{"ip":"131.186.2.193","exported_at":"2026-10-24T08:18:49+00:00","period_days":30,"metrics":{"events7d":504,"distinct_ports":1,"distinct_classifications":5,"max_severity":7,"last_sensor_id":"paris-1","max_waf_score":null,"max_risk_score":51,"attack_stage":"exploit_attempt","attack_chain_stage":"exploitation","threat_family":["ddos"],"recommended_action":"investigate","confidence":1,"risk_breakdown":{"waf":8,"classification":80,"behavior":0,"geo":0,"protocol":33,"novelty":15},"mitre_tactics":["TA0001","TA0002"],"mitre_technique":"T1499","top_mitre_technique":"T1499","top_mitre_count":425,"executive_one_liner_fr":"Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTPS","campaign_hint_fr":null,"confidence_breakdown":{"waf":8,"classification":80,"behavior":0,"geo":0,"protocol":33,"novelty":15,"risk_score":51},"persona_hostname":"mail.sensor-1.internal","correlation_flags":[],"correlation_flags_labels_fr":[],"confidence_pct":100,"confidence_hint_fr":null,"sensor_role_label_fr":"Renseignement menaces","tags_summary_labels_fr":["MITRE-T1499","Upstream"],"tags_summary":["MITRE-T1499","INT-upstream"],"attack_vector":"http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)","protocol_details":{"payload_preview":"\u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\r\u0001m*\ufffd\ufffdc\ufffd\ufffdn\ufffd\u001c\u012e\ufffdh\ufffd#\ufffd\ufffd\u074a\ufffdyEn\ufffd\ufffda0\u0018 ~wlU\ufffd\ufffd\ufffd]M4\u003C\ufffd\/X\ufffd\ufffd\u003E\u0012\u003E\ufffd8s\ufffdk%b\ufffd\u0016\ufffd\ufffd\ufffd\ufffd\u0000\u0014\u0013\u0002\u0013\u0001\u0013\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\u0000\ufffd\u0001\u0000\u0000\ufffd\u0000\u000b\u0000\u0002\u0001\u0000\u0000-\u0000\u0002\u0001\u0001\u00003\u0000\u0026\u0000$\u0000\u001d\u0000 \ufffd.,\ufffd","tls_ja3":"728d0cd1bdc13a98b58130fae39cdc1f","tls_ja4":"5ff7ef500118cd328516d6a7943d8766","port":8443,"service":"https","service_label_fr":"HTTPS"},"protocol_summary_fr":"JA3 728d0cd1bdc13a98 \u00b7 Payload \u0016\u0003\u0001\u0000\ufffd\u0001\u0000\u0000\ufffd\u0003\u0003\ufffd\r\u0001m*\ufffd\ufffdc\ufffd\ufffdn\ufffd\u001c\u012e\ufffdh\ufffd#\ufffd\ufffd\u074a\ufffdyEn\ufffd\ufffda0\u0018 ~wlU\ufffd\ufffd\ufffd]M4\u003C\ufffd\/X\ufffd\ufffd\u003E\u0012\u003E\ufffd8\u2026 \u00b7 HTTPS:8443","evidence_snippet":"\ufffd\ufffd\ufffd\rm*\ufffd\ufffdc\ufffd\ufffdn\ufffd\u012e\ufffdh\ufffd#\ufffd\ufffd\u074a\ufffdyEn\ufffd\ufffda0 ~wlU\ufffd\ufffd\ufffd]M4\u003C\ufffd\/X\ufffd\ufffd\u003E\u003E\ufffd8s\ufffdk%b\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-3\u0026$ \ufffd.,\ufffd","target_port_label":"8443 \u00b7 HTTPS","emulator_service":"https","confidence_reason":"Confiance 100 % \u2014 3 signal(aux) capteur","classification_reason":"Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%","classification_reason_label_fr":"Type \u00ab Flood \/ DDoS \u00bb (signaux protocolaires) \u00b7 confiance 100%","confidence_factors_fr":"Confiance 100 % \u2014 Score WAF 8","payload_preview":"\ufffd\ufffd\ufffd\rm*\ufffd\ufffdc\ufffd\ufffdn\ufffd\u012e\ufffdh\ufffd#\ufffd\ufffd\u074a\ufffdyEn\ufffd\ufffda0 ~wlU\ufffd\ufffd\ufffd]M4\u003C\ufffd\/X\ufffd\ufffd\u003E\u003E\ufffd8s\ufffdk%b\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-3\u0026$ \ufffd.,\ufffd","open_intel":{"source":"Emerging Threats open","status":"ok","matched":false,"label_fr":null,"detail_fr":null},"open_intel_ipsum":{"source":"IPsum","status":"ok","matched":false,"label_fr":null,"detail_fr":null},"open_intel_cins":{"source":"CINS Army","status":"ok","matched":false,"label_fr":null,"detail_fr":null}},"dnsbl":{"query":"193.2.186.131.dnsbl.blacklistip.com","listed":false,"available":false,"response":null,"meaning":null,"label":null},"events":[{"id":6034092,"ip":"131.186.2.193","ts":"2026-10-21 14:55:35.000000","proto":"tcp","src_port":39646,"dst_port":8443,"service":"https","classification":"http_flood","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.827828594760538, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022602ecc7984feae22664230a9fc6b61e756fd9f12\u0022, \u0022event_fingerprint\u0022: \u00221268b50d410d1cdd8232ddd7c8594924aae881d7\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 147, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022matched_pattern_names\u0022: [\u0022PostgreSQL startup\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022], \u0022pattern_ids\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00225258b9666b04bbbb2470d5729f727cb0\u0022, \u0022path_pattern_hash\u0022: \u00224d7cc3b45cbf3e5b6ce484f88d569789\u0022, \u0022ja3\u0022: \u0022728d0cd1bdc13a98b58130fae39cdc1f\u0022, \u0022ja4\u0022: \u00225ff7ef500118cd328516d6a7943d8766\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022728d0cd1bdc13a98b58130fae39cdc1f\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,11-45-51-5-23-35-10-16-43-13,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00225ff7ef500118cd328516d6a7943d8766\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_db35716cfbd9_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 51}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\\r\\u0001m*\ufffd\ufffdc\ufffd\ufffdn\ufffd\\u001c\u012e\ufffdh\ufffd#\ufffd\ufffd\u074a\ufffdyEn\ufffd\ufffda0\\u0018 ~wlU\ufffd\ufffd\ufffd]M4\u003C\ufffd\/X\ufffd\ufffd\u003E\\u0012\u003E\ufffd8s\ufffdk%b\ufffd\\u0016\ufffd\ufffd\ufffd\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \ufffd.,\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\\r\\u0001m*\ufffd\ufffdc\ufffd\ufffdn\ufffd\\u001c\u012e\ufffdh\ufffd#\ufffd\ufffd\u074a\ufffdyEn\ufffd\ufffda0\\u0018 ~wlU\ufffd\ufffd\ufffd]M4\u003C\ufffd\/X\ufffd\ufffd\u003E\\u0012\u003E\ufffd8s\ufffdk%b\ufffd\\u0016\ufffd\ufffd\ufffd\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \ufffd.,\ufffdb\ufffd\ufffd\ufffd\ufffd\\u0004\ufffd\\u001fH\ufffd\ufffd\ufffdK\ufffd\\u0018\\u0015O*\\u0017\ufffd8\ufffd\\u0002\ufffd\ufffd\ufffd\\u0001k\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000#\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\\r\\u0001m*\ufffd\ufffdc\ufffd\ufffdn\ufffd\\u001c\u012e\ufffdh\ufffd#\ufffd\ufffd\u074a\ufffdyEn\ufffd\ufffda0\\u0018 ~wlU\ufffd\ufffd\ufffd]M4\u003C\ufffd\/X\ufffd\ufffd\u003E\\u0012\u003E\ufffd8s\ufffdk%b\ufffd\\u0016\ufffd\ufffd\ufffd\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \ufffd.,\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00227b43e01083610f96dc19d55919f511aba01dfe6b\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\\r\\u0001m*\ufffd\ufffdc\ufffd\ufffdn\ufffd\\u001c\u012e\ufffdh\ufffd#\ufffd\ufffd\u074a\ufffdyEn\ufffd\ufffda0\\u0018 ~wlU\ufffd\ufffd\ufffd]M4\u003C\ufffd\/X\ufffd\ufffd\u003E\\u0012\u003E\ufffd8s\ufffdk%b\ufffd\\u0016\ufffd\ufffd\ufffd\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \ufffd.,\ufffd\u0022, \u0022tls_ja3\u0022: \u0022728d0cd1bdc13a98b58130fae39cdc1f\u0022, \u0022tls_ja4\u0022: \u00225ff7ef500118cd328516d6a7943d8766\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\\rm*\ufffd\ufffdc\ufffd\ufffdn\ufffd\u012e\ufffdh\ufffd#\ufffd\ufffd\u074a\ufffdyEn\ufffd\ufffda0 ~wlU\ufffd\ufffd\ufffd]M4\u003C\ufffd\/X\ufffd\ufffd\u003E\u003E\ufffd8s\ufffdk%b\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-3\u0026$ \ufffd.,\ufffd\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTPS\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\\r\\u0001m*\ufffd\ufffdc\ufffd\ufffdn\ufffd\\u001c\u012e\ufffdh\ufffd#\ufffd\ufffd\u074a\ufffdyEn\ufffd\ufffda0\\u0018 ~wlU\ufffd\ufffd\ufffd]M4\u003C\ufffd\/X\ufffd\ufffd\u003E\\u0012\u003E\ufffd8s\ufffdk%b\ufffd\\u0016\ufffd\ufffd\ufffd\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \ufffd.,\ufffd\u0022, \u0022tls_ja3\u0022: \u0022728d0cd1bdc13a98b58130fae39cdc1f\u0022, \u0022tls_ja4\u0022: \u00225ff7ef500118cd328516d6a7943d8766\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\\rm*\ufffd\ufffdc\ufffd\ufffdn\ufffd\u012e\ufffdh\ufffd#\ufffd\ufffd\u074a\ufffdyEn\ufffd\ufffda0 ~wlU\ufffd\ufffd\ufffd]M4\u003C\ufffd\/X\ufffd\ufffd\u003E\u003E\ufffd8s\ufffdk%b\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-3\u0026$ \ufffd.,\ufffd\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":7,"bytes_in":241},{"id":6034091,"ip":"131.186.2.193","ts":"2026-10-21 14:55:35.000000","proto":"tcp","src_port":39700,"dst_port":8443,"service":"https","classification":"http_flood","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.809253943936366, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022602ecc7984feae22664230a9fc6b61e756fd9f12\u0022, \u0022event_fingerprint\u0022: \u00221268b50d410d1cdd8232ddd7c8594924aae881d7\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 147, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022a40081b8779facb8cc4c8db614e77500\u0022, \u0022path_pattern_hash\u0022: \u00224d7cc3b45cbf3e5b6ce484f88d569789\u0022, \u0022ja3\u0022: \u0022eb90e3b8b0d724cf986e09d5bf327940\u0022, \u0022ja4\u0022: \u00225bc1480ced607ac51b8d2e02d45317e3\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022eb90e3b8b0d724cf986e09d5bf327940\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,16-10-43-35-51-5-11-13-45-23,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00225bc1480ced607ac51b8d2e02d45317e3\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_9b4ea54ffcb0_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 51}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003e\u0027\ufffd\ufffd\\u0010X[\ufffd\ufffd\ufffd\ufffdOS`\ufffdDn\\u001c\ufffd\ufffd\ufffdX\ufffd_]\ufffd|\ufffd\ufffd\ufffd\\t \ufffd\ufffd\ufffd*\ufffdP\ufffdj\ufffdNY\ufffdFY\ufffd-\ufffdy\ufffd\ufffd\ufffd=ZL\u01a9:\\b\\u0010\ufffdb\\u0002\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003e\u0027\ufffd\ufffd\\u0010X[\ufffd\ufffd\ufffd\ufffdOS`\ufffdDn\\u001c\ufffd\ufffd\ufffdX\ufffd_]\ufffd|\ufffd\ufffd\ufffd\\t \ufffd\ufffd\ufffd*\ufffdP\ufffdj\ufffdNY\ufffdFY\ufffd-\ufffdy\ufffd\ufffd\ufffd=ZL\u01a9:\\b\\u0010\ufffdb\\u0002\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000#\\u0000\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \ufffdb\\\u0022\\u0000`\ufffdN\\u0002\ufffd-\u0463\ufffd\ufffd\\u000f\\u0002\ufffd\ufffd2\\u0010\u00a87\ufffd\ufffd\\u001cv$\ufffd\ufffd\/7\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u0017\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003e\u0027\ufffd\ufffd\\u0010X[\ufffd\ufffd\ufffd\ufffdOS`\ufffdDn\\u001c\ufffd\ufffd\ufffdX\ufffd_]\ufffd|\ufffd\ufffd\ufffd\\t \ufffd\ufffd\ufffd*\ufffdP\ufffdj\ufffdNY\ufffdFY\ufffd-\ufffdy\ufffd\ufffd\ufffd=ZL\u01a9:\\b\\u0010\ufffdb\\u0002\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002239a3a31976b5e2a692bd31dd12e99e57b3b9d2ef\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003e\u0027\ufffd\ufffd\\u0010X[\ufffd\ufffd\ufffd\ufffdOS`\ufffdDn\\u001c\ufffd\ufffd\ufffdX\ufffd_]\ufffd|\ufffd\ufffd\ufffd\\t \ufffd\ufffd\ufffd*\ufffdP\ufffdj\ufffdNY\ufffdFY\ufffd-\ufffdy\ufffd\ufffd\ufffd=ZL\u01a9:\\b\\u0010\ufffdb\\u0002\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\u0022, \u0022tls_ja3\u0022: \u0022eb90e3b8b0d724cf986e09d5bf327940\u0022, \u0022tls_ja4\u0022: \u00225bc1480ced607ac51b8d2e02d45317e3\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffde\u0027\ufffd\ufffdX[\ufffd\ufffd\ufffd\ufffdOS`\ufffdDn\ufffd\ufffd\ufffdX\ufffd_]\ufffd|\ufffd\ufffd\ufffd\\t \ufffd\ufffd\ufffd*\ufffdP\ufffdj\ufffdNY\ufffdFY\ufffd-\ufffdy\ufffd\ufffd\ufffd=ZL\u01a9:\ufffdb\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\\thttp\/1.1\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTPS\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003e\u0027\ufffd\ufffd\\u0010X[\ufffd\ufffd\ufffd\ufffdOS`\ufffdDn\\u001c\ufffd\ufffd\ufffdX\ufffd_]\ufffd|\ufffd\ufffd\ufffd\\t \ufffd\ufffd\ufffd*\ufffdP\ufffdj\ufffdNY\ufffdFY\ufffd-\ufffdy\ufffd\ufffd\ufffd=ZL\u01a9:\\b\\u0010\ufffdb\\u0002\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\u0022, \u0022tls_ja3\u0022: \u0022eb90e3b8b0d724cf986e09d5bf327940\u0022, \u0022tls_ja4\u0022: \u00225bc1480ced607ac51b8d2e02d45317e3\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffde\u0027\ufffd\ufffdX[\ufffd\ufffd\ufffd\ufffdOS`\ufffdDn\ufffd\ufffd\ufffdX\ufffd_]\ufffd|\ufffd\ufffd\ufffd\\t \ufffd\ufffd\ufffd*\ufffdP\ufffdj\ufffdNY\ufffdFY\ufffd-\ufffdy\ufffd\ufffd\ufffd=ZL\u01a9:\ufffdb\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\\thttp\/1.1\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":7,"bytes_in":241},{"id":6034086,"ip":"131.186.2.193","ts":"2026-10-21 14:55:35.000000","proto":"tcp","src_port":39298,"dst_port":8443,"service":"https","classification":"http_flood","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.874131421211885, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022602ecc7984feae22664230a9fc6b61e756fd9f12\u0022, \u0022event_fingerprint\u0022: \u00221268b50d410d1cdd8232ddd7c8594924aae881d7\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 147, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022matched_pattern_names\u0022: [\u0022PostgreSQL startup\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022], \u0022pattern_ids\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002284d4b58a8656d8bac62a80611c26a08f\u0022, \u0022path_pattern_hash\u0022: \u00224d7cc3b45cbf3e5b6ce484f88d569789\u0022, \u0022ja3\u0022: \u00228f10c1e28711950349491681e232f4d8\u0022, \u0022ja4\u0022: \u002284d01126948203f9b2e18cb68a2896fa\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u00228f10c1e28711950349491681e232f4d8\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,13-5-45-11-23-43-35-10-51-16,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u002284d01126948203f9b2e18cb68a2896fa\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_9b0e097dabbc_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 51}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\\u0006\\u0004I\\u001d\\n1\ufffd\ufffd\ufffd`\ufffd\ufffd$\ufffd\ufffdEBsj\ufffdU_\ufffd\\u001b\ufffd\ufffddM\ufffd\ufffd\ufffdt \ufffd\u0027\ufffd\ufffd\ufffd\ufffd\ufffd\\u0012\ufffdo\ufffdAH\ufffdi\ufffd\ufffd\u0486I*\\u0018\ufffdY\\b^\ufffd\\u0018F`$\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\\u0006\\u0004I\\u001d\\n1\ufffd\ufffd\ufffd`\ufffd\ufffd$\ufffd\ufffdEBsj\ufffdU_\ufffd\\u001b\ufffd\ufffddM\ufffd\ufffd\ufffdt \ufffd\u0027\ufffd\ufffd\ufffd\ufffd\ufffd\\u0012\ufffdo\ufffdAH\ufffdi\ufffd\ufffd\u0486I*\\u0018\ufffdY\\b^\ufffd\\u0018F`$\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000#\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \\u0000\ufffd\\u001c\ufffd1\\f@S\ufffdd\ufffdc\ufffdb\u0f61\ufffdU\ufffd\ufffdf\\u0016H\ufffdu\ufffd\ufffd\ufffd\ufffdf7\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\\u0006\\u0004I\\u001d\\n1\ufffd\ufffd\ufffd`\ufffd\ufffd$\ufffd\ufffdEBsj\ufffdU_\ufffd\\u001b\ufffd\ufffddM\ufffd\ufffd\ufffdt \ufffd\u0027\ufffd\ufffd\ufffd\ufffd\ufffd\\u0012\ufffdo\ufffdAH\ufffdi\ufffd\ufffd\u0486I*\\u0018\ufffdY\\b^\ufffd\\u0018F`$\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00227ca61f0af339c58013cc4b2bf919c02c9c7952da\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\\u0006\\u0004I\\u001d\\n1\ufffd\ufffd\ufffd`\ufffd\ufffd$\ufffd\ufffdEBsj\ufffdU_\ufffd\\u001b\ufffd\ufffddM\ufffd\ufffd\ufffdt \ufffd\u0027\ufffd\ufffd\ufffd\ufffd\ufffd\\u0012\ufffdo\ufffdAH\ufffdi\ufffd\ufffd\u0486I*\\u0018\ufffdY\\b^\ufffd\\u0018F`$\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\u0022, \u0022tls_ja3\u0022: \u00228f10c1e28711950349491681e232f4d8\u0022, \u0022tls_ja4\u0022: \u002284d01126948203f9b2e18cb68a2896fa\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdI\\n1\ufffd\ufffd\ufffd`\ufffd\ufffd$\ufffd\ufffdEBsj\ufffdU_\ufffd\ufffd\ufffddM\ufffd\ufffd\ufffdt \ufffd\u0027\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdo\ufffdAH\ufffdi\ufffd\ufffd\u0486I*\ufffdY^\ufffdF`$\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTPS\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\\u0006\\u0004I\\u001d\\n1\ufffd\ufffd\ufffd`\ufffd\ufffd$\ufffd\ufffdEBsj\ufffdU_\ufffd\\u001b\ufffd\ufffddM\ufffd\ufffd\ufffdt \ufffd\u0027\ufffd\ufffd\ufffd\ufffd\ufffd\\u0012\ufffdo\ufffdAH\ufffdi\ufffd\ufffd\u0486I*\\u0018\ufffdY\\b^\ufffd\\u0018F`$\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\u0022, \u0022tls_ja3\u0022: \u00228f10c1e28711950349491681e232f4d8\u0022, \u0022tls_ja4\u0022: \u002284d01126948203f9b2e18cb68a2896fa\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdI\\n1\ufffd\ufffd\ufffd`\ufffd\ufffd$\ufffd\ufffdEBsj\ufffdU_\ufffd\ufffd\ufffddM\ufffd\ufffd\ufffdt \ufffd\u0027\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdo\ufffdAH\ufffdi\ufffd\ufffd\u0486I*\ufffdY^\ufffdF`$\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":7,"bytes_in":241},{"id":6034085,"ip":"131.186.2.193","ts":"2026-10-21 14:55:35.000000","proto":"tcp","src_port":39168,"dst_port":8443,"service":"https","classification":"http_flood","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.878295477550682, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022602ecc7984feae22664230a9fc6b61e756fd9f12\u0022, \u0022event_fingerprint\u0022: \u00221268b50d410d1cdd8232ddd7c8594924aae881d7\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 147, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00228d6cbd8eafa2e28dc3591b39b6bdb052\u0022, \u0022path_pattern_hash\u0022: \u00224d7cc3b45cbf3e5b6ce484f88d569789\u0022, \u0022ja3\u0022: \u0022acc340af2da0dae21827dd53aa886502\u0022, \u0022ja4\u0022: \u0022d407f741458e7bd06782758a4b5f36a0\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022acc340af2da0dae21827dd53aa886502\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,35-23-43-11-51-10-45-16-5-13,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u0022d407f741458e7bd06782758a4b5f36a0\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_20de9cc218f0_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 51}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\\u0000\ufffd\\b(7\/\\u0012\\f\ufffd\ufffd\ufffd\ufffd{yjk\\\u0022;\ufffd\\u0011D\u0401\ufffd\ufffd\ufffd\u0026\ufffd*\u0026X \u003E\ufffd\ufffdt\\u001aq?PRrp\ufffd\ube61\ufffd\\u001e`\ufffd\ufffd\ufffd\ufffdf\\u0011\ufffdIT\ufffdH\ufffd\\u0005\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000#\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u00003\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\\u0000\ufffd\\b(7\/\\u0012\\f\ufffd\ufffd\ufffd\ufffd{yjk\\\u0022;\ufffd\\u0011D\u0401\ufffd\ufffd\ufffd\u0026\ufffd*\u0026X \u003E\ufffd\ufffdt\\u001aq?PRrp\ufffd\ube61\ufffd\\u001e`\ufffd\ufffd\ufffd\ufffdf\\u0011\ufffdIT\ufffdH\ufffd\\u0005\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000#\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 g\\nuu\ufffd\ufffd\\u0006\ufffdX\ufffdL7\\u0012\ufffd\ufffdJN#\ufffd}\ufffd\ufffd\u0199i\\u0015~+\\u0017v$\\u0011\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\\u0000\ufffd\\b(7\/\\u0012\\f\ufffd\ufffd\ufffd\ufffd{yjk\\\u0022;\ufffd\\u0011D\u0401\ufffd\ufffd\ufffd\u0026\ufffd*\u0026X \u003E\ufffd\ufffdt\\u001aq?PRrp\ufffd\ube61\ufffd\\u001e`\ufffd\ufffd\ufffd\ufffdf\\u0011\ufffdIT\ufffdH\ufffd\\u0005\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000#\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u00003\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022d5059ddf810fb61c95faf68156954043253672ca\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\\u0000\ufffd\\b(7\/\\u0012\\f\ufffd\ufffd\ufffd\ufffd{yjk\\\u0022;\ufffd\\u0011D\u0401\ufffd\ufffd\ufffd\u0026\ufffd*\u0026X \u003E\ufffd\ufffdt\\u001aq?PRrp\ufffd\ube61\ufffd\\u001e`\ufffd\ufffd\ufffd\ufffdf\\u0011\ufffdIT\ufffdH\ufffd\\u0005\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000#\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u00003\\u0000\u0022, \u0022tls_ja3\u0022: \u0022acc340af2da0dae21827dd53aa886502\u0022, \u0022tls_ja4\u0022: \u0022d407f741458e7bd06782758a4b5f36a0\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd(7\/\ufffd\ufffd\ufffd\ufffd{yjk\\\u0022;\ufffdD\u0401\ufffd\ufffd\ufffd\u0026\ufffd*\u0026X \u003E\ufffd\ufffdtq?PRrp\ufffd\ube61\ufffd`\ufffd\ufffd\ufffd\ufffdf\ufffdIT\ufffdH\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd#+3\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTPS\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\\u0000\ufffd\\b(7\/\\u0012\\f\ufffd\ufffd\ufffd\ufffd{yjk\\\u0022;\ufffd\\u0011D\u0401\ufffd\ufffd\ufffd\u0026\ufffd*\u0026X \u003E\ufffd\ufffdt\\u001aq?PRrp\ufffd\ube61\ufffd\\u001e`\ufffd\ufffd\ufffd\ufffdf\\u0011\ufffdIT\ufffdH\ufffd\\u0005\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000#\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u00003\\u0000\u0022, \u0022tls_ja3\u0022: \u0022acc340af2da0dae21827dd53aa886502\u0022, \u0022tls_ja4\u0022: \u0022d407f741458e7bd06782758a4b5f36a0\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd(7\/\ufffd\ufffd\ufffd\ufffd{yjk\\\u0022;\ufffdD\u0401\ufffd\ufffd\ufffd\u0026\ufffd*\u0026X \u003E\ufffd\ufffdtq?PRrp\ufffd\ube61\ufffd`\ufffd\ufffd\ufffd\ufffdf\ufffdIT\ufffdH\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd#+3\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":7,"bytes_in":241},{"id":6034084,"ip":"131.186.2.193","ts":"2026-10-21 14:55:35.000000","proto":"tcp","src_port":39292,"dst_port":8443,"service":"https","classification":"http_flood","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.899144325082917, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022602ecc7984feae22664230a9fc6b61e756fd9f12\u0022, \u0022event_fingerprint\u0022: \u00221268b50d410d1cdd8232ddd7c8594924aae881d7\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 147, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022matched_pattern_names\u0022: [\u0022PostgreSQL startup\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022], \u0022pattern_ids\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00226c0770d3c21ec0ba5087bf1c19000c2b\u0022, \u0022path_pattern_hash\u0022: \u00224d7cc3b45cbf3e5b6ce484f88d569789\u0022, \u0022ja3\u0022: \u002259874427c5c91637faad39c104bb55d7\u0022, \u0022ja4\u0022: \u0022fdeec8fd67812522e89f6319fbdb8864\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u002259874427c5c91637faad39c104bb55d7\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,43-11-5-45-16-23-35-10-51-13,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u0022fdeec8fd67812522e89f6319fbdb8864\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_b236453f7f96_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 51}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd \ufffd\ufffd\\u0018$P\\b\u0541\u0184\u05916ja\\u0013=M\u0633\u02fe\u003E\ufffd\u0026\ufffd\ufffdsL6 n\ufffdC\ufffdW\\\\\ufffd\ufffd7\ufffd\ufffdO\\u0014M\ufffdl\ufffd\ufffd\ufffd\ufffdB*\ufffdXs\ufffdf.\ufffddd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000-\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd \ufffd\ufffd\\u0018$P\\b\u0541\u0184\u05916ja\\u0013=M\u0633\u02fe\u003E\ufffd\u0026\ufffd\ufffdsL6 n\ufffdC\ufffdW\\\\\ufffd\ufffd7\ufffd\ufffdO\\u0014M\ufffdl\ufffd\ufffd\ufffd\ufffdB*\ufffdXs\ufffdf.\ufffddd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\u0017\\u0000\\u0000\\u0000#\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \ufffde\\u0019\ufffd\ufffdF\ufffd.qY\ufffd\ufffd2\ufffda\ufffd\u05e6%\ufffd\ufffd \ud9e2\udf27\ufffd=\ufffd\\u0005\ufffd\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd \ufffd\ufffd\\u0018$P\\b\u0541\u0184\u05916ja\\u0013=M\u0633\u02fe\u003E\ufffd\u0026\ufffd\ufffdsL6 n\ufffdC\ufffdW\\\\\ufffd\ufffd7\ufffd\ufffdO\\u0014M\ufffdl\ufffd\ufffd\ufffd\ufffdB*\ufffdXs\ufffdf.\ufffddd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000-\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00223c87c2e45f40190f4621742600c4e5050b551a7e\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd \ufffd\ufffd\\u0018$P\\b\u0541\u0184\u05916ja\\u0013=M\u0633\u02fe\u003E\ufffd\u0026\ufffd\ufffdsL6 n\ufffdC\ufffdW\\\\\ufffd\ufffd7\ufffd\ufffdO\\u0014M\ufffdl\ufffd\ufffd\ufffd\ufffdB*\ufffdXs\ufffdf.\ufffddd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000-\u0022, \u0022tls_ja3\u0022: \u002259874427c5c91637faad39c104bb55d7\u0022, \u0022tls_ja4\u0022: \u0022fdeec8fd67812522e89f6319fbdb8864\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd \ufffd\ufffd$P\u0541\u0184\u05916ja=M\u0633\u02fe\u003E\ufffd\u0026\ufffd\ufffdsL6 n\ufffdC\ufffdW\\\\\ufffd\ufffd7\ufffd\ufffdOM\ufffdl\ufffd\ufffd\ufffd\ufffdB*\ufffdXs\ufffdf.\ufffddd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd+-\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTPS\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd \ufffd\ufffd\\u0018$P\\b\u0541\u0184\u05916ja\\u0013=M\u0633\u02fe\u003E\ufffd\u0026\ufffd\ufffdsL6 n\ufffdC\ufffdW\\\\\ufffd\ufffd7\ufffd\ufffdO\\u0014M\ufffdl\ufffd\ufffd\ufffd\ufffdB*\ufffdXs\ufffdf.\ufffddd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000-\u0022, \u0022tls_ja3\u0022: \u002259874427c5c91637faad39c104bb55d7\u0022, \u0022tls_ja4\u0022: \u0022fdeec8fd67812522e89f6319fbdb8864\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd \ufffd\ufffd$P\u0541\u0184\u05916ja=M\u0633\u02fe\u003E\ufffd\u0026\ufffd\ufffdsL6 n\ufffdC\ufffdW\\\\\ufffd\ufffd7\ufffd\ufffdOM\ufffdl\ufffd\ufffd\ufffd\ufffdB*\ufffdXs\ufffdf.\ufffddd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd+-\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":7,"bytes_in":241},{"id":6034083,"ip":"131.186.2.193","ts":"2026-10-21 14:55:35.000000","proto":"tcp","src_port":39918,"dst_port":8443,"service":"https","classification":"http_flood","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.840791446507156, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022602ecc7984feae22664230a9fc6b61e756fd9f12\u0022, \u0022event_fingerprint\u0022: \u00221268b50d410d1cdd8232ddd7c8594924aae881d7\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 147, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00228df4ff0638d0c35597dfd698cd58d6b0\u0022, \u0022path_pattern_hash\u0022: \u00224d7cc3b45cbf3e5b6ce484f88d569789\u0022, \u0022ja3\u0022: \u0022b6c13f688993475a60b02440b6697f5c\u0022, \u0022ja4\u0022: \u0022aeb56191d30beb90fe2116bc358e4703\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022b6c13f688993475a60b02440b6697f5c\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,10-35-11-43-23-5-51-45-13-16,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u0022aeb56191d30beb90fe2116bc358e4703\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_f2881f007bed_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 51}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003:8\ufffd\ufffd\ufffdO\ufffd\ufffd\ufffd\ufffdn\ufffd\ufffd\ufffd\\u0015s\ufffdtF=\ufffd\ufffdX\ufffd\ufffd\ufffd\ufffd. \ufffdn\\u0001eS\ufffd\u031b\ufffd}\\u0017{P\ufffdh\ufffdb\ufffd\u00e0Hd\\u0001\ufffd\ufffdz\ufffd\ufffd]\\u0010}\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000#\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000+\\u0000\\u0005\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003:8\ufffd\ufffd\ufffdO\ufffd\ufffd\ufffd\ufffdn\ufffd\ufffd\ufffd\\u0015s\ufffdtF=\ufffd\ufffdX\ufffd\ufffd\ufffd\ufffd. \ufffdn\\u0001eS\ufffd\u031b\ufffd}\\u0017{P\ufffdh\ufffdb\ufffd\u00e0Hd\\u0001\ufffd\ufffdz\ufffd\ufffd]\\u0010}\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000#\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\u0017\\u0000\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 Z\\u0000\\u001e\ufffd7z~\ufffd\u003Ep\ufffd\ufffd%wu\\u0001{4e\ufffd\u003E\ufffdO\u018e\u003E;\ufffd\ufffd\ufffd0\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003:8\ufffd\ufffd\ufffdO\ufffd\ufffd\ufffd\ufffdn\ufffd\ufffd\ufffd\\u0015s\ufffdtF=\ufffd\ufffdX\ufffd\ufffd\ufffd\ufffd. \ufffdn\\u0001eS\ufffd\u031b\ufffd}\\u0017{P\ufffdh\ufffdb\ufffd\u00e0Hd\\u0001\ufffd\ufffdz\ufffd\ufffd]\\u0010}\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000#\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000+\\u0000\\u0005\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022b755c7809172e4aec44e50a9bd647fec6191db56\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003:8\ufffd\ufffd\ufffdO\ufffd\ufffd\ufffd\ufffdn\ufffd\ufffd\ufffd\\u0015s\ufffdtF=\ufffd\ufffdX\ufffd\ufffd\ufffd\ufffd. \ufffdn\\u0001eS\ufffd\u031b\ufffd}\\u0017{P\ufffdh\ufffdb\ufffd\u00e0Hd\\u0001\ufffd\ufffdz\ufffd\ufffd]\\u0010}\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000#\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000+\\u0000\\u0005\u0022, \u0022tls_ja3\u0022: \u0022b6c13f688993475a60b02440b6697f5c\u0022, \u0022tls_ja4\u0022: \u0022aeb56191d30beb90fe2116bc358e4703\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd:8\ufffd\ufffd\ufffdO\ufffd\ufffd\ufffd\ufffdn\ufffd\ufffd\ufffds\ufffdtF=\ufffd\ufffdX\ufffd\ufffd\ufffd\ufffd. \ufffdneS\ufffd\u031b\ufffd}{P\ufffdh\ufffdb\ufffd\u00e0Hd\ufffd\ufffdz\ufffd\ufffd]}\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\\n#+\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTPS\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003:8\ufffd\ufffd\ufffdO\ufffd\ufffd\ufffd\ufffdn\ufffd\ufffd\ufffd\\u0015s\ufffdtF=\ufffd\ufffdX\ufffd\ufffd\ufffd\ufffd. \ufffdn\\u0001eS\ufffd\u031b\ufffd}\\u0017{P\ufffdh\ufffdb\ufffd\u00e0Hd\\u0001\ufffd\ufffdz\ufffd\ufffd]\\u0010}\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000#\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000+\\u0000\\u0005\u0022, \u0022tls_ja3\u0022: \u0022b6c13f688993475a60b02440b6697f5c\u0022, \u0022tls_ja4\u0022: \u0022aeb56191d30beb90fe2116bc358e4703\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd:8\ufffd\ufffd\ufffdO\ufffd\ufffd\ufffd\ufffdn\ufffd\ufffd\ufffds\ufffdtF=\ufffd\ufffdX\ufffd\ufffd\ufffd\ufffd. \ufffdneS\ufffd\u031b\ufffd}{P\ufffdh\ufffdb\ufffd\u00e0Hd\ufffd\ufffdz\ufffd\ufffd]}\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\\n#+\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":7,"bytes_in":241},{"id":6034082,"ip":"131.186.2.193","ts":"2026-10-21 