        "ddos"
    ],
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "caa91191d4a6b86cb58395c5b6f4cd0fe58e421b",
    "protocol_details": {
        "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDoxcTJ3M2U0cg==",
        "port": 8090,
        "service": "http-alt-8090",
        "service_label_fr": "HTTP ALT 8090"
    },
    "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDoxcTJ3M2U0cg==",
    "attack_vector": "http flood \u00b7 via HTTP ALT 8090:8090 \u00b7 (tentative d'exploit)",
    "target_port_label": "8090 \u00b7 HTTP ALT 8090",
    "emulator_service": "http-alt-8090",
    "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "classification_reason_label_fr": "Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 49%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u2014 risque 46\/100 (Moyen) \u2014 MITRE TA0001 \u2014 confiance 57 % \u2014 via HTTP ALT 8090 \u2014 multi-protocole (2 protocoles \u00b7 5 min)",
        "confidence_pct": 57,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 80,
            "behavior": 0,
            "geo": 40,
            "protocol": 22,
            "novelty": 15,
            "risk_score": 46,
            "correlation_boost": 8
        },
        "attack_stage": "exploit_attempt",
        "attack_stage_label": "Tentative d'exploit",
        "attack_chain_stage": "exploitation",
        "attack_chain_stage_label_fr": "Exploitation",
        "risk_score": 46,
        "risk_label": "Moyen",
        "service_name": "http-alt-8090",
        "service_label_fr": "HTTP ALT 8090",
        "dst_port": 8090,
        "protocol_emulated": true,
        "tags_summary": [
            "pat-0418"
        ],
        "tags_summary_labels_fr": [
            "pat-0418"
        ],
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0001",
        "mitre_technique": "TA0001",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http-alt-8090",
        "correlation_flags": [
            "multi_protocol_correlation"
        ],
        "correlation_flags_labels_fr": [
            "Multi-protocole corr\u00e9l\u00e9 (5 min)"
        ],
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": "Corr\u00e9lation +8",
        "protocol_details": {
            "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDoxcTJ3M2U0cg==",
            "port": 8090,
            "service": "http-alt-8090",
            "service_label_fr": "HTTP ALT 8090"
        },
        "attack_vector": "http flood \u00b7 via HTTP ALT 8090:8090 \u00b7 (tentative d'exploit)",
        "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDoxcTJ3M2U0cg==",
        "target_port_label": "8090 \u00b7 HTTP ALT 8090",
        "emulator_service": "http-alt-8090",
        "confidence_reason": "Confiance 49 % \u2014 Motif catalogue confirm\u00e9",
        "confidence_factors_fr": "Confiance 57 % \u2014 Score WAF 8 \u00b7 Bonus corr\u00e9lation +8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "exploitation",
                "label_fr": "Exploitation",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http_alt_8090",
        "service_banner": "honeypot-http-alt-8090",
        "service_os": "linux",
        "dst_port": "8090"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "multi_protocol_correlation": true,
    "multi_protocol_count": 2,
    "multi_protocol_sample": [
        "http",
        "http-alt-8090"
    ],
    "multi_protocol_window_s": 300,
    "behavior_alerts": [
        "multi_protocol_correlation"
    ],
    "correlation_confidence_boost": 8,
    "attack_chain_stage": "exploitation",
    "ban_policy": "advisory_monitor",
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "98:80",
    "http_ua_hash": null,
    "http_host_hash": "47ff1c54158454896ce0c029bfa7ac9397ab6a7a",
    "http_target_hash": "47ff1c54158454896ce0c029bfa7ac9397ab6a7a",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 106,
    "payload_entropy": 5.182576469913909,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 197769,
    "country": "SI",
    "dst_port": 8090,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 6.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
    "event_fingerprint": "6e5bd7d01e90462fc329ef4a129ade18f1dfd812",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "26270a2bc4a6817465d9925194699c4e",
        "path_pattern_hash": "6dea86b00adf6715f6c6c1e11db802e4"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 8090,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDpnaGJkdG4=\r\n\r\n",
    "method": "CONNECT",
    "path": "130.12.182.98:80",
    "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
    "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDpnaGJkdG4=\r\n\r\n",
    "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDpnaGJkdG4=",
    "evidence": {
        "method": "CONNECT",
        "path": "130.12.182.98:80",
        "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
        "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDpnaGJkdG4=\r\n\r\n",
        "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDpnaGJkdG4=",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 40