14:55:35.000000","proto":"tcp","src_port":39644,"dst_port":8443,"service":"https","classification":"http_flood","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.801245453533399, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022602ecc7984feae22664230a9fc6b61e756fd9f12\u0022, \u0022event_fingerprint\u0022: \u00221268b50d410d1cdd8232ddd7c8594924aae881d7\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 147, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022matched_pattern_names\u0022: [\u0022PostgreSQL startup\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022], \u0022pattern_ids\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022e126520f99140a47d1c7ca92e4507c9f\u0022, \u0022path_pattern_hash\u0022: \u00224d7cc3b45cbf3e5b6ce484f88d569789\u0022, \u0022ja3\u0022: \u00222201dd78f7a90bcad20ae9ef785c83d3\u0022, \u0022ja4\u0022: \u0022c32eb5ff1e06e712f388eb0804bbd87b\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u00222201dd78f7a90bcad20ae9ef785c83d3\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,45-51-5-11-13-16-43-35-23-10,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u0022c32eb5ff1e06e712f388eb0804bbd87b\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_b31ef6cdd8bf_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 51}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\\u000e\\u001f\\\\F|-\ufffd\\u001au\ufffdY\ufffdR\ufffdB\\ft\\n:\ufffd!ik \ufffd\\u0012K,Q2\ufffd\ufffd \ufffd\ufffdf\ufffd\u0684\ufffd\ufffd\u042b\ufffd\\u001e\\u001c\ufffd\\u0010f\\f\ufffd\ufffd\\u0011\\u0002\ufffd\\u0013O\\u001a+$\ufffd\ufffdt%o\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000-\\u0000\\u0002\\u0001\\u0001\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 )\ufffdB \ufffd#\ufffdPoM\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\\u000e\\u001f\\\\F|-\ufffd\\u001au\ufffdY\ufffdR\ufffdB\\ft\\n:\ufffd!ik \ufffd\\u0012K,Q2\ufffd\ufffd \ufffd\ufffdf\ufffd\u0684\ufffd\ufffd\u042b\ufffd\\u001e\\u001c\ufffd\\u0010f\\f\ufffd\ufffd\\u0011\\u0002\ufffd\\u0013O\\u001a+$\ufffd\ufffdt%o\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000-\\u0000\\u0002\\u0001\\u0001\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 )\ufffdB \ufffd#\ufffdPoM\\u0005\\u000e-\ufffd\\u0006\ufffd\ufffd:p\\u0005\ufffd\ufffd\\u001e\ufffd\ufffd\ufffd6x\ufffd\ufffduo\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000#\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\\u000e\\u001f\\\\F|-\ufffd\\u001au\ufffdY\ufffdR\ufffdB\\ft\\n:\ufffd!ik \ufffd\\u0012K,Q2\ufffd\ufffd \ufffd\ufffdf\ufffd\u0684\ufffd\ufffd\u042b\ufffd\\u001e\\u001c\ufffd\\u0010f\\f\ufffd\ufffd\\u0011\\u0002\ufffd\\u0013O\\u001a+$\ufffd\ufffdt%o\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000-\\u0000\\u0002\\u0001\\u0001\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 )\ufffdB \ufffd#\ufffdPoM\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022ee6b5ce8d6392b664367a57ef3c127e1945f05af\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\\u000e\\u001f\\\\F|-\ufffd\\u001au\ufffdY\ufffdR\ufffdB\\ft\\n:\ufffd!ik \ufffd\\u0012K,Q2\ufffd\ufffd \ufffd\ufffdf\ufffd\u0684\ufffd\ufffd\u042b\ufffd\\u001e\\u001c\ufffd\\u0010f\\f\ufffd\ufffd\\u0011\\u0002\ufffd\\u0013O\\u001a+$\ufffd\ufffdt%o\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000-\\u0000\\u0002\\u0001\\u0001\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 )\ufffdB \ufffd#\ufffdPoM\u0022, \u0022tls_ja3\u0022: \u00222201dd78f7a90bcad20ae9ef785c83d3\u0022, \u0022tls_ja4\u0022: \u0022c32eb5ff1e06e712f388eb0804bbd87b\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\\\\F|-\ufffdu\ufffdY\ufffdR\ufffdBt\\n:\ufffd!ik \ufffdK,Q2\ufffd\ufffd \ufffd\ufffdf\ufffd\u0684\ufffd\ufffd\u042b\ufffd\ufffdf\ufffd\ufffd\ufffdO+$\ufffd\ufffdt%o\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-3\u0026$ )\ufffdB \ufffd#\ufffdPoM\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTPS\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\\u000e\\u001f\\\\F|-\ufffd\\u001au\ufffdY\ufffdR\ufffdB\\ft\\n:\ufffd!ik \ufffd\\u0012K,Q2\ufffd\ufffd \ufffd\ufffdf\ufffd\u0684\ufffd\ufffd\u042b\ufffd\\u001e\\u001c\ufffd\\u0010f\\f\ufffd\ufffd\\u0011\\u0002\ufffd\\u0013O\\u001a+$\ufffd\ufffdt%o\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000-\\u0000\\u0002\\u0001\\u0001\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 )\ufffdB \ufffd#\ufffdPoM\u0022, \u0022tls_ja3\u0022: \u00222201dd78f7a90bcad20ae9ef785c83d3\u0022, \u0022tls_ja4\u0022: \u0022c32eb5ff1e06e712f388eb0804bbd87b\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\\\\F|-\ufffdu\ufffdY\ufffdR\ufffdBt\\n:\ufffd!ik \ufffdK,Q2\ufffd\ufffd \ufffd\ufffdf\ufffd\u0684\ufffd\ufffd\u042b\ufffd\ufffdf\ufffd\ufffd\ufffdO+$\ufffd\ufffdt%o\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-3\u0026$ )\ufffdB \ufffd#\ufffdPoM\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":7,"bytes_in":241},{"id":6034081,"ip":"131.186.2.193","ts":"2026-10-21 14:55:35.000000","proto":"tcp","src_port":39986,"dst_port":8443,"service":"https","classification":"http_flood","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.901862258825879, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022602ecc7984feae22664230a9fc6b61e756fd9f12\u0022, \u0022event_fingerprint\u0022: \u00221268b50d410d1cdd8232ddd7c8594924aae881d7\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 147, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022matched_pattern_names\u0022: [\u0022PostgreSQL startup\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022], \u0022pattern_ids\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002258d06adc0d2252b125d6e0e9286b5db5\u0022, \u0022path_pattern_hash\u0022: \u00224d7cc3b45cbf3e5b6ce484f88d569789\u0022, \u0022ja3\u0022: \u00221b6aa73eeba84d8b93a7d866d76ce05f\u0022, \u0022ja4\u0022: \u00222e1021c7f9a19474fbd640e8db9e7675\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u00221b6aa73eeba84d8b93a7d866d76ce05f\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,43-51-45-11-23-13-35-16-5-10,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00222e1021c7f9a19474fbd640e8db9e7675\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_33480abaa14f_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 51}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffds\ufffd\ufffdgY\ufffdY\\u000fA\ufffdn?\ufffd\\u0005\\u0019\ufffdw\\u001az\ufffd\\u000f\\u001c9^U\ufffd9\\u0019\ufffdH\ufffd \ufffd9\\u001b\ufffd\ufffd2\\\\\ufffd\ufffd\ufffd\ufffdi\ufffd\\u001e\/\ufffdEy\ufffd\ufffdnR\\u001a\ufffd)J\\u001f\u0027`\\u0006\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \u07b0\ufffd\u022f\ufffds\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffds\ufffd\ufffdgY\ufffdY\\u000fA\ufffdn?\ufffd\\u0005\\u0019\ufffdw\\u001az\ufffd\\u000f\\u001c9^U\ufffd9\\u0019\ufffdH\ufffd \ufffd9\\u001b\ufffd\ufffd2\\\\\ufffd\ufffd\ufffd\ufffdi\ufffd\\u001e\/\ufffdEy\ufffd\ufffdnR\\u001a\ufffd)J\\u001f\u0027`\\u0006\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \u07b0\ufffd\u022f\ufffds\ufffd\ufffd\\u00135\\u0010*Gw\ufffdM\ufffd}X\ufffd9\ufffdc\\u001f\ufffd\ufffdY\ua4eb\\u000e\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000#\\u0000\\u0000\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffds\ufffd\ufffdgY\ufffdY\\u000fA\ufffdn?\ufffd\\u0005\\u0019\ufffdw\\u001az\ufffd\\u000f\\u001c9^U\ufffd9\\u0019\ufffdH\ufffd \ufffd9\\u001b\ufffd\ufffd2\\\\\ufffd\ufffd\ufffd\ufffdi\ufffd\\u001e\/\ufffdEy\ufffd\ufffdnR\\u001a\ufffd)J\\u001f\u0027`\\u0006\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \u07b0\ufffd\u022f\ufffds\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022fa78d110bf9f0e3a47fdd5f6c258c43ffbcad93e\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffds\ufffd\ufffdgY\ufffdY\\u000fA\ufffdn?\ufffd\\u0005\\u0019\ufffdw\\u001az\ufffd\\u000f\\u001c9^U\ufffd9\\u0019\ufffdH\ufffd \ufffd9\\u001b\ufffd\ufffd2\\\\\ufffd\ufffd\ufffd\ufffdi\ufffd\\u001e\/\ufffdEy\ufffd\ufffdnR\\u001a\ufffd)J\\u001f\u0027`\\u0006\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \u07b0\ufffd\u022f\ufffds\u0022, \u0022tls_ja3\u0022: \u00221b6aa73eeba84d8b93a7d866d76ce05f\u0022, \u0022tls_ja4\u0022: \u00222e1021c7f9a19474fbd640e8db9e7675\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffds\ufffd\ufffdgY\ufffdYA\ufffdn?\ufffd\ufffdwz\ufffd9^U\ufffd9\ufffdH\ufffd \ufffd9\ufffd\ufffd2\\\\\ufffd\ufffd\ufffd\ufffdi\ufffd\/\ufffdEy\ufffd\ufffdnR\ufffd)J\u0027`\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd+3\u0026$ \u07b0\ufffd\u022f\ufffds\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTPS\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffds\ufffd\ufffdgY\ufffdY\\u000fA\ufffdn?\ufffd\\u0005\\u0019\ufffdw\\u001az\ufffd\\u000f\\u001c9^U\ufffd9\\u0019\ufffdH\ufffd \ufffd9\\u001b\ufffd\ufffd2\\\\\ufffd\ufffd\ufffd\ufffdi\ufffd\\u001e\/\ufffdEy\ufffd\ufffdnR\\u001a\ufffd)J\\u001f\u0027`\\u0006\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \u07b0\ufffd\u022f\ufffds\u0022, \u0022tls_ja3\u0022: \u00221b6aa73eeba84d8b93a7d866d76ce05f\u0022, \u0022tls_ja4\u0022: \u00222e1021c7f9a19474fbd640e8db9e7675\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffds\ufffd\ufffdgY\ufffdYA\ufffdn?\ufffd\ufffdwz\ufffd9^U\ufffd9\ufffdH\ufffd \ufffd9\ufffd\ufffd2\\\\\ufffd\ufffd\ufffd\ufffdi\ufffd\/\ufffdEy\ufffd\ufffdnR\ufffd)J\u0027`\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd+3\u0026$ \u07b0\ufffd\u022f\ufffds\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":7,"bytes_in":241},{"id":6034080,"ip":"131.186.2.193","ts":"2026-10-21 14:55:35.000000","proto":"tcp","src_port":39488,"dst_port":8443,"service":"https","classification":"http_flood","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.807546581858319, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022602ecc7984feae22664230a9fc6b61e756fd9f12\u0022, \u0022event_fingerprint\u0022: \u00221268b50d410d1cdd8232ddd7c8594924aae881d7\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 147, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022c100e5e0f8a5024da3258614035f1d64\u0022, \u0022path_pattern_hash\u0022: \u00224d7cc3b45cbf3e5b6ce484f88d569789\u0022, \u0022ja3\u0022: \u0022d66e252ca9edb1ec5197bc6686d2e11b\u0022, \u0022ja4\u0022: \u00220feff5de776764094777087444935012\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022d66e252ca9edb1ec5197bc6686d2e11b\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,23-45-5-11-43-16-13-35-51-10,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00220feff5de776764094777087444935012\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_4ef16725ffb6_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 51}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003vd)\ufffd\ufffd@\ufffd\ufffd\ufffd6\ufffdq\\u0018\ufffd\ufffd\ufffdr\ufffd^\ufffdc\ufffdv\ufffd\u0026d\/\ufffd \\u000f\ufffd\\u001c\u0026\ufffd\\u00031\\u0002\\u001d\u0027\ufffd\\u001fx\\u000e\ufffdI\ufffd5\\u0005\\u001a\u0570\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0017\\u0000\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003vd)\ufffd\ufffd@\ufffd\ufffd\ufffd6\ufffdq\\u0018\ufffd\ufffd\ufffdr\ufffd^\ufffdc\ufffdv\ufffd\u0026d\/\ufffd \\u000f\ufffd\\u001c\u0026\ufffd\\u00031\\u0002\\u001d\u0027\ufffd\\u001fx\\u000e\ufffdI\ufffd5\\u0005\\u001a\u0570\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0017\\u0000\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000#\\u0000\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \\u0016\ufffd\\u0014s\ufffd\ufffd\ufffd;\ufffd}\ufffd\\b-\ufffd\\u0001\ufffd\u0026,R|M\\u0004\u0026iR\\u001fK\ufffd\ufffdJ\\u001a\\u0005\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003vd)\ufffd\ufffd@\ufffd\ufffd\ufffd6\ufffdq\\u0018\ufffd\ufffd\ufffdr\ufffd^\ufffdc\ufffdv\ufffd\u0026d\/\ufffd \\u000f\ufffd\\u001c\u0026\ufffd\\u00031\\u0002\\u001d\u0027\ufffd\\u001fx\\u000e\ufffdI\ufffd5\\u0005\\u001a\u0570\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0017\\u0000\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00222bf1b47f58e0081f007f8b18a9a6dbdb5c7b65f3\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003vd)\ufffd\ufffd@\ufffd\ufffd\ufffd6\ufffdq\\u0018\ufffd\ufffd\ufffdr\ufffd^\ufffdc\ufffdv\ufffd\u0026d\/\ufffd \\u000f\ufffd\\u001c\u0026\ufffd\\u00031\\u0002\\u001d\u0027\ufffd\\u001fx\\u000e\ufffdI\ufffd5\\u0005\\u001a\u0570\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0017\\u0000\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u0022d66e252ca9edb1ec5197bc6686d2e11b\u0022, \u0022tls_ja4\u0022: \u00220feff5de776764094777087444935012\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdvd)\ufffd\ufffd@\ufffd\ufffd\ufffd6\ufffdq\ufffd\ufffd\ufffdr\ufffd^\ufffdc\ufffdv\ufffd\u0026d\/\ufffd \ufffd\u0026\ufffd1\u0027\ufffdx\ufffdI\ufffd5\u0570\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTPS\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003vd)\ufffd\ufffd@\ufffd\ufffd\ufffd6\ufffdq\\u0018\ufffd\ufffd\ufffdr\ufffd^\ufffdc\ufffdv\ufffd\u0026d\/\ufffd \\u000f\ufffd\\u001c\u0026\ufffd\\u00031\\u0002\\u001d\u0027\ufffd\\u001fx\\u000e\ufffdI\ufffd5\\u0005\\u001a\u0570\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0017\\u0000\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\u0022, \u0022tls_ja3\u0022: \u0022d66e252ca9edb1ec5197bc6686d2e11b\u0022, \u0022tls_ja4\u0022: \u00220feff5de776764094777087444935012\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdvd)\ufffd\ufffd@\ufffd\ufffd\ufffd6\ufffdq\ufffd\ufffd\ufffdr\ufffd^\ufffdc\ufffdv\ufffd\u0026d\/\ufffd \ufffd\u0026\ufffd1\u0027\ufffdx\ufffdI\ufffd5\u0570\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\\\\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":7,"bytes_in":241},{"id":6034079,"ip":"131.186.2.193","ts":"2026-10-21 14:55:35.000000","proto":"tcp","src_port":39394,"dst_port":8443,"service":"https","classification":"http_flood","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.84772792929134, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022602ecc7984feae22664230a9fc6b61e756fd9f12\u0022, \u0022event_fingerprint\u0022: \u00221268b50d410d1cdd8232ddd7c8594924aae881d7\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 147, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022matched_pattern_names\u0022: [\u0022PostgreSQL startup\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022], \u0022pattern_ids\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022b0ba89a3b3d8f36f16e1885e4bb21c5c\u0022, \u0022path_pattern_hash\u0022: \u00224d7cc3b45cbf3e5b6ce484f88d569789\u0022, \u0022ja3\u0022: \u0022e8d1fa1da56a157d5c649354b4e7a24c\u0022, \u0022ja4\u0022: \u00229ef6b6b95c47a2afab7faff0841cf6ac\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022e8d1fa1da56a157d5c649354b4e7a24c\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,11-45-51-43-5-23-16-13-35-10,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00229ef6b6b95c47a2afab7faff0841cf6ac\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_3634a51c8b8f_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 51}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\\b\ufffd\ufffd\ufffd\ufffd\\f\\u001eo o[\ufffd\ufffdG0\ufffd:Zs\ufffdK$\ufffduB\ufffd\\u0007\\u000e\ufffd\\u001a \ufffdN\ufffd\\u0000\ufffdQ\ufffd\\u001aX\ufffdY\ufffd\ufffd[f\ufffd3\ufffd\u02b1\ufffd\ufffd\\u0012\ufffd9\ufffd\ufffdV\\u0006Z;\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \\u0007\ufffd\ufffd(\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\\b\ufffd\ufffd\ufffd\ufffd\\f\\u001eo o[\ufffd\ufffdG0\ufffd:Zs\ufffdK$\ufffduB\ufffd\\u0007\\u000e\ufffd\\u001a \ufffdN\ufffd\\u0000\ufffdQ\ufffd\\u001aX\ufffdY\ufffd\ufffd[f\ufffd3\ufffd\u02b1\ufffd\ufffd\\u0012\ufffd9\ufffd\ufffdV\\u0006Z;\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \\u0007\ufffd\ufffd(\ufffd\u003C#*\ufffd\\u0018\ufffd4\ufffde\\r\ufffd\ufffd\ufffd\ufffd\ufffd*\ufffd(\\u0014\\u000e\\u0000\ufffdL\ufffdfPY\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000#\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\\b\ufffd\ufffd\ufffd\ufffd\\f\\u001eo o[\ufffd\ufffdG0\ufffd:Zs\ufffdK$\ufffduB\ufffd\\u0007\\u000e\ufffd\\u001a \ufffdN\ufffd\\u0000\ufffdQ\ufffd\\u001aX\ufffdY\ufffd\ufffd[f\ufffd3\ufffd\u02b1\ufffd\ufffd\\u0012\ufffd9\ufffd\ufffdV\\u0006Z;\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \\u0007\ufffd\ufffd(\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022ce1ec750158754d155d85ada5dfb8573d9cfde15\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\\b\ufffd\ufffd\ufffd\ufffd\\f\\u001eo o[\ufffd\ufffdG0\ufffd:Zs\ufffdK$\ufffduB\ufffd\\u0007\\u000e\ufffd\\u001a \ufffdN\ufffd\\u0000\ufffdQ\ufffd\\u001aX\ufffdY\ufffd\ufffd[f\ufffd3\ufffd\u02b1\ufffd\ufffd\\u0012\ufffd9\ufffd\ufffdV\\u0006Z;\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \\u0007\ufffd\ufffd(\u0022, \u0022tls_ja3\u0022: \u0022e8d1fa1da56a157d5c649354b4e7a24c\u0022, \u0022tls_ja4\u0022: \u00229ef6b6b95c47a2afab7faff0841cf6ac\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdo o[\ufffd\ufffdG0\ufffd:Zs\ufffdK$\ufffduB\ufffd\ufffd \ufffdN\ufffd\ufffdQ\ufffdX\ufffdY\ufffd\ufffd[f\ufffd3\ufffd\u02b1\ufffd\ufffd\ufffd9\ufffd\ufffdVZ;\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-3\u0026$ \ufffd\ufffd(\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTPS\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\\b\ufffd\ufffd\ufffd\ufffd\\f\\u001eo o[\ufffd\ufffdG0\ufffd:Zs\ufffdK$\ufffduB\ufffd\\u0007\\u000e\ufffd\\u001a \ufffdN\ufffd\\u0000\ufffdQ\ufffd\\u001aX\ufffdY\ufffd\ufffd[f\ufffd3\ufffd\u02b1\ufffd\ufffd\\u0012\ufffd9\ufffd\ufffdV\\u0006Z;\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \\u0007\ufffd\ufffd(\u0022, \u0022tls_ja3\u0022: \u0022e8d1fa1da56a157d5c649354b4e7a24c\u0022, \u0022tls_ja4\u0022: \u00229ef6b6b95c47a2afab7faff0841cf6ac\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdo o[\ufffd\ufffdG0\ufffd:Zs\ufffdK$\ufffduB\ufffd\ufffd \ufffdN\ufffd\ufffdQ\ufffdX\ufffdY\ufffd\ufffd[f\ufffd3\ufffd\u02b1\ufffd\ufffd\ufffd9\ufffd\ufffdVZ;\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-3\u0026$ \ufffd\ufffd(\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":7,"bytes_in":241},{"id":6034078,"ip":"131.186.2.193","ts":"2026-10-21 14:55:35.000000","proto":"tcp","src_port":40080,"dst_port":8443,"service":"https","classification":"http_flood","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.856725990947962, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022602ecc7984feae22664230a9fc6b61e756fd9f12\u0022, \u0022event_fingerprint\u0022: \u00221268b50d410d1cdd8232ddd7c8594924aae881d7\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 147, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022matched_pattern_names\u0022: [\u0022PostgreSQL startup\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022], \u0022pattern_ids\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022dc6664a970d92a3ceef0b6789e99d7c1\u0022, \u0022path_pattern_hash\u0022: \u00224d7cc3b45cbf3e5b6ce484f88d569789\u0022, \u0022ja3\u0022: \u002296d467f211fd709f5ae25740fe69d0b7\u0022, \u0022ja4\u0022: \u00229a25f1cf7ebeef3a40e8ae82689768a3\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u002296d467f211fd709f5ae25740fe69d0b7\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,13-51-45-16-35-23-11-43-5-10,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00229a25f1cf7ebeef3a40e8ae82689768a3\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_4d3050bdc6ff_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 51}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003[t\\u0005\ufffdC\ufffd\u07d2\\t\ufffd\ufffdr\ufffdI\ufffd\\u0015\ufffd!\ufffd\ufffd+O6\ufffd\\u000f\ufffd\ufffd\ufffd\ufffd\ufffd\\u0013\ufffd \\t\ufffd!\ufffd\u003C\\u0005\ufffdq\ufffd\ufffd~\ufffd)\ufffdB\ufffd.\\u0010\ufffd!t\u077f(\ufffd[\ufffdV\ufffd\\u0005sS\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003[t\\u0005\ufffdC\ufffd\u07d2\\t\ufffd\ufffdr\ufffdI\ufffd\\u0015\ufffd!\ufffd\ufffd+O6\ufffd\\u000f\ufffd\ufffd\ufffd\ufffd\ufffd\\u0013\ufffd \\t\ufffd!\ufffd\u003C\\u0005\ufffdq\ufffd\ufffd~\ufffd)\ufffdB\ufffd.\\u0010\ufffd!t\u077f(\ufffd[\ufffdV\ufffd\\u0005sS\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \ufffdS)\ufffd\ufffd{}\u0529\\u0010\ufffdL\ufffd\u0026\\t\u06be%\ufffd\u03a1\ufffd\ufffd\\u001c\ufffd\u03d6{\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000#\\u0000\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003[t\\u0005\ufffdC\ufffd\u07d2\\t\ufffd\ufffdr\ufffdI\ufffd\\u0015\ufffd!\ufffd\ufffd+O6\ufffd\\u000f\ufffd\ufffd\ufffd\ufffd\ufffd\\u0013\ufffd \\t\ufffd!\ufffd\u003C\\u0005\ufffdq\ufffd\ufffd~\ufffd)\ufffdB\ufffd.\\u0010\ufffd!t\u077f(\ufffd[\ufffdV\ufffd\\u0005sS\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022cadb132ef68c8f98bfa6b21f8ec99b3db09ba862\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003[t\\u0005\ufffdC\ufffd\u07d2\\t\ufffd\ufffdr\ufffdI\ufffd\\u0015\ufffd!\ufffd\ufffd+O6\ufffd\\u000f\ufffd\ufffd\ufffd\ufffd\ufffd\\u0013\ufffd \\t\ufffd!\ufffd\u003C\\u0005\ufffdq\ufffd\ufffd~\ufffd)\ufffdB\ufffd.\\u0010\ufffd!t\u077f(\ufffd[\ufffdV\ufffd\\u0005sS\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\u0022, \u0022tls_ja3\u0022: \u002296d467f211fd709f5ae25740fe69d0b7\u0022, \u0022tls_ja4\u0022: \u00229a25f1cf7ebeef3a40e8ae82689768a3\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd[t\ufffdC\ufffd\u07d2\\t\ufffd\ufffdr\ufffdI\ufffd\ufffd!\ufffd\ufffd+O6\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \\t\ufffd!\ufffd\u003C\ufffdq\ufffd\ufffd~\ufffd)\ufffdB\ufffd.\ufffd!t\u077f(\ufffd[\ufffdV\ufffdsS\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTPS\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003[t\\u0005\ufffdC\ufffd\u07d2\\t\ufffd\ufffdr\ufffdI\ufffd\\u0015\ufffd!\ufffd\ufffd+O6\ufffd\\u000f\ufffd\ufffd\ufffd\ufffd\ufffd\\u0013\ufffd \\t\ufffd!\ufffd\u003C\\u0005\ufffdq\ufffd\ufffd~\ufffd)\ufffdB\ufffd.\\u0010\ufffd!t\u077f(\ufffd[\ufffdV\ufffd\\u0005sS\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\u0022, \u0022tls_ja3\u0022: \u002296d467f211fd709f5ae25740fe69d0b7\u0022, \u0022tls_ja4\u0022: \u00229a25f1cf7ebeef3a40e8ae82689768a3\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd[t\ufffdC\ufffd\u07d2\\t\ufffd\ufffdr\ufffdI\ufffd\ufffd!\ufffd\ufffd+O6\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd \\t\ufffd!\ufffd\u003C\ufffdq\ufffd\ufffd~\ufffd)\ufffdB\ufffd.\ufffd!t\u077f(\ufffd[\ufffdV\ufffdsS\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":7,"bytes_in":241},{"id":6034077,"ip":"131.186.2.193","ts":"2026-10-21 14:55:35.000000","proto":"tcp","src_port":40126,"dst_port":8443,"service":"https","classification":"http_flood","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.8779683788266475, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022602ecc7984feae22664230a9fc6b61e756fd9f12\u0022, \u0022event_fingerprint\u0022: \u00221268b50d410d1cdd8232ddd7c8594924aae881d7\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 147, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002263c18482c5fc2ad2989cceda27e40f55\u0022, \u0022path_pattern_hash\u0022: \u00224d7cc3b45cbf3e5b6ce484f88d569789\u0022, \u0022ja3\u0022: \u0022aa72476f5e89b972830393bec546be3a\u0022, \u0022ja4\u0022: \u0022d5724be9cbcd656eac81559f4b6990d5\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022aa72476f5e89b972830393bec546be3a\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,45-5-13-10-51-35-16-43-11-23,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u0022d5724be9cbcd656eac81559f4b6990d5\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_1a499cbf51c7_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 51}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\ufffd8%\ufffd\ufffd\ufffdT\\u001d\u05ca@\u0187\ufffd(\ufffd\ufffd\\u0012R\\r\ufffd\ufffd\\u0010\\u0013%F=V \ufffd\ufffd\ufffdWg\ufffdBt\u003C\ufffd\ufffd\\u0017\ufffd\\u0006\\u0006u\ufffd\u0745\\u000fL\ufffd\ufffdMM\ufffd7\u0090HW\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\ufffd8%\ufffd\ufffd\ufffdT\\u001d\u05ca@\u0187\ufffd(\ufffd\ufffd\\u0012R\\r\ufffd\ufffd\\u0010\\u0013%F=V \ufffd\ufffd\ufffdWg\ufffdBt\u003C\ufffd\ufffd\\u0017\ufffd\\u0006\\u0006u\ufffd\u0745\\u000fL\ufffd\ufffdMM\ufffd7\u0090HW\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 5;\ufffdIJ\\n\\u001d\ufffd\\f]s\ufffd;\\u001bM\\u001c\ufffdC\ufffd\ufffddI;\ufffd\ufffdh\ufffd\\u001b\ufffdr\\u0016d\\u0000#\\u0000\\u0000\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\ufffd8%\ufffd\ufffd\ufffdT\\u001d\u05ca@\u0187\ufffd(\ufffd\ufffd\\u0012R\\r\ufffd\ufffd\\u0010\\u0013%F=V \ufffd\ufffd\ufffdWg\ufffdBt\u003C\ufffd\ufffd\\u0017\ufffd\\u0006\\u0006u\ufffd\u0745\\u000fL\ufffd\ufffdMM\ufffd7\u0090HW\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022ff343f1fc8068adbe753fb437c5cb4829f2069ad\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\ufffd8%\ufffd\ufffd\ufffdT\\u001d\u05ca@\u0187\ufffd(\ufffd\ufffd\\u0012R\\r\ufffd\ufffd\\u0010\\u0013%F=V \ufffd\ufffd\ufffdWg\ufffdBt\u003C\ufffd\ufffd\\u0017\ufffd\\u0006\\u0006u\ufffd\u0745\\u000fL\ufffd\ufffdMM\ufffd7\u0090HW\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\u0022, \u0022tls_ja3\u0022: \u0022aa72476f5e89b972830393bec546be3a\u0022, \u0022tls_ja4\u0022: \u0022d5724be9cbcd656eac81559f4b6990d5\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd8%\ufffd\ufffd\ufffdT\u05ca@\u0187\ufffd(\ufffd\ufffdR\\r\ufffd\ufffd%F=V \ufffd\ufffd\ufffdWg\ufffdBt\u003C\ufffd\ufffd\ufffdu\ufffd\u0745L\ufffd\ufffdMM\ufffd7\u0090HW\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTPS\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd\ufffd8%\ufffd\ufffd\ufffdT\\u001d\u05ca@\u0187\ufffd(\ufffd\ufffd\\u0012R\\r\ufffd\ufffd\\u0010\\u0013%F=V \ufffd\ufffd\ufffdWg\ufffdBt\u003C\ufffd\ufffd\\u0017\ufffd\\u0006\\u0006u\ufffd\u0745\\u000fL\ufffd\ufffdMM\ufffd7\u0090HW\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\u0022, \u0022tls_ja3\u0022: \u0022aa72476f5e89b972830393bec546be3a\u0022, \u0022tls_ja4\u0022: \u0022d5724be9cbcd656eac81559f4b6990d5\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd8%\ufffd\ufffd\ufffdT\u05ca@\u0187\ufffd(\ufffd\ufffdR\\r\ufffd\ufffd%F=V \ufffd\ufffd\ufffdWg\ufffdBt\u003C\ufffd\ufffd\ufffdu\ufffd\u0745L\ufffd\ufffdMM\ufffd7\u0090HW\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":7,"bytes_in":241},{"id":6034076,"ip":"131.186.2.193","ts":"2026-10-21 14:55:35.000000","proto":"tcp","src_port":39908,"dst_port":8443,"service":"https","classification":"http_flood","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.8728969328166745, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022602ecc7984feae22664230a9fc6b61e756fd9f12\u0022, \u0022event_fingerprint\u0022: \u00221268b50d410d1cdd8232ddd7c8594924aae881d7\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 147, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022matched_pattern_names\u0022: [\u0022PostgreSQL startup\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022], \u0022pattern_ids\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00225c199d527b34bd3a68c6ad28a40d97ef\u0022, \u0022path_pattern_hash\u0022: \u00224d7cc3b45cbf3e5b6ce484f88d569789\u0022, \u0022ja3\u0022: \u0022ffc6a033a9a27412d9dd3726ce4c560c\u0022, \u0022ja4\u0022: \u0022963ed9e10b7bca5a7db53051eeed4e71\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022ffc6a033a9a27412d9dd3726ce4c560c\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,5-11-35-45-51-23-10-16-43-13,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u0022963ed9e10b7bca5a7db53051eeed4e71\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_0e710fb6cda2_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 51}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003i\ufffd\\u0003\ufffdD\u0402}b\u03c4\ufffd\ufffd\ufffd\ufffd~\\u0004\ufffdg9\\u001eY3\ufffdt\ufffd0\ufffd#m\u0026\\u0005 Zq\ufffdH\ufffdH\u02ab;\ufffd\ufffd`\u0622\ufffd\u0027\ufffd\ufffdl\ufffd8\\u0014]B\ufffdz\ufffd\\u001a\ufffd\\u0019\ufffd\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003i\ufffd\\u0003\ufffdD\u0402}b\u03c4\ufffd\ufffd\ufffd\ufffd~\\u0004\ufffdg9\\u001eY3\ufffdt\ufffd0\ufffd#m\u0026\\u0005 Zq\ufffdH\ufffdH\u02ab;\ufffd\ufffd`\u0622\ufffd\u0027\ufffd\ufffdl\ufffd8\\u0014]B\ufffdz\ufffd\\u001a\ufffd\\u0019\ufffd\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \ufffd\ufffd\u05a2|\ufffdaY\\u0011\ufffd\ufffd\ufffd\\u0000k\\u0019En\ufffd\\u0005\ufffd\ufffd\u0706\ufffd\ufffd\ufffd\\u000e\u0027j\u0415\\t\\u0000\\u0017\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003i\ufffd\\u0003\ufffdD\u0402}b\u03c4\ufffd\ufffd\ufffd\ufffd~\\u0004\ufffdg9\\u001eY3\ufffdt\ufffd0\ufffd#m\u0026\\u0005 Zq\ufffdH\ufffdH\u02ab;\ufffd\ufffd`\u0622\ufffd\u0027\ufffd\ufffdl\ufffd8\\u0014]B\ufffdz\ufffd\\u001a\ufffd\\u0019\ufffd\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022839c1f780efddb3e5d6ebaaa9eab275530b8aec5\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003i\ufffd\\u0003\ufffdD\u0402}b\u03c4\ufffd\ufffd\ufffd\ufffd~\\u0004\ufffdg9\\u001eY3\ufffdt\ufffd0\ufffd#m\u0026\\u0005 Zq\ufffdH\ufffdH\u02ab;\ufffd\ufffd`\u0622\ufffd\u0027\ufffd\ufffdl\ufffd8\\u0014]B\ufffdz\ufffd\\u001a\ufffd\\u0019\ufffd\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\u0022, \u0022tls_ja3\u0022: \u0022ffc6a033a9a27412d9dd3726ce4c560c\u0022, \u0022tls_ja4\u0022: \u0022963ed9e10b7bca5a7db53051eeed4e71\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdi\ufffd\ufffdD\u0402}b\u03c4\ufffd\ufffd\ufffd\ufffd~\ufffdg9Y3\ufffdt\ufffd0\ufffd#m\u0026 Zq\ufffdH\ufffdH\u02ab;\ufffd\ufffd`\u0622\ufffd\u0027\ufffd\ufffdl\ufffd8]B\ufffdz\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd#-\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTPS\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003i\ufffd\\u0003\ufffdD\u0402}b\u03c4\ufffd\ufffd\ufffd\ufffd~\\u0004\ufffdg9\\u001eY3\ufffdt\ufffd0\ufffd#m\u0026\\u0005 Zq\ufffdH\ufffdH\u02ab;\ufffd\ufffd`\u0622\ufffd\u0027\ufffd\ufffdl\ufffd8\\u0014]B\ufffdz\ufffd\\u001a\ufffd\\u0019\ufffd\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\u0022, \u0022tls_ja3\u0022: \u0022ffc6a033a9a27412d9dd3726ce4c560c\u0022, \u0022tls_ja4\u0022: \u0022963ed9e10b7bca5a7db53051eeed4e71\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdi\ufffd\ufffdD\u0402}b\u03c4\ufffd\ufffd\ufffd\ufffd~\ufffdg9Y3\ufffdt\ufffd0\ufffd#m\u0026 Zq\ufffdH\ufffdH\u02ab;\ufffd\ufffd`\u0622\ufffd\u0027\ufffd\ufffdl\ufffd8]B\ufffdz\ufffd\ufffd\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd#-\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":7,"bytes_in":241},{"id":6034075,"ip":"131.186.2.193","ts":"2026-10-21 14:55:35.000000","proto":"tcp","src_port":40052,"dst_port":8443,"service":"https","classification":"http_flood","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.881729441358598, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022602ecc7984feae22664230a9fc6b61e756fd9f12\u0022, \u0022event_fingerprint\u0022: \u00221268b50d410d1cdd8232ddd7c8594924aae881d7\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 147, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022matched_pattern_names\u0022: [\u0022PostgreSQL startup\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022], \u0022pattern_ids\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00222c7ff9d5b11954b133468544f49f4fa7\u0022, \u0022path_pattern_hash\u0022: \u00224d7cc3b45cbf3e5b6ce484f88d569789\u0022, \u0022ja3\u0022: \u00225d72df29b97faa0d9fcbc5677f2a2571\u0022, \u0022ja4\u0022: \u0022b7234f1ff4cfd904fc1d9c2810e40bcb\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u00225d72df29b97faa0d9fcbc5677f2a2571\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,23-16-45-43-51-5-11-35-10-13,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u0022b7234f1ff4cfd904fc1d9c2810e40bcb\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_01dd5a166ad5_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 51}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003U\ufffd\ufffds\ufffd\ufffd\ufffdRW\ufffd\\u0007hc\u07db~B\ufffd\u01e9A\ufffd\\u00014\ufffdxL\\u0001\ufffd\\b\ufffd \ufffd\ufffd\ufffd\ufffd\\u001c\ufffd\u003E\ufffd\ufffdK\ufffdI\ufffd\u003C\ufffdJ\u070fR.