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "3ec7125562d2f6e5f098c2392dee1a77c231b220",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "130.12.182.98:80",
        "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
        "port": 8090,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDpnaGJkdG4=",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.98:80",
    "target_port_label": "8090 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8090,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "130.12.182.98:80",
            "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
            "port": 8090,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.98:80",
        "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDpnaGJkdG4=",
        "target_port_label": "8090 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8090"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua",
        "net_web_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "98:80",
    "http_ua_hash": null,
    "http_host_hash": "47ff1c54158454896ce0c029bfa7ac9397ab6a7a",
    "http_target_hash": "47ff1c54158454896ce0c029bfa7ac9397ab6a7a",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 104,
    "payload_entropy": 5.059466493669,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 197769,
    "country": "SI",
    "dst_port": 8090,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 6.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
    "event_fingerprint": "6e5bd7d01e90462fc329ef4a129ade18f1dfd812",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "a402b48aded21b4bc3e2a70840c62ec5",
        "path_pattern_hash": "6dea86b00adf6715f6c6c1e11db802e4"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 8090,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n",
    "method": "CONNECT",
    "path": "130.12.182.98:80",
    "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
    "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n",
    "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=",
    "evidence": {
        "method": "CONNECT",
        "path": "130.12.182.98:80",
        "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
        "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=\r\n",
        "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 40
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "eb92f7e7e01c4aeb4e25c1e7d59259c3a9cb4968",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "130.12.182.98:80",
        "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
        "port": 8090,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.98:80",
    "target_port_label": "8090 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8090,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "130.12.182.98:80",
            "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
            "port": 8090,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.98:80",
        "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic YWRtaW46YWRtaW4=",
        "target_port_label": "8090 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8090"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua",
        "net_web_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 0,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "98:80",
    "http_ua_hash": null,
    "http_host_hash": null,
    "http_target_hash": "47ff1c54158454896ce0c029bfa7ac9397ab6a7a",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 35,
    "payload_entropy": 4.0360069453309535,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 197769,
    "country": "SI",
    "dst_port": 8090,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 0,
    "risk_boost": 0,
    "risk_granularity": 6.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 0
    },
    "risk_score": 40,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
    "event_fingerprint": "6e5bd7d01e90462fc329ef4a129ade18f1dfd812",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "083a05a86d21e1db9da52b7a11d78afe",
        "path_pattern_hash": "6dea86b00adf6715f6c6c1e11db802e4"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 8090,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\n",
    "method": "CONNECT",
    "path": "130.12.182.98:80",
    "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
    "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\n",
    "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0",
    "evidence": {
        "method": "CONNECT",
        "path": "130.12.182.98:80",
        "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
        "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\n",
        "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 0,
        "risk_score": 40
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "25666b55e5bcc7881913f5910f374b18de3d62ca",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "130.12.182.98:80",
        "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
        "port": 8090,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.98:80",
    "target_port_label": "8090 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 0,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8090,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "130.12.182.98:80",
            "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
            "port": 8090,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.98:80",
        "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0",
        "target_port_label": "8090 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8090"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua",
        "net_web_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "98:80",
    "http_ua_hash": null,
    "http_host_hash": "47ff1c54158454896ce0c029bfa7ac9397ab6a7a",
    "http_target_hash": "47ff1c54158454896ce0c029bfa7ac9397ab6a7a",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 108,
    "payload_entropy": 5.166175466203821,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 197769,
    "country": "SI",
    "dst_port": 8090,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 6.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
    "event_fingerprint": "6e5bd7d01e90462fc329ef4a129ade18f1dfd812",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "ea2ffbf0d67abe3c53646f9aa766da5f",
        "path_pattern_hash": "6dea86b00adf6715f6c6c1e11db802e4"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 8090,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cGFua2FqOmZ0cHVzZXI=\r\n",
    "method": "CONNECT",
    "path": "130.12.182.98:80",
    "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
    "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cGFua2FqOmZ0cHVzZXI=\r\n",
    "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cGFua2FqOmZ0cHVzZXI=",
    "evidence": {
        "method": "CONNECT",
        "path": "130.12.182.98:80",
        "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
        "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cGFua2FqOmZ0cHVzZXI=\r\n",
        "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cGFua2FqOmZ0cHVzZXI=",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 40
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "1ee7116b64f0aa08f6240c789e4f6d36820d713a",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "130.12.182.98:80",
        "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
        "port": 8090,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cGFua2FqOmZ0cHVzZXI=",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.98:80",
    "target_port_label": "8090 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8090,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "130.12.182.98:80",
            "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
            "port": 8090,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.98:80",
        "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cGFua2FqOmZ0cHVzZXI=",
        "target_port_label": "8090 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8090"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua",
        "net_web_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "98:80",
    "http_ua_hash": null,
    "http_host_hash": "47ff1c54158454896ce0c029bfa7ac9397ab6a7a",
    "http_target_hash": "47ff1c54158454896ce0c029bfa7ac9397ab6a7a",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 100,
    "payload_entropy": 5.057824251225186,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 197769,
    "country": "SI",
    "dst_port": 8090,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 6.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
    "event_fingerprint": "6e5bd7d01e90462fc329ef4a129ade18f1dfd812",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "209ad8a1b746ca156dd8a8c67b06aa75",
        "path_pattern_hash": "6dea86b00adf6715f6c6c1e11db802e4"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 8090,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n",
    "method": "CONNECT",
    "path": "130.12.182.98:80",
    "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
    "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n",
    "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0",
    "evidence": {
        "method": "CONNECT",
        "path": "130.12.182.98:80",
        "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
        "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0\r\n",
        "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 40
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "98865b522eb15ef7b5d66c2665895b2725c12357",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "130.12.182.98:80",
        "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
        "port": 8090,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.98:80",
    "target_port_label": "8090 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8090,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "130.12.182.98:80",
            "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
            "port": 8090,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.98:80",
        "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic dGVzdDp0ZXN0",
        "target_port_label": "8090 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8090"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua",