\ufffd\ufffd?\ufffdC\ufffd\ufffd\u017e$\u0026\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0017\\u0000\\u0000\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003U\ufffd\ufffds\ufffd\ufffd\ufffdRW\ufffd\\u0007hc\u07db~B\ufffd\u01e9A\ufffd\\u00014\ufffdxL\\u0001\ufffd\\b\ufffd \ufffd\ufffd\ufffd\ufffd\\u001c\ufffd\u003E\ufffd\ufffdK\ufffdI\ufffd\u003C\ufffdJ\u070fR.\ufffd\ufffd?\ufffdC\ufffd\ufffd\u017e$\u0026\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0017\\u0000\\u0000\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \ufffd\\u0004\ufffd)\ufffd\ufffd\ufffd\ufffdB\ufffd\ufffd8A\\r\ufffd\\u0018\ufffd\ufffdlw\ufffd\ufffd[f\ufffd\ufffd\\u0001\ufffdd5\ufffdE\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003U\ufffd\ufffds\ufffd\ufffd\ufffdRW\ufffd\\u0007hc\u07db~B\ufffd\u01e9A\ufffd\\u00014\ufffdxL\\u0001\ufffd\\b\ufffd \ufffd\ufffd\ufffd\ufffd\\u001c\ufffd\u003E\ufffd\ufffdK\ufffdI\ufffd\u003C\ufffdJ\u070fR.\ufffd\ufffd?\ufffdC\ufffd\ufffd\u017e$\u0026\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0017\\u0000\\u0000\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022fd23d67d100a4c8cc055f37fb33563e27f65b8d1\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003U\ufffd\ufffds\ufffd\ufffd\ufffdRW\ufffd\\u0007hc\u07db~B\ufffd\u01e9A\ufffd\\u00014\ufffdxL\\u0001\ufffd\\b\ufffd \ufffd\ufffd\ufffd\ufffd\\u001c\ufffd\u003E\ufffd\ufffdK\ufffdI\ufffd\u003C\ufffdJ\u070fR.\ufffd\ufffd?\ufffdC\ufffd\ufffd\u017e$\u0026\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0017\\u0000\\u0000\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\u0022, \u0022tls_ja3\u0022: \u00225d72df29b97faa0d9fcbc5677f2a2571\u0022, \u0022tls_ja4\u0022: \u0022b7234f1ff4cfd904fc1d9c2810e40bcb\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdU\ufffd\ufffds\ufffd\ufffd\ufffdRW\ufffdhc\u07db~B\ufffd\u01e9A\ufffd4\ufffdxL\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\u003E\ufffd\ufffdK\ufffdI\ufffd\u003C\ufffdJ\u070fR.\ufffd\ufffd?\ufffdC\ufffd\ufffd\u017e$\u0026\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\\thttp\/1.1-\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTPS\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003U\ufffd\ufffds\ufffd\ufffd\ufffdRW\ufffd\\u0007hc\u07db~B\ufffd\u01e9A\ufffd\\u00014\ufffdxL\\u0001\ufffd\\b\ufffd \ufffd\ufffd\ufffd\ufffd\\u001c\ufffd\u003E\ufffd\ufffdK\ufffdI\ufffd\u003C\ufffdJ\u070fR.\ufffd\ufffd?\ufffdC\ufffd\ufffd\u017e$\u0026\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0017\\u0000\\u0000\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\u0022, \u0022tls_ja3\u0022: \u00225d72df29b97faa0d9fcbc5677f2a2571\u0022, \u0022tls_ja4\u0022: \u0022b7234f1ff4cfd904fc1d9c2810e40bcb\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdU\ufffd\ufffds\ufffd\ufffd\ufffdRW\ufffdhc\u07db~B\ufffd\u01e9A\ufffd4\ufffdxL\ufffd\ufffd \ufffd\ufffd\ufffd\ufffd\ufffd\u003E\ufffd\ufffdK\ufffdI\ufffd\u003C\ufffdJ\u070fR.\ufffd\ufffd?\ufffdC\ufffd\ufffd\u017e$\u0026\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\\thttp\/1.1-\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":7,"bytes_in":241},{"id":6034074,"ip":"131.186.2.193","ts":"2026-10-21 14:55:35.000000","proto":"tcp","src_port":40184,"dst_port":8443,"service":"https","classification":"http_flood","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.950080643302331, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022602ecc7984feae22664230a9fc6b61e756fd9f12\u0022, \u0022event_fingerprint\u0022: \u00221268b50d410d1cdd8232ddd7c8594924aae881d7\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 147, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0768\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022matched_pattern_names\u0022: [\u0022Mumble ping\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022], \u0022pattern_ids\u0022: [\u0022pat-0768\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00227149ddb3676abd781aa9312a371abee9\u0022, \u0022path_pattern_hash\u0022: \u00224d7cc3b45cbf3e5b6ce484f88d569789\u0022, \u0022ja3\u0022: \u00225e473462c99b30fe8cd9b7a6aa50f53b\u0022, \u0022ja4\u0022: \u0022868a5247a53499cfca4b1efbe0d2a2f3\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u00225e473462c99b30fe8cd9b7a6aa50f53b\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,10-35-11-43-13-45-23-51-16-5,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u0022868a5247a53499cfca4b1efbe0d2a2f3\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_1c1664516006_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 51}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffdg\ufffd\ufffd\ufffd\ufffdf\\u0000\ufffd\ufffd\ufffd\ufffd~\ufffdg\ufffd\\u0014{f\ufffd\ufffd\\u0010\u03b0p\ufffdm\ufffd\ufffd\ufffd \ufffd\ufffd%Q\ufffd@2\ufffd\ufffd\u003E6\\u0007Ku\ufffd:`\ufffdG\\\\b\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdo[\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000#\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000+\\u0000\\u0005\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffdg\ufffd\ufffd\ufffd\ufffdf\\u0000\ufffd\ufffd\ufffd\ufffd~\ufffdg\ufffd\\u0014{f\ufffd\ufffd\\u0010\u03b0p\ufffdm\ufffd\ufffd\ufffd \ufffd\ufffd%Q\ufffd@2\ufffd\ufffd\u003E6\\u0007Ku\ufffd:`\ufffdG\\\\b\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdo[\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000#\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u0017\\u0000\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \ufffd\ufffd\ufffd\ufffd\ufffd\ufffdm\ufffd\ufffdfg\ufffd\ufffd\ufffd\ufffdL\ufffd\\u0007\ufffd?\ufffd\ufffd\ufffd\ufffdw\ufffd\ufffd\u07ac\\t\\u0016\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffdg\ufffd\ufffd\ufffd\ufffdf\\u0000\ufffd\ufffd\ufffd\ufffd~\ufffdg\ufffd\\u0014{f\ufffd\ufffd\\u0010\u03b0p\ufffdm\ufffd\ufffd\ufffd \ufffd\ufffd%Q\ufffd@2\ufffd\ufffd\u003E6\\u0007Ku\ufffd:`\ufffdG\\\\b\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdo[\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000#\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000+\\u0000\\u0005\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00222b48d972faf7d721e9f77e3ffac9148da31e0d1b\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffdg\ufffd\ufffd\ufffd\ufffdf\\u0000\ufffd\ufffd\ufffd\ufffd~\ufffdg\ufffd\\u0014{f\ufffd\ufffd\\u0010\u03b0p\ufffdm\ufffd\ufffd\ufffd \ufffd\ufffd%Q\ufffd@2\ufffd\ufffd\u003E6\\u0007Ku\ufffd:`\ufffdG\\\\b\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdo[\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000#\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000+\\u0000\\u0005\u0022, \u0022tls_ja3\u0022: \u00225e473462c99b30fe8cd9b7a6aa50f53b\u0022, \u0022tls_ja4\u0022: \u0022868a5247a53499cfca4b1efbe0d2a2f3\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffdf\ufffd\ufffd\ufffd\ufffd~\ufffdg\ufffd{f\ufffd\ufffd\u03b0p\ufffdm\ufffd\ufffd\ufffd \ufffd\ufffd%Q\ufffd@2\ufffd\ufffd\u003E6Ku\ufffd:`\ufffdG\\\\b\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdo[\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\\n#+\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTPS\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffdg\ufffd\ufffd\ufffd\ufffdf\\u0000\ufffd\ufffd\ufffd\ufffd~\ufffdg\ufffd\\u0014{f\ufffd\ufffd\\u0010\u03b0p\ufffdm\ufffd\ufffd\ufffd \ufffd\ufffd%Q\ufffd@2\ufffd\ufffd\u003E6\\u0007Ku\ufffd:`\ufffdG\\\\b\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdo[\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000#\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000+\\u0000\\u0005\u0022, \u0022tls_ja3\u0022: \u00225e473462c99b30fe8cd9b7a6aa50f53b\u0022, \u0022tls_ja4\u0022: \u0022868a5247a53499cfca4b1efbe0d2a2f3\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffdg\ufffd\ufffd\ufffd\ufffdf\ufffd\ufffd\ufffd\ufffd~\ufffdg\ufffd{f\ufffd\ufffd\u03b0p\ufffdm\ufffd\ufffd\ufffd \ufffd\ufffd%Q\ufffd@2\ufffd\ufffd\u003E6Ku\ufffd:`\ufffdG\\\\b\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdo[\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\\n#+\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":7,"bytes_in":241},{"id":6034073,"ip":"131.186.2.193","ts":"2026-10-21 14:55:35.000000","proto":"tcp","src_port":40096,"dst_port":8443,"service":"https","classification":"http_flood","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.7750647237325134, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022602ecc7984feae22664230a9fc6b61e756fd9f12\u0022, \u0022event_fingerprint\u0022: \u00221268b50d410d1cdd8232ddd7c8594924aae881d7\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 147, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022182ee13020fe0b36c8343c218937d9f6\u0022, \u0022path_pattern_hash\u0022: \u00224d7cc3b45cbf3e5b6ce484f88d569789\u0022, \u0022ja3\u0022: \u002218e787b88774612d87e0591395fbf491\u0022, \u0022ja4\u0022: \u0022536957468450da92e6c83cd427dbbdbc\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u002218e787b88774612d87e0591395fbf491\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,13-35-51-23-16-43-10-11-5-45,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u0022536957468450da92e6c83cd427dbbdbc\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_5e8447a3f140_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 51}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd \ufffda@\ufffd\ufffdx5\\r\ufffd\ufffd,\\n\ufffdD:E\\u00135\ufffd\u0205\ufffds\ufffd\ufffdU\\u0006 \\u00101\ufffd{\ufffd\ufffd\\bP=W\ufffd\ufffd\ufffd3\ufffd~e\ufffd\ufffd\\u0015\ufffd\\u0001\ufffd.\\u0001\u01af\ufffdQ\ufffd\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd \ufffda@\ufffd\ufffdx5\\r\ufffd\ufffd,\\n\ufffdD:E\\u00135\ufffd\u0205\ufffds\ufffd\ufffdU\\u0006 \\u00101\ufffd{\ufffd\ufffd\\bP=W\ufffd\ufffd\ufffd3\ufffd~e\ufffd\ufffd\\u0015\ufffd\\u0001\ufffd.\\u0001\u01af\ufffdQ\ufffd\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000#\\u0000\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \ufffd2\\u0003 \ufffdI\\u0004\ufffd\ufffd\ufffda\\b}-|\\r\\u001e\ufffd\ufffd\ufffdS\ufffdD\\u0003\ufffd\ufffd\ufffd\ufffd\ufffd\\t\\u0016\\u0000\\u0017\\u0000\\u0000\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd \ufffda@\ufffd\ufffdx5\\r\ufffd\ufffd,\\n\ufffdD:E\\u00135\ufffd\u0205\ufffds\ufffd\ufffdU\\u0006 \\u00101\ufffd{\ufffd\ufffd\\bP=W\ufffd\ufffd\ufffd3\ufffd~e\ufffd\ufffd\\u0015\ufffd\\u0001\ufffd.\\u0001\u01af\ufffdQ\ufffd\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00222a37d742bdc7768df96a1bf374009dc6b592dced\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd \ufffda@\ufffd\ufffdx5\\r\ufffd\ufffd,\\n\ufffdD:E\\u00135\ufffd\u0205\ufffds\ufffd\ufffdU\\u0006 \\u00101\ufffd{\ufffd\ufffd\\bP=W\ufffd\ufffd\ufffd3\ufffd~e\ufffd\ufffd\\u0015\ufffd\\u0001\ufffd.\\u0001\u01af\ufffdQ\ufffd\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\u0022, \u0022tls_ja3\u0022: \u002218e787b88774612d87e0591395fbf491\u0022, \u0022tls_ja4\u0022: \u0022536957468450da92e6c83cd427dbbdbc\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd \ufffda@\ufffd\ufffdx5\\r\ufffd\ufffd,\\n\ufffdD:E5\ufffd\u0205\ufffds\ufffd\ufffdU 1\ufffd{\ufffd\ufffdP=W\ufffd\ufffd\ufffd3\ufffd~e\ufffd\ufffd\ufffd\ufffd.\u01af\ufffdQ\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTPS\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\ufffd\ufffd \ufffda@\ufffd\ufffdx5\\r\ufffd\ufffd,\\n\ufffdD:E\\u00135\ufffd\u0205\ufffds\ufffd\ufffdU\\u0006 \\u00101\ufffd{\ufffd\ufffd\\bP=W\ufffd\ufffd\ufffd3\ufffd~e\ufffd\ufffd\\u0015\ufffd\\u0001\ufffd.\\u0001\u01af\ufffdQ\ufffd\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\u0022, \u0022tls_ja3\u0022: \u002218e787b88774612d87e0591395fbf491\u0022, \u0022tls_ja4\u0022: \u0022536957468450da92e6c83cd427dbbdbc\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\ufffd\ufffd \ufffda@\ufffd\ufffdx5\\r\ufffd\ufffd,\\n\ufffdD:E5\ufffd\u0205\ufffds\ufffd\ufffdU 1\ufffd{\ufffd\ufffdP=W\ufffd\ufffd\ufffd3\ufffd~e\ufffd\ufffd\ufffd\ufffd.