        "net_web_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "98:80",
    "http_ua_hash": null,
    "http_host_hash": "47ff1c54158454896ce0c029bfa7ac9397ab6a7a",
    "http_target_hash": "47ff1c54158454896ce0c029bfa7ac9397ab6a7a",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 104,
    "payload_entropy": 5.1218725032427805,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 197769,
    "country": "SI",
    "dst_port": 8090,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 6.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
    "event_fingerprint": "6e5bd7d01e90462fc329ef4a129ade18f1dfd812",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "d48e24d1717a9c0c7e2c6f62fa4387a8",
        "path_pattern_hash": "6dea86b00adf6715f6c6c1e11db802e4"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 8090,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDphc2RmMTIz\r\n",
    "method": "CONNECT",
    "path": "130.12.182.98:80",
    "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
    "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDphc2RmMTIz\r\n",
    "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDphc2RmMTIz",
    "evidence": {
        "method": "CONNECT",
        "path": "130.12.182.98:80",
        "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
        "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDphc2RmMTIz\r\n",
        "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDphc2RmMTIz",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 40
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "fb8b00e1be099707d67dbe98ec62d582e3577f45",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "130.12.182.98:80",
        "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
        "port": 8090,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDphc2RmMTIz",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.98:80",
    "target_port_label": "8090 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8090,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "130.12.182.98:80",
            "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
            "port": 8090,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.98:80",
        "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDphc2RmMTIz",
        "target_port_label": "8090 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8090"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua",
        "net_web_probe"
    ],
    "asn_dc_heuristic": true
}

{
    "protocol_emulated": true,
    "emulator_response": "485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b",
    "emulator_response_len": 82,
    "http_header_count": 2,
    "http_query_params": 0,
    "http_path_depth": 1,
    "http_path_ext": "98:80",
    "http_ua_hash": null,
    "http_host_hash": "47ff1c54158454896ce0c029bfa7ac9397ab6a7a",
    "http_target_hash": "47ff1c54158454896ce0c029bfa7ac9397ab6a7a",
    "http_referer_hash": null,
    "http_method": "CONNECT",
    "http_ua_is_cli": false,
    "http_ua_is_browser": false,
    "bytes_in": 104,
    "payload_entropy": 5.149322051053101,
    "port_category": "registered",
    "org": "VPS Dedicated LLC",
    "service": "http",
    "app_proto": "http",
    "asn": 197769,
    "country": "SI",
    "dst_port": 8090,
    "risk_waf": 8,
    "risk_classification": 38,
    "risk_behavior": 0,
    "risk_geo": 40,
    "risk_protocol": 43,
    "risk_novelty": 15,
    "risk_boost": 0,
    "risk_granularity": 6.2,
    "risk_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15
    },
    "risk_score": 40,
    "tag_count": 4,
    "anomaly_count": 0,
    "campaign_key": "ac92b13ee4ce944156da57e63243561c5d4bd794",
    "event_fingerprint": "6e5bd7d01e90462fc329ef4a129ade18f1dfd812",
    "city": null,
    "is_datacenter": true,
    "is_tor_hint": false,
    "geo": {
        "country": "SI",
        "asn": 197769,
        "org": "VPS Dedicated LLC",
        "is_datacenter": true,
        "is_tor_hint": false
    },
    "fingerprint": {
        "payload_hash": "4bbaba08ef9f4e5d4fc345d0bb55b0ae",
        "path_pattern_hash": "6dea86b00adf6715f6c6c1e11db802e4"
    },
    "service_name": "http",
    "target_context": {
        "dst_port": 8090,
        "service": "http",
        "service_name": "http",
        "risk_score": 40
    },
    "payload_preview": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDphamVldA==\r\n",
    "method": "CONNECT",
    "path": "130.12.182.98:80",
    "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
    "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDphamVldA==\r\n",
    "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDphamVldA==",
    "evidence": {
        "method": "CONNECT",
        "path": "130.12.182.98:80",
        "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
        "request_sample": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDphamVldA==\r\n",
        "payload_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDphamVldA==",
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%"
    },
    "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