\u01af\ufffdQ\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":7,"bytes_in":241},{"id":6034072,"ip":"131.186.2.193","ts":"2026-10-21 14:55:35.000000","proto":"tcp","src_port":39472,"dst_port":8443,"service":"https","classification":"http_flood","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.787816758197887, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022602ecc7984feae22664230a9fc6b61e756fd9f12\u0022, \u0022event_fingerprint\u0022: \u00221268b50d410d1cdd8232ddd7c8594924aae881d7\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 147, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022matched_pattern_names\u0022: [\u0022PostgreSQL startup\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022], \u0022pattern_ids\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022bbe210632416c2b529e786111c879e8b\u0022, \u0022path_pattern_hash\u0022: \u00224d7cc3b45cbf3e5b6ce484f88d569789\u0022, \u0022ja3\u0022: \u0022f08406438f1e7fa47436ff61bce5ff73\u0022, \u0022ja4\u0022: \u0022aa2ea59b807e64a7be5311a5a48d9e75\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022f08406438f1e7fa47436ff61bce5ff73\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,23-51-45-35-13-11-43-16-5-10,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u0022aa2ea59b807e64a7be5311a5a48d9e75\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_ef8228830ff0_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 51}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003Bt\ufffdO\\u0003=\\f\ufffd\u02e1\ufffd\ufffd\ufffd3\u003C\ufffd\ufffd\ufffd*\ufffd\\t\ufffd\ufffd\\u0005\\rL\\r\ufffdP h~ \ufffd{Y\ufffd\ufffdo\ufffdo\\\\NW\ufffdU\ufffd\ufffd\ufffd\ufffd\u016d\\t\\u0003=\ufffd\\u0004\ufffd\u010e\ufffd\ufffda\ufffdi\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0017\\u0000\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 yf\ufffd\u032d\ufffd\\f\\\u0022f\ufffd9\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003Bt\ufffdO\\u0003=\\f\ufffd\u02e1\ufffd\ufffd\ufffd3\u003C\ufffd\ufffd\ufffd*\ufffd\\t\ufffd\ufffd\\u0005\\rL\\r\ufffdP h~ \ufffd{Y\ufffd\ufffdo\ufffdo\\\\NW\ufffdU\ufffd\ufffd\ufffd\ufffd\u016d\\t\\u0003=\ufffd\\u0004\ufffd\u010e\ufffd\ufffda\ufffdi\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0017\\u0000\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 yf\ufffd\u032d\ufffd\\f\\\u0022f\ufffd9\ufffd\u2f14\\b\ufffdC\\u0005\ufffdR*\\u0017\ufffd\ufffd\\n\\u0007\ufffdC9\ufffd\\f\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000#\\u0000\\u0000\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003Bt\ufffdO\\u0003=\\f\ufffd\u02e1\ufffd\ufffd\ufffd3\u003C\ufffd\ufffd\ufffd*\ufffd\\t\ufffd\ufffd\\u0005\\rL\\r\ufffdP h~ \ufffd{Y\ufffd\ufffdo\ufffdo\\\\NW\ufffdU\ufffd\ufffd\ufffd\ufffd\u016d\\t\\u0003=\ufffd\\u0004\ufffd\u010e\ufffd\ufffda\ufffdi\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0017\\u0000\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 yf\ufffd\u032d\ufffd\\f\\\u0022f\ufffd9\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022288124d44e8f34a2a17eb82034c6e2ce2b36bcab\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003Bt\ufffdO\\u0003=\\f\ufffd\u02e1\ufffd\ufffd\ufffd3\u003C\ufffd\ufffd\ufffd*\ufffd\\t\ufffd\ufffd\\u0005\\rL\\r\ufffdP h~ \ufffd{Y\ufffd\ufffdo\ufffdo\\\\NW\ufffdU\ufffd\ufffd\ufffd\ufffd\u016d\\t\\u0003=\ufffd\\u0004\ufffd\u010e\ufffd\ufffda\ufffdi\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0017\\u0000\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 yf\ufffd\u032d\ufffd\\f\\\u0022f\ufffd9\ufffd\u0022, \u0022tls_ja3\u0022: \u0022f08406438f1e7fa47436ff61bce5ff73\u0022, \u0022tls_ja4\u0022: \u0022aa2ea59b807e64a7be5311a5a48d9e75\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdBt\ufffdO=\ufffd\u02e1\ufffd\ufffd\ufffd3\u003C\ufffd\ufffd\ufffd*\ufffd\\t\ufffd\ufffd\\rL\\r\ufffdP h~ \ufffd{Y\ufffd\ufffdo\ufffdo\\\\NW\ufffdU\ufffd\ufffd\ufffd\ufffd\u016d\\t=\ufffd\ufffd\u010e\ufffd\ufffda\ufffdi\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd3\u0026$ yf\ufffd\u032d\ufffd\\\u0022f\ufffd9\ufffd\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTPS\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003Bt\ufffdO\\u0003=\\f\ufffd\u02e1\ufffd\ufffd\ufffd3\u003C\ufffd\ufffd\ufffd*\ufffd\\t\ufffd\ufffd\\u0005\\rL\\r\ufffdP h~ \ufffd{Y\ufffd\ufffdo\ufffdo\\\\NW\ufffdU\ufffd\ufffd\ufffd\ufffd\u016d\\t\\u0003=\ufffd\\u0004\ufffd\u010e\ufffd\ufffda\ufffdi\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0017\\u0000\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 yf\ufffd\u032d\ufffd\\f\\\u0022f\ufffd9\ufffd\u0022, \u0022tls_ja3\u0022: \u0022f08406438f1e7fa47436ff61bce5ff73\u0022, \u0022tls_ja4\u0022: \u0022aa2ea59b807e64a7be5311a5a48d9e75\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdBt\ufffdO=\ufffd\u02e1\ufffd\ufffd\ufffd3\u003C\ufffd\ufffd\ufffd*\ufffd\\t\ufffd\ufffd\\rL\\r\ufffdP h~ \ufffd{Y\ufffd\ufffdo\ufffdo\\\\NW\ufffdU\ufffd\ufffd\ufffd\ufffd\u016d\\t=\ufffd\ufffd\u010e\ufffd\ufffda\ufffdi\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd3\u0026$ yf\ufffd\u032d\ufffd\\\u0022f\ufffd9\ufffd\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":7,"bytes_in":241},{"id":6034071,"ip":"131.186.2.193","ts":"2026-10-21 14:55:35.000000","proto":"tcp","src_port":39468,"dst_port":8443,"service":"https","classification":"http_flood","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.893467704525862, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022602ecc7984feae22664230a9fc6b61e756fd9f12\u0022, \u0022event_fingerprint\u0022: \u00221268b50d410d1cdd8232ddd7c8594924aae881d7\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 147, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002240f625578620d5083912e968e80ead53\u0022, \u0022path_pattern_hash\u0022: \u00224d7cc3b45cbf3e5b6ce484f88d569789\u0022, \u0022ja3\u0022: \u0022ceb966ea6d13efce4bd7340369c33c3d\u0022, \u0022ja4\u0022: \u00225c9be0375dc16d83ef1c5856b2b4d3a1\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022ceb966ea6d13efce4bd7340369c33c3d\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,16-5-43-11-10-35-45-51-13-23,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00225c9be0375dc16d83ef1c5856b2b4d3a1\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_13d5517fec90_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 51}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd)\ufffd\ufffd\ufffdy\\u0006\ufffd\ufffd\ufffda1C\ufffd\ufffd\u003C+\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\u0006 \\u00175\ufffd\ufffd\ufffd\ufffdw\\u0015\\u0013\ufffd\ufffd\ufffd\ufffd\\u0015\ufffd$=j\u0026\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\u0018\ufffd\\u001f\\u0014S\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000+\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd)\ufffd\ufffd\ufffdy\\u0006\ufffd\ufffd\ufffda1C\ufffd\ufffd\u003C+\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\u0006 \\u00175\ufffd\ufffd\ufffd\ufffdw\\u0015\\u0013\ufffd\ufffd\ufffd\ufffd\\u0015\ufffd$=j\u0026\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\u0018\ufffd\\u001f\\u0014S\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000#\\u0000\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \ufffdm\ufffd?\\\\\ufffd{\ufffd\ufffd\ufffdA\ufffd\\u0019\ufffd\\u001d\ufffdOn3lT\ufffd\ufffd\ufffdF\\u0004M\ufffd\ufffdV\ufffd!\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000\\u0017\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd)\ufffd\ufffd\ufffdy\\u0006\ufffd\ufffd\ufffda1C\ufffd\ufffd\u003C+\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\u0006 \\u00175\ufffd\ufffd\ufffd\ufffdw\\u0015\\u0013\ufffd\ufffd\ufffd\ufffd\\u0015\ufffd$=j\u0026\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\u0018\ufffd\\u001f\\u0014S\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000+\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022de4592e97fd716e00544c1c0b43577a972f3b191\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd)\ufffd\ufffd\ufffdy\\u0006\ufffd\ufffd\ufffda1C\ufffd\ufffd\u003C+\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\u0006 \\u00175\ufffd\ufffd\ufffd\ufffdw\\u0015\\u0013\ufffd\ufffd\ufffd\ufffd\\u0015\ufffd$=j\u0026\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\u0018\ufffd\\u001f\\u0014S\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000+\u0022, \u0022tls_ja3\u0022: \u0022ceb966ea6d13efce4bd7340369c33c3d\u0022, \u0022tls_ja4\u0022: \u00225c9be0375dc16d83ef1c5856b2b4d3a1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd)\ufffd\ufffd\ufffdy\ufffd\ufffd\ufffda1C\ufffd\ufffd\u003C+\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd 5\ufffd\ufffd\ufffd\ufffdw\ufffd\ufffd\ufffd\ufffd\ufffd$=j\u0026\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\\thttp\/1.1+\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTPS\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd)\ufffd\ufffd\ufffdy\\u0006\ufffd\ufffd\ufffda1C\ufffd\ufffd\u003C+\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\u0006 \\u00175\ufffd\ufffd\ufffd\ufffdw\\u0015\\u0013\ufffd\ufffd\ufffd\ufffd\\u0015\ufffd$=j\u0026\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\\u0018\ufffd\\u001f\\u0014S\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000+\u0022, \u0022tls_ja3\u0022: \u0022ceb966ea6d13efce4bd7340369c33c3d\u0022, \u0022tls_ja4\u0022: \u00225c9be0375dc16d83ef1c5856b2b4d3a1\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd)\ufffd\ufffd\ufffdy\ufffd\ufffd\ufffda1C\ufffd\ufffd\u003C+\ufffd\ufffdA\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd 5\ufffd\ufffd\ufffd\ufffdw\ufffd\ufffd\ufffd\ufffd\ufffd$=j\u0026\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdS\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\\thttp\/1.1+\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":7,"bytes_in":241},{"id":6034070,"ip":"131.186.2.193","ts":"2026-10-21 14:55:35.000000","proto":"tcp","src_port":39614,"dst_port":8443,"service":"https","classification":"http_flood","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.9390183519478, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022602ecc7984feae22664230a9fc6b61e756fd9f12\u0022, \u0022event_fingerprint\u0022: \u00221268b50d410d1cdd8232ddd7c8594924aae881d7\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 147, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022matched_pattern_names\u0022: [\u0022PostgreSQL startup\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022], \u0022pattern_ids\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00221aa88689a863e3e744b00f77cefed642\u0022, \u0022path_pattern_hash\u0022: \u00224d7cc3b45cbf3e5b6ce484f88d569789\u0022, \u0022ja3\u0022: \u0022c163038bfd4b66fee3a092d9848e0ec5\u0022, \u0022ja4\u0022: \u00224915384e96529af6914ee3584bf079c8\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022c163038bfd4b66fee3a092d9848e0ec5\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,5-45-11-43-35-10-13-23-51-16,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00224915384e96529af6914ee3584bf079c8\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_33cdc0f64e55_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 51}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003@*\ufffd\ufffdH\ufffd)\ufffdG\ufffd3Kd\u003E\ufffd\\f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdw+\ufffd\u078f\ufffd~\ufffd I%\ufffd\ufffd\\u0005@\\\\\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd97\ufffdshT\\u000e\ufffd\ufffd\ufffd\ufffdM-\ufffd\ufffd~\u003C[\\u0018\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000+\\u0000\\u0005\\u0004\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003@*\ufffd\ufffdH\ufffd)\ufffdG\ufffd3Kd\u003E\ufffd\\f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdw+\ufffd\u078f\ufffd~\ufffd I%\ufffd\ufffd\\u0005@\\\\\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd97\ufffdshT\\u000e\ufffd\ufffd\ufffd\ufffdM-\ufffd\ufffd~\u003C[\\u0018\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000#\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000\\u0017\\u0000\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \ufffdRa\ufffd\u040c{\ufffd\ufffd\ufffd\ufffd@\ufffd8\ufffd9\ufffd\\u001b\ufffdI\ufffdv\ufffd\\\u0022\ufffd\ufffdT\ufffd\ufffd*\\u0004\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003@*\ufffd\ufffdH\ufffd)\ufffdG\ufffd3Kd\u003E\ufffd\\f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdw+\ufffd\u078f\ufffd~\ufffd I%\ufffd\ufffd\\u0005@\\\\\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd97\ufffdshT\\u000e\ufffd\ufffd\ufffd\ufffdM-\ufffd\ufffd~\u003C[\\u0018\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000+\\u0000\\u0005\\u0004\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022a62c0eaa9806bb11a427fbcec5afc2c013ad5dc3\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003@*\ufffd\ufffdH\ufffd)\ufffdG\ufffd3Kd\u003E\ufffd\\f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdw+\ufffd\u078f\ufffd~\ufffd I%\ufffd\ufffd\\u0005@\\\\\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd97\ufffdshT\\u000e\ufffd\ufffd\ufffd\ufffdM-\ufffd\ufffd~\u003C[\\u0018\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000+\\u0000\\u0005\\u0004\u0022, \u0022tls_ja3\u0022: \u0022c163038bfd4b66fee3a092d9848e0ec5\u0022, \u0022tls_ja4\u0022: \u00224915384e96529af6914ee3584bf079c8\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd@*\ufffd\ufffdH\ufffd)\ufffdG\ufffd3Kd\u003E\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdw+\ufffd\u078f\ufffd~\ufffd I%\ufffd\ufffd@\\\\\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd97\ufffdshT\ufffd\ufffd\ufffd\ufffdM-\ufffd\ufffd~\u003C[\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-+\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTPS\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003@*\ufffd\ufffdH\ufffd)\ufffdG\ufffd3Kd\u003E\ufffd\\f\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdw+\ufffd\u078f\ufffd~\ufffd I%\ufffd\ufffd\\u0005@\\\\\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd97\ufffdshT\\u000e\ufffd\ufffd\ufffd\ufffdM-\ufffd\ufffd~\u003C[\\u0018\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000+\\u0000\\u0005\\u0004\u0022, \u0022tls_ja3\u0022: \u0022c163038bfd4b66fee3a092d9848e0ec5\u0022, \u0022tls_ja4\u0022: \u00224915384e96529af6914ee3584bf079c8\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd@*\ufffd\ufffdH\ufffd)\ufffdG\ufffd3Kd\u003E\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdw+\ufffd\u078f\ufffd~\ufffd I%\ufffd\ufffd@\\\\\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd97\ufffdshT\ufffd\ufffd\ufffd\ufffdM-\ufffd\ufffd~\u003C[\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-+\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":7,"bytes_in":241},{"id":6034069,"ip":"131.186.2.193","ts":"2026-10-21 14:55:35.000000","proto":"tcp","src_port":42204,"dst_port":8443,"service":"https","classification":"http_flood","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.860060484975176, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022602ecc7984feae22664230a9fc6b61e756fd9f12\u0022, \u0022event_fingerprint\u0022: \u00221268b50d410d1cdd8232ddd7c8594924aae881d7\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 147, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022matched_pattern_names\u0022: [\u0022PostgreSQL startup\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022], \u0022pattern_ids\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022af8f9f4cd797ea120858ab2fbb2dcc08\u0022, \u0022path_pattern_hash\u0022: \u00224d7cc3b45cbf3e5b6ce484f88d569789\u0022, \u0022ja3\u0022: \u00226ad4533daf6affe86750ed793aee5c36\u0022, \u0022ja4\u0022: \u0022deee5cad1c9866e43fdda43a0f31fd5e\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u00226ad4533daf6affe86750ed793aee5c36\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,11-35-10-16-45-23-5-51-43-13,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u0022deee5cad1c9866e43fdda43a0f31fd5e\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_cfde8ae14316_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 51}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003l7\ufffd6B]\ufffd\ufffd\ufffd\\b\ufffd\ufffd\\u001e\\u0000\\u0011IKNP\\u0013\ufffd,A\u026eB\\u0002\ufffd^z\u02d9 O\ufffd\ufffdXLv\ufffd\ufffdbQ@:\\b\u0026\ufffd.