    "confidence_breakdown": {
        "waf": 8,
        "classification": 38,
        "behavior": 0,
        "geo": 40,
        "protocol": 43,
        "novelty": 15,
        "risk_score": 40
    },
    "attack_stage": "probe",
    "mitre_tactics": [
        "TA0007",
        "TA0001"
    ],
    "mitre": "TA0007",
    "threat_family": [
        "scanner"
    ],
    "confidence": 0.77,
    "classification_confidence": 0.77,
    "recommended_client_action": "monitor",
    "policy_mode": "intelligence",
    "sensor_role": "threat_intelligence",
    "event_signature": "dfa2ac8cdc963723f496f522009533dbcde60844",
    "protocol_details": {
        "http_method": "CONNECT",
        "http_path": "130.12.182.98:80",
        "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
        "port": 8090,
        "service": "http",
        "service_label_fr": "HTTP"
    },
    "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDphamVldA==",
    "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.98:80",
    "target_port_label": "8090 \u00b7 HTTP",
    "emulator_service": "http",
    "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
    "site_display": {
        "classification": null,
        "classification_reason": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "classification_reason_label_fr": "Type \u00ab web_probe \u00bb (signaux protocolaires) \u00b7 confiance 77%",
        "executive_one_liner_fr": "Activit\u00e9 suspecte \u00b7 risque 40\/100",
        "confidence_pct": 77,
        "confidence_breakdown": {
            "waf": 8,
            "classification": 38,
            "behavior": 0,
            "geo": 40,
            "protocol": 43,
            "novelty": 15,
            "risk_score": 40
        },
        "attack_stage": "probe",
        "attack_stage_label": "Sonde \/ probe",
        "attack_chain_stage": "discovery",
        "attack_chain_stage_label_fr": "D\u00e9couverte",
        "risk_score": 40,
        "risk_label": "Moyen",
        "service_name": "http",
        "service_label_fr": "HTTP",
        "dst_port": 8090,
        "protocol_emulated": true,
        "tags_summary": null,
        "tags_summary_labels_fr": null,
        "recommended_action": "monitor",
        "recommended_action_label": "Surveiller",
        "mitre": "TA0007",
        "mitre_technique": "TA0007",
        "persona_hostname": "mail.sensor-1.internal",
        "persona_service_banner": "honeypot-http",
        "correlation_flags": null,
        "correlation_flags_labels_fr": null,
        "sensor_role": "threat_intelligence",
        "sensor_role_label_fr": "Renseignement menaces",
        "confidence_hint_fr": null,
        "protocol_details": {
            "http_method": "CONNECT",
            "http_path": "130.12.182.98:80",
            "request_line": "CONNECT 130.12.182.98:80 HTTP\/1.1",
            "port": 8090,
            "service": "http",
            "service_label_fr": "HTTP"
        },
        "attack_vector": "Sonde HTTP \u00b7 via HTTP:8090 \u00b7 (sonde \/ probe) \u00b7 \u2192 130.12.182.98:80",
        "evidence_snippet": "CONNECT 130.12.182.98:80 HTTP\/1.0\r\nHost: 130.12.182.98:80\r\nProxy-Authorization: Basic cm9vdDphamVldA==",
        "target_port_label": "8090 \u00b7 HTTP",
        "emulator_service": "http",
        "confidence_reason": "Confiance 77 % \u2014 Score WAF 8",
        "confidence_factors_fr": "Confiance 77 % \u2014 Score WAF 8",
        "campaign_hint_fr": null,
        "attack_phases_timeline_fr": [
            {
                "key": "recon",
                "label_fr": "Reconnaissance",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "probe",
                "label_fr": "Sonde \/ probe",
                "active": true,
                "kind": "stage"
            },
            {
                "key": "exploit_attempt",
                "label_fr": "Tentative d'exploit",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "post_exploit",
                "label_fr": "Post-exploitation",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "c2",
                "label_fr": "Commande & contr\u00f4le",
                "active": false,
                "kind": "stage"
            },
            {
                "key": "discovery",
                "label_fr": "D\u00e9couverte",
                "active": true,
                "kind": "chain",
                "hint_fr": null
            }
        ]
    },
    "honeypot_persona": {
        "sensor_id": "sensor-1",
        "hostname": "mail.sensor-1.internal",
        "mail_host": "mail.sensor-1.internal",
        "ldap_dc": "dc.sensor-1.internal",
        "k8s_cluster": "hp-sensor-1",
        "domain": "sensor-1.internal",
        "service_role": "http",
        "service_banner": "honeypot-http",
        "service_os": "linux",
        "dst_port": "8090"
    },
    "hostname": "mail.sensor-1.internal",
    "sensor_id": "sensor-1",
    "attack_chain_stage": "discovery",
    "matched_patterns": [],
    "ban_policy": "advisory_monitor",
    "tags_list": [
        "http_dangerous_method",
        "http_method_uncommon",
        "http_no_ua",
        "net_web_probe"
    ],
    "asn_dc_heuristic": true
}