\\n\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdk-\\u0007\ufffd\ufffd\ufffd\ufffd\u00f4\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0010\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003l7\ufffd6B]\ufffd\ufffd\ufffd\\b\ufffd\ufffd\\u001e\\u0000\\u0011IKNP\\u0013\ufffd,A\u026eB\\u0002\ufffd^z\u02d9 O\ufffd\ufffdXLv\ufffd\ufffdbQ@:\\b\u0026\ufffd.\\n\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdk-\\u0007\ufffd\ufffd\ufffd\ufffd\u00f4\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u0017\\u0000\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \\u001a_\ufffd}\ufffd\\nM\ufffdH\ufffd`\\u0003\ufffd\u0027\ufffd\ufffdi\ufffd$\ufffd\ufffdU\ufffd8\/_\ufffd\\u0012\ufffd\ufffd\\u0017\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003l7\ufffd6B]\ufffd\ufffd\ufffd\\b\ufffd\ufffd\\u001e\\u0000\\u0011IKNP\\u0013\ufffd,A\u026eB\\u0002\ufffd^z\u02d9 O\ufffd\ufffdXLv\ufffd\ufffdbQ@:\\b\u0026\ufffd.\\n\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdk-\\u0007\ufffd\ufffd\ufffd\ufffd\u00f4\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0010\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022a7b33db09fad3934db33a9a91c4525449fd2c2b8\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003l7\ufffd6B]\ufffd\ufffd\ufffd\\b\ufffd\ufffd\\u001e\\u0000\\u0011IKNP\\u0013\ufffd,A\u026eB\\u0002\ufffd^z\u02d9 O\ufffd\ufffdXLv\ufffd\ufffdbQ@:\\b\u0026\ufffd.\\n\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdk-\\u0007\ufffd\ufffd\ufffd\ufffd\u00f4\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0010\\u0000\u0022, \u0022tls_ja3\u0022: \u00226ad4533daf6affe86750ed793aee5c36\u0022, \u0022tls_ja4\u0022: \u0022deee5cad1c9866e43fdda43a0f31fd5e\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdl7\ufffd6B]\ufffd\ufffd\ufffd\ufffd\ufffdIKNP\ufffd,A\u026eB\ufffd^z\u02d9 O\ufffd\ufffdXLv\ufffd\ufffdbQ@:\u0026\ufffd.\\n\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdk-\ufffd\ufffd\ufffd\ufffd\u00f4\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd#\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTPS\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003l7\ufffd6B]\ufffd\ufffd\ufffd\\b\ufffd\ufffd\\u001e\\u0000\\u0011IKNP\\u0013\ufffd,A\u026eB\\u0002\ufffd^z\u02d9 O\ufffd\ufffdXLv\ufffd\ufffdbQ@:\\b\u0026\ufffd.\\n\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdk-\\u0007\ufffd\ufffd\ufffd\ufffd\u00f4\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000#\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0010\\u0000\u0022, \u0022tls_ja3\u0022: \u00226ad4533daf6affe86750ed793aee5c36\u0022, \u0022tls_ja4\u0022: \u0022deee5cad1c9866e43fdda43a0f31fd5e\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdl7\ufffd6B]\ufffd\ufffd\ufffd\ufffd\ufffdIKNP\ufffd,A\u026eB\ufffd^z\u02d9 O\ufffd\ufffdXLv\ufffd\ufffdbQ@:\u0026\ufffd.\\n\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdk-\ufffd\ufffd\ufffd\ufffd\u00f4\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd#\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":7,"bytes_in":241},{"id":6034068,"ip":"131.186.2.193","ts":"2026-10-21 14:55:35.000000","proto":"tcp","src_port":41868,"dst_port":8443,"service":"https","classification":"http_flood","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.813396828888266, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022602ecc7984feae22664230a9fc6b61e756fd9f12\u0022, \u0022event_fingerprint\u0022: \u00221268b50d410d1cdd8232ddd7c8594924aae881d7\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 147, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022matched_pattern_names\u0022: [\u0022PostgreSQL startup\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022], \u0022pattern_ids\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022708fb1923225e749fbc8b6f1e64212a7\u0022, \u0022path_pattern_hash\u0022: \u00224d7cc3b45cbf3e5b6ce484f88d569789\u0022, \u0022ja3\u0022: \u0022cdc3231760f6d7449797b105ac91001a\u0022, \u0022ja4\u0022: \u00228ce34b86aef42c821265d0e257fcd0c8\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022cdc3231760f6d7449797b105ac91001a\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,13-11-16-51-23-5-45-43-35-10,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00228ce34b86aef42c821265d0e257fcd0c8\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_69531e426975_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 51}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\\u0003p\ufffd\u0423r\ufffd\\u0001@\ufffd\ufffd[{\ufffd\\u0001\u06d2\ufffd\ufffd\ufffdD\ufffdp\ufffds\ufffd:N\ufffdQc \ufffd\\u0001$\\u0013\ufffd\\u0006\ufffd8\u05ae5\ufffd\\u0001\ufffd?Xt\\u0015\ufffd\ufffd\\\\\\bn\\u0003=\ufffd}H\ufffds7\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\\u0003p\ufffd\u0423r\ufffd\\u0001@\ufffd\ufffd[{\ufffd\\u0001\u06d2\ufffd\ufffd\ufffdD\ufffdp\ufffds\ufffd:N\ufffdQc \ufffd\\u0001$\\u0013\ufffd\\u0006\ufffd8\u05ae5\ufffd\\u0001\ufffd?Xt\\u0015\ufffd\ufffd\\\\\\bn\\u0003=\ufffd}H\ufffds7\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 s\ufffd\ufffd7\ufffd\\r\ufffd\ufffdP\ufffd\\u0004\ufffda\ufffda\ufffd@\ufffd\\u000e\ufffdK yJ\ufffd\ufffd\ufffd\\u0017\\u0000\\u0017\\u0000\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000#\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\\u0003p\ufffd\u0423r\ufffd\\u0001@\ufffd\ufffd[{\ufffd\\u0001\u06d2\ufffd\ufffd\ufffdD\ufffdp\ufffds\ufffd:N\ufffdQc \ufffd\\u0001$\\u0013\ufffd\\u0006\ufffd8\u05ae5\ufffd\\u0001\ufffd?Xt\\u0015\ufffd\ufffd\\\\\\bn\\u0003=\ufffd}H\ufffds7\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u00228b5d4fd5973f42892c4a80e628a78c5353acdc52\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\\u0003p\ufffd\u0423r\ufffd\\u0001@\ufffd\ufffd[{\ufffd\\u0001\u06d2\ufffd\ufffd\ufffdD\ufffdp\ufffds\ufffd:N\ufffdQc \ufffd\\u0001$\\u0013\ufffd\\u0006\ufffd8\u05ae5\ufffd\\u0001\ufffd?Xt\\u0015\ufffd\ufffd\\\\\\bn\\u0003=\ufffd}H\ufffds7\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\u0022, \u0022tls_ja3\u0022: \u0022cdc3231760f6d7449797b105ac91001a\u0022, \u0022tls_ja4\u0022: \u00228ce34b86aef42c821265d0e257fcd0c8\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdp\ufffd\u0423r\ufffd@\ufffd\ufffd[{\ufffd\u06d2\ufffd\ufffd\ufffdD\ufffdp\ufffds\ufffd:N\ufffdQc \ufffd$\ufffd\ufffd8\u05ae5\ufffd\ufffd?Xt\ufffd\ufffd\\\\n=\ufffd}H\ufffds7\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTPS\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\\u0003p\ufffd\u0423r\ufffd\\u0001@\ufffd\ufffd[{\ufffd\\u0001\u06d2\ufffd\ufffd\ufffdD\ufffdp\ufffds\ufffd:N\ufffdQc \ufffd\\u0001$\\u0013\ufffd\\u0006\ufffd8\u05ae5\ufffd\\u0001\ufffd?Xt\\u0015\ufffd\ufffd\\\\\\bn\\u0003=\ufffd}H\ufffds7\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\u0022, \u0022tls_ja3\u0022: \u0022cdc3231760f6d7449797b105ac91001a\u0022, \u0022tls_ja4\u0022: \u00228ce34b86aef42c821265d0e257fcd0c8\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffdp\ufffd\u0423r\ufffd@\ufffd\ufffd[{\ufffd\u06d2\ufffd\ufffd\ufffdD\ufffdp\ufffds\ufffd:N\ufffdQc \ufffd$\ufffd\ufffd8\u05ae5\ufffd\ufffd?Xt\ufffd\ufffd\\\\n=\ufffd}H\ufffds7\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":7,"bytes_in":241},{"id":6034067,"ip":"131.186.2.193","ts":"2026-10-21 14:55:35.000000","proto":"tcp","src_port":41920,"dst_port":8443,"service":"https","classification":"http_flood","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.809892146641723, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022602ecc7984feae22664230a9fc6b61e756fd9f12\u0022, \u0022event_fingerprint\u0022: \u00221268b50d410d1cdd8232ddd7c8594924aae881d7\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 147, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022matched_pattern_names\u0022: [\u0022PostgreSQL startup\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022], \u0022pattern_ids\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022ec3f6eee69b3f7204a3533b3ec7c9cdb\u0022, \u0022path_pattern_hash\u0022: \u00224d7cc3b45cbf3e5b6ce484f88d569789\u0022, \u0022ja3\u0022: \u00222d5378c5e7e573cf609b43c5584fb2e6\u0022, \u0022ja4\u0022: \u002239371e213c297f42dc81f3515706af8d\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u00222d5378c5e7e573cf609b43c5584fb2e6\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,45-11-23-16-43-51-5-10-35-13,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u002239371e213c297f42dc81f3515706af8d\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_f401e36d5279_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 51}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd7\\u0011\ufffd\ufffd\u04f5x\ufffd\ufffd\ufffd\ufffd#\\u00180X\ufffdshH4\uebd1p\\u0005\\u0012K\ufffd3\u0216 \ufffd\\\u0022\ufffd\\u0006\ufffd\ufffd#\ufffd\ufffdw\ufffd!\ufffd\\u0010\\u0016x\ufffd\ufffd! \ufffdt2\ufffdR\ufffdv\\\\\\u0013\ufffd\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhtt\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd7\\u0011\ufffd\ufffd\u04f5x\ufffd\ufffd\ufffd\ufffd#\\u00180X\ufffdshH4\uebd1p\\u0005\\u0012K\ufffd3\u0216 \ufffd\\\u0022\ufffd\\u0006\ufffd\ufffd#\ufffd\ufffdw\ufffd!\ufffd\\u0010\\u0016x\ufffd\ufffd! \ufffdt2\ufffdR\ufffdv\\\\\\u0013\ufffd\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \ufffd[\ufffd\/C9\\\\w\ufffdK\\u001e\ufffd\ufffd$\ufffd\\u0016\u0321\\u0015\ufffd\ufffd\ufffd\\u0012\ufffd\u0619[\ufffd\\u0002X\ufffd:\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000#\\u0000\\u0000\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd7\\u0011\ufffd\ufffd\u04f5x\ufffd\ufffd\ufffd\ufffd#\\u00180X\ufffdshH4\uebd1p\\u0005\\u0012K\ufffd3\u0216 \ufffd\\\u0022\ufffd\\u0006\ufffd\ufffd#\ufffd\ufffdw\ufffd!\ufffd\\u0010\\u0016x\ufffd\ufffd! \ufffdt2\ufffdR\ufffdv\\\\\\u0013\ufffd\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhtt\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u002202d7dc2ee7df5fca6cae578cfb4297ff449f069b\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd7\\u0011\ufffd\ufffd\u04f5x\ufffd\ufffd\ufffd\ufffd#\\u00180X\ufffdshH4\uebd1p\\u0005\\u0012K\ufffd3\u0216 \ufffd\\\u0022\ufffd\\u0006\ufffd\ufffd#\ufffd\ufffdw\ufffd!\ufffd\\u0010\\u0016x\ufffd\ufffd! \ufffdt2\ufffdR\ufffdv\\\\\\u0013\ufffd\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhtt\u0022, \u0022tls_ja3\u0022: \u00222d5378c5e7e573cf609b43c5584fb2e6\u0022, \u0022tls_ja4\u0022: \u002239371e213c297f42dc81f3515706af8d\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd7\ufffd\ufffd\u04f5x\ufffd\ufffd\ufffd\ufffd#0X\ufffdshH4\uebd1pK\ufffd3\u0216 \ufffd\\\u0022\ufffd\ufffd\ufffd#\ufffd\ufffdw\ufffd!\ufffdx\ufffd\ufffd! \ufffdt2\ufffdR\ufffdv\\\\\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-\\thtt\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTPS\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd7\\u0011\ufffd\ufffd\u04f5x\ufffd\ufffd\ufffd\ufffd#\\u00180X\ufffdshH4\uebd1p\\u0005\\u0012K\ufffd3\u0216 \ufffd\\\u0022\ufffd\\u0006\ufffd\ufffd#\ufffd\ufffdw\ufffd!\ufffd\\u0010\\u0016x\ufffd\ufffd! \ufffdt2\ufffdR\ufffdv\\\\\\u0013\ufffd\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000\\u0017\\u0000\\u0000\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhtt\u0022, \u0022tls_ja3\u0022: \u00222d5378c5e7e573cf609b43c5584fb2e6\u0022, \u0022tls_ja4\u0022: \u002239371e213c297f42dc81f3515706af8d\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd7\ufffd\ufffd\u04f5x\ufffd\ufffd\ufffd\ufffd#0X\ufffdshH4\uebd1pK\ufffd3\u0216 \ufffd\\\u0022\ufffd\ufffd\ufffd#\ufffd\ufffdw\ufffd!\ufffdx\ufffd\ufffd! \ufffdt2\ufffdR\ufffdv\\\\\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-\\thtt\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":7,"bytes_in":241},{"id":6034066,"ip":"131.186.2.193","ts":"2026-10-21 14:55:35.000000","proto":"tcp","src_port":42430,"dst_port":8443,"service":"https","classification":"http_flood","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.86548851914362, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022602ecc7984feae22664230a9fc6b61e756fd9f12\u0022, \u0022event_fingerprint\u0022: \u00221268b50d410d1cdd8232ddd7c8594924aae881d7\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 147, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022matched_pattern_names\u0022: [\u0022PostgreSQL startup\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022], \u0022pattern_ids\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u002214f50de5634e1f13b7f26af8274ea935\u0022, \u0022path_pattern_hash\u0022: \u00224d7cc3b45cbf3e5b6ce484f88d569789\u0022, \u0022ja3\u0022: \u00228890550dd20a10b6ade5f94ceadbd2a3\u0022, \u0022ja4\u0022: \u0022e84603f0104f4d3236af1e100a7eadde\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u00228890550dd20a10b6ade5f94ceadbd2a3\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,45-43-11-51-16-5-10-23-13-35,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u0022e84603f0104f4d3236af1e100a7eadde\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_75756e72d2b9_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 51}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\\\u0022\ufffd\\u000f\ufffdy\ufffd\\n\\u0010\u00263\\u0003\ufffd\\u000f\ufffdm \ufffd|K\ufffdS\\u000f~^X\ufffd\ufffdm\ufffd\ufffd@ \ufffdn%\ufffdW\\u0005\\u0002\ufffd\ufffd\\u0019\ufffd\ufffd\ufffd\ufffdB\ufffd\ufffd\ufffd[%\ufffd\ufffdX\\n\ufffdN\ufffd\ufffd\\u000b\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u00003\\u0000\u0026\\u0000\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\\\u0022\ufffd\\u000f\ufffdy\ufffd\\n\\u0010\u00263\\u0003\ufffd\\u000f\ufffdm \ufffd|K\ufffdS\\u000f~^X\ufffd\ufffdm\ufffd\ufffd@ \ufffdn%\ufffdW\\u0005\\u0002\ufffd\ufffd\\u0019\ufffd\ufffd\ufffd\ufffdB\ufffd\ufffd\ufffd[%\ufffd\ufffdX\\n\ufffdN\ufffd\ufffd\\u000b\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \\u001a\ufffd)\ufffd@[\ufffd%\ufffd\ufffdq\ufffd\u0448\ufffd\ufffd`\ufffd\u070b\ufffd\u009e\ufffd\u035d4\ufffd\ufffd~h\\r\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\u0017\\u0000\\u0000\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000#\\u0000\\u0000\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\\\u0022\ufffd\\u000f\ufffdy\ufffd\\n\\u0010\u00263\\u0003\ufffd\\u000f\ufffdm \ufffd|K\ufffdS\\u000f~^X\ufffd\ufffdm\ufffd\ufffd@ \ufffdn%\ufffdW\\u0005\\u0002\ufffd\ufffd\\u0019\ufffd\ufffd\ufffd\ufffdB\ufffd\ufffd\ufffd[%\ufffd\ufffdX\\n\ufffdN\ufffd\ufffd\\u000b\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u00003\\u0000\u0026\\u0000\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022bf1a12db4fb16f16ee5d86615367026f70df5bb7\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\\\u0022\ufffd\\u000f\ufffdy\ufffd\\n\\u0010\u00263\\u0003\ufffd\\u000f\ufffdm \ufffd|K\ufffdS\\u000f~^X\ufffd\ufffdm\ufffd\ufffd@ \ufffdn%\ufffdW\\u0005\\u0002\ufffd\ufffd\\u0019\ufffd\ufffd\ufffd\ufffdB\ufffd\ufffd\ufffd[%\ufffd\ufffdX\\n\ufffdN\ufffd\ufffd\\u000b\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u00003\\u0000\u0026\\u0000\u0022, \u0022tls_ja3\u0022: \u00228890550dd20a10b6ade5f94ceadbd2a3\u0022, \u0022tls_ja4\u0022: \u0022e84603f0104f4d3236af1e100a7eadde\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\\\u0022\ufffd\ufffdy\ufffd\\n\u00263\ufffd\ufffdm \ufffd|K\ufffdS~^X\ufffd\ufffdm\ufffd\ufffd@ \ufffdn%\ufffdW\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdB\ufffd\ufffd\ufffd[%\ufffd\ufffdX\\n\ufffdN\ufffd\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-+3\u0026\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTPS\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\ufffd\\\u0022\ufffd\\u000f\ufffdy\ufffd\\n\\u0010\u00263\\u0003\ufffd\\u000f\ufffdm \ufffd|K\ufffdS\\u000f~^X\ufffd\ufffdm\ufffd\ufffd@ \ufffdn%\ufffdW\\u0005\\u0002\ufffd\ufffd\\u0019\ufffd\ufffd\ufffd\ufffdB\ufffd\ufffd\ufffd[%\ufffd\ufffdX\\n\ufffdN\ufffd\ufffd\\u000b\ufffd\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000-\\u0000\\u0002\\u0001\\u0001\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u00003\\u0000\u0026\\u0000\u0022, \u0022tls_ja3\u0022: \u00228890550dd20a10b6ade5f94ceadbd2a3\u0022, \u0022tls_ja4\u0022: \u0022e84603f0104f4d3236af1e100a7eadde\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\ufffd\\\u0022\ufffd\ufffdy\ufffd\\n\u00263\ufffd\ufffdm \ufffd|K\ufffdS~^X\ufffd\ufffdm\ufffd\ufffd@ \ufffdn%\ufffdW\ufffd\ufffd\ufffd\ufffd\ufffd\ufffdB\ufffd\ufffd\ufffd[%\ufffd\ufffdX\\n\ufffdN\ufffd\ufffd\ufffd\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd-+3\u0026\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":7,"bytes_in":241},{"id":6034065,"ip":"131.186.2.193","ts":"2026-10-21 14:55:35.000000","proto":"tcp","src_port":42212,"dst_port":8443,"service":"https","classification":"http_flood","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.952069169490236, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022602ecc7984feae22664230a9fc6b61e756fd9f12\u0022, \u0022event_fingerprint\u0022: \u00221268b50d410d1cdd8232ddd7c8594924aae881d7\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 147, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022matched_pattern_names\u0022: [\u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022], \u0022pattern_ids\u0022: [\u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u00227270323f6909140f4d8cd1644fe01bb3\u0022, \u0022path_pattern_hash\u0022: \u00224d7cc3b45cbf3e5b6ce484f88d569789\u0022, \u0022ja3\u0022: \u0022a9f6991ade0ecff7dd64075aeee9e6e7\u0022, \u0022ja4\u0022: \u0022d572511006a073c7c2fdb2283e7edd24\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022a9f6991ade0ecff7dd64075aeee9e6e7\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,51-35-5-11-43-10-13-16-23-45,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u0022d572511006a073c7c2fdb2283e7edd24\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_0dcf750fefa1_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 51}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\\u000e{\ufffd\ufffd\ufffdPd\u0770\ufffd\\u0016dP#O\ufffd\ufffdzh\u019e\\u0010q\ufffdLK\ufffd9V+\ufffd\\u001c \\u001f,Y\ufffd\ufffd[\ufffd\ufffd@\ufffd\ufffd\\u0018m!\ufffd\ufffd\\u0005\ufffd\ufffdp\ufffd\ufffd\ufffd,\ufffd.\ufffd\ufffd\ufffd#A4\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \ufffd\u0506S\ufffd\\n\ufffdy}\ufffd\\u001b\ufffdl\ufffd\ufffd\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\\u000e{\ufffd\ufffd\ufffdPd\u0770\ufffd\\u0016dP#O\ufffd\ufffdzh\u019e\\u0010q\ufffdLK\ufffd9V+\ufffd\\u001c \\u001f,Y\ufffd\ufffd[\ufffd\ufffd@\ufffd\ufffd\\u0018m!\ufffd\ufffd\\u0005\ufffd\ufffdp\ufffd\ufffd\ufffd,\ufffd.\ufffd\ufffd\ufffd#A4\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \ufffd\u0506S\ufffd\\n\ufffdy}\ufffd\\u001b\ufffdl\ufffd\ufffd\\n\ufffd\ufffd\ufffdn\ufffd\ufffd\ufffd\u02bb\ufffd\ufffdj\ufffd)\\u0000#\\u0000\\u0000\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\u0017\\u0000\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\\u000e{\ufffd\ufffd\ufffdPd\u0770\ufffd\\u0016dP#O\ufffd\ufffdzh\u019e\\u0010q\ufffdLK\ufffd9V+\ufffd\\u001c \\u001f,Y\ufffd\ufffd[\ufffd\ufffd@\ufffd\ufffd\\u0018m!\ufffd\ufffd\\u0005\ufffd\ufffdp\ufffd\ufffd\ufffd,\ufffd.\ufffd\ufffd\ufffd#A4\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \ufffd\u0506S\ufffd\\n\ufffdy}\ufffd\\u001b\ufffdl\ufffd\ufffd\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022fa24e91b05a05218647bd56750d345ba055d56f3\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\\u000e{\ufffd\ufffd\ufffdPd\u0770\ufffd\\u0016dP#O\ufffd\ufffdzh\u019e\\u0010q\ufffdLK\ufffd9V+\ufffd\\u001c \\u001f,Y\ufffd\ufffd[\ufffd\ufffd@\ufffd\ufffd\\u0018m!\ufffd\ufffd\\u0005\ufffd\ufffdp\ufffd\ufffd\ufffd,\ufffd.\ufffd\ufffd\ufffd#A4\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \ufffd\u0506S\ufffd\\n\ufffdy}\ufffd\\u001b\ufffdl\ufffd\ufffd\u0022, \u0022tls_ja3\u0022: \u0022a9f6991ade0ecff7dd64075aeee9e6e7\u0022, \u0022tls_ja4\u0022: \u0022d572511006a073c7c2fdb2283e7edd24\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd{\ufffd\ufffd\ufffdPd\u0770\ufffddP#O\ufffd\ufffdzh\u019eq\ufffdLK\ufffd9V+\ufffd ,Y\ufffd\ufffd[\ufffd\ufffd@\ufffd\ufffdm!\ufffd\ufffd\ufffd\ufffdp\ufffd\ufffd\ufffd,\ufffd.\ufffd\ufffd\ufffd#A4\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd3\u0026$ \ufffd\u0506S\ufffd\\n\ufffdy}\ufffd\ufffdl\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTPS\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\\u000e{\ufffd\ufffd\ufffdPd\u0770\ufffd\\u0016dP#O\ufffd\ufffdzh\u019e\\u0010q\ufffdLK\ufffd9V+\ufffd\\u001c \\u001f,Y\ufffd\ufffd[\ufffd\ufffd@\ufffd\ufffd\\u0018m!\ufffd\ufffd\\u0005\ufffd\ufffdp\ufffd\ufffd\ufffd,\ufffd.\ufffd\ufffd\ufffd#A4\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \ufffd\u0506S\ufffd\\n\ufffdy}\ufffd\\u001b\ufffdl\ufffd\ufffd\u0022, \u0022tls_ja3\u0022: \u0022a9f6991ade0ecff7dd64075aeee9e6e7\u0022, \u0022tls_ja4\u0022: \u0022d572511006a073c7c2fdb2283e7edd24\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd{\ufffd\ufffd\ufffdPd\u0770\ufffddP#O\ufffd\ufffdzh\u019eq\ufffdLK\ufffd9V+\ufffd ,Y\ufffd\ufffd[\ufffd\ufffd@\ufffd\ufffdm!\ufffd\ufffd\ufffd\ufffdp\ufffd\ufffd\ufffd,\ufffd.\ufffd\ufffd\ufffd#A4\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd3\u0026$ \ufffd\u0506S\ufffd\\n\ufffdy}\ufffd\ufffdl\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":7,"bytes_in":241},{"id":6034064,"ip":"131.186.2.193","ts":"2026-10-21 14:55:35.000000","proto":"tcp","src_port":42292,"dst_port":8443,"service":"https","classification":"http_flood","waf_score":null,"waf_tags":null,"http_method":null,"http_target":null,"sensor_id":"paris-1","meta":"{\u0022protocol_emulated\u0022: true, \u0022emulator_response\u0022: \u0022485454502f312e3120323030204f4b0d0a5365727665723a204170616368652f322e342e35370d0a436f6e74656e742d4c656e6774683a20320d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a4f4b\u0022, \u0022emulator_response_len\u0022: 82, \u0022bytes_in\u0022: 241, \u0022payload_entropy\u0022: 5.873705655930689, \u0022port_category\u0022: \u0022registered\u0022, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022service\u0022: \u0022https\u0022, \u0022app_proto\u0022: \u0022https\u0022, \u0022asn\u0022: 31898, \u0022country\u0022: \u0022US\u0022, \u0022dst_port\u0022: 8443, \u0022risk_waf\u0022: 8.0, \u0022risk_classification\u0022: 80.0, \u0022risk_behavior\u0022: 0.0, \u0022risk_geo\u0022: 0.0, \u0022risk_protocol\u0022: 33.0, \u0022risk_novelty\u0022: 15.0, \u0022risk_boost\u0022: 0, \u0022risk_granularity\u0022: 2.8, \u0022risk_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0}, \u0022risk_score\u0022: 51, \u0022tag_count\u0022: 3, \u0022anomaly_count\u0022: 0, \u0022campaign_key\u0022: \u0022602ecc7984feae22664230a9fc6b61e756fd9f12\u0022, \u0022event_fingerprint\u0022: \u00221268b50d410d1cdd8232ddd7c8594924aae881d7\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022confidence\u0022: 1.0, \u0022classification_confidence\u0022: 1.0, \u0022precision_score\u0022: 147, \u0022precision_signals\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022kb_rule_ids\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022matched_patterns\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022matched_pattern_names\u0022: [\u0022PostgreSQL startup\u0022, \u0022Minecraft varint handshake\u0022, \u0022SOCKS5 greeting\u0022, \u0022SIP TLS ClientHello\u0022], \u0022pattern_ids\u0022: [\u0022pat-0369\u0022, \u0022pat-0554\u0022, \u0022pat-0567\u0022, \u0022pat-0578\u0022], \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022named_classification_skipped\u0022: false, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_confidence_factor\u0022: 100.0, \u0022city\u0022: null, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false, \u0022geo\u0022: {\u0022country\u0022: \u0022US\u0022, \u0022asn\u0022: 31898, \u0022org\u0022: \u0022Oracle Corporation\u0022, \u0022is_datacenter\u0022: false, \u0022is_tor_hint\u0022: false}, \u0022fingerprint\u0022: {\u0022payload_hash\u0022: \u0022b85c40586639733c60486183b261c4a4\u0022, \u0022path_pattern_hash\u0022: \u00224d7cc3b45cbf3e5b6ce484f88d569789\u0022, \u0022ja3\u0022: \u0022fb5d143e512cc02eea154ad3cd798f4c\u0022, \u0022ja4\u0022: \u00227767ba336293fd5e5b34c4a82fa1399a\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022}, \u0022tls_ja3_hash\u0022: \u0022fb5d143e512cc02eea154ad3cd798f4c\u0022, \u0022tls_ja3\u0022: \u0022771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,13-16-5-51-35-10-43-23-11-45,29-23-24,0\u0022, \u0022tls_ja4_hash\u0022: \u00227767ba336293fd5e5b34c4a82fa1399a\u0022, \u0022tls_ja4\u0022: \u0022t13d0110_6a370f950172_28135b4947ef\u0022, \u0022tls_version\u0022: \u00220x0303\u0022, \u0022tls_cipher_count\u0022: 10, \u0022ja3_client_category\u0022: \u0022nmap_scanner\u0022, \u0022target_context\u0022: {\u0022dst_port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022risk_score\u0022: 51}, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\u07af\u06a8\ufffd\\\u0022Y\ufffd\\u0005\u069c\ufffd\\n\ufffd\ufffd\\u0010\ufffd\u06e7U-\ufffd|\ufffd\\u001av-\ufffd\\u0013d\ufffdA ?\\u0018\ufffd\ufffd\ufffd\\u000bOI\ufffd\ufffd\ufffd\\u0000\\u001d\ufffd\ufffd\u069c\ufffda\ufffd\\u0011IJ\ufffd\ufffd\\\\1\ufffd9e\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\u0022, \u0022evidence\u0022: {\u0022request_sample\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\u07af\u06a8\ufffd\\\u0022Y\ufffd\\u0005\u069c\ufffd\\n\ufffd\ufffd\\u0010\ufffd\u06e7U-\ufffd|\ufffd\\u001av-\ufffd\\u0013d\ufffdA ?\\u0018\ufffd\ufffd\ufffd\\u000bOI\ufffd\ufffd\ufffd\\u0000\\u001d\ufffd\ufffd\u069c\ufffda\ufffd\\u0011IJ\ufffd\ufffd\\\\1\ufffd9e\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\\b\\u0006\\b\\u0007\\b\\b\\u0000\\u0010\\u0000\\u000b\\u0000\\t\\bhttp\/1.1\\u0000\\u0005\\u0000\\u0005\\u0001\\u0000\\u0000\\u0000\\u0000\\u00003\\u0000\u0026\\u0000$\\u0000\\u001d\\u0000 \ufffd\ufffd\\r%\ufffdP\ufffd\ufffd;\\u001fkS\ufffd\ufffdW7\ufffd.\ufffd]\ufffdj\u003E\ufffd\ufffd\ufffd\uda8d\udeff\ufffd,\\u0000#\\u0000\\u0000\\u0000\\n\\u0000\\b\\u0000\\u0006\\u0000\\u001d\\u0000\\u0017\\u0000\\u0018\\u0000+\\u0000\\u0005\\u0004\\u0003\\u0004\\u0003\\u0003\\u0000\\u0017\\u0000\\u0000\\u0000\\u000b\\u0000\\u0002\\u0001\\u0000\\u0000-\\u0000\\u0002\\u0001\\u0001\u0022, \u0022payload_snippet\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\u07af\u06a8\ufffd\\\u0022Y\ufffd\\u0005\u069c\ufffd\\n\ufffd\ufffd\\u0010\ufffd\u06e7U-\ufffd|\ufffd\\u001av-\ufffd\\u0013d\ufffdA ?\\u0018\ufffd\ufffd\ufffd\\u000bOI\ufffd\ufffd\ufffd\\u0000\\u001d\ufffd\ufffd\u069c\ufffda\ufffd\\u0011IJ\ufffd\ufffd\\\\1\ufffd9e\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\u0022, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022mitre_tactics\u0022: [\u0022TA0001\u0022, \u0022TA0002\u0022], \u0022mitre_techniques\u0022: [\u0022T1499\u0022], \u0022mitre\u0022: \u0022T1499\u0022, \u0022threat_family\u0022: [\u0022ddos\u0022], \u0022recommended_client_action\u0022: \u0022investigate\u0022, \u0022policy_mode\u0022: \u0022intelligence\u0022, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022event_signature\u0022: \u0022841c74587f54c094e63070c41650ad559b25bf20\u0022, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\u07af\u06a8\ufffd\\\u0022Y\ufffd\\u0005\u069c\ufffd\\n\ufffd\ufffd\\u0010\ufffd\u06e7U-\ufffd|\ufffd\\u001av-\ufffd\\u0013d\ufffdA ?\\u0018\ufffd\ufffd\ufffd\\u000bOI\ufffd\ufffd\ufffd\\u0000\\u001d\ufffd\ufffd\u069c\ufffda\ufffd\\u0011IJ\ufffd\ufffd\\\\1\ufffd9e\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\u0022, \u0022tls_ja3\u0022: \u0022fb5d143e512cc02eea154ad3cd798f4c\u0022, \u0022tls_ja4\u0022: \u00227767ba336293fd5e5b34c4a82fa1399a\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\u07af\u06a8\ufffd\\\u0022Y\ufffd\u069c\ufffd\\n\ufffd\ufffd\ufffd\u06e7U-\ufffd|\ufffdv-\ufffdd\ufffdA ?\ufffd\ufffd\ufffdOI\ufffd\ufffd\ufffd\ufffd\ufffd\u069c\ufffda\ufffdIJ\ufffd\ufffd\\\\1\ufffd9e\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\u0022, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022site_display\u0022: {\u0022classification\u0022: null, \u0022classification_reason\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022classification_reason_label_fr\u0022: \u0022Type \u00ab http_flood \u00bb (signaux protocolaires) \u00b7 confiance 100%\u0022, \u0022executive_one_liner_fr\u0022: \u0022Activit\u00e9 suspecte \u2014 risque 51\/100 (Moyen) \u2014 MITRE T1499 \u2014 confiance 100 % \u2014 via HTTPS\u0022, \u0022confidence_pct\u0022: 100, \u0022confidence_breakdown\u0022: {\u0022waf\u0022: 8.0, \u0022classification\u0022: 80.0, \u0022behavior\u0022: 0.0, \u0022geo\u0022: 0.0, \u0022protocol\u0022: 33.0, \u0022novelty\u0022: 15.0, \u0022risk_score\u0022: 51}, \u0022attack_stage\u0022: \u0022exploit_attempt\u0022, \u0022attack_stage_label\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022attack_chain_stage_label_fr\u0022: \u0022Exploitation\u0022, \u0022risk_score\u0022: 51, \u0022risk_label\u0022: \u0022Moyen\u0022, \u0022service_name\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022, \u0022dst_port\u0022: 8443, \u0022protocol_emulated\u0022: true, \u0022tags_summary\u0022: [\u0022MITRE-T1499\u0022, \u0022INT-upstream\u0022], \u0022tags_summary_labels_fr\u0022: [\u0022MITRE-T1499\u0022, \u0022Upstream\u0022], \u0022recommended_action\u0022: \u0022investigate\u0022, \u0022recommended_action_label\u0022: \u0022Investiguer\u0022, \u0022mitre\u0022: \u0022T1499\u0022, \u0022mitre_technique\u0022: \u0022T1499\u0022, \u0022persona_hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022persona_service_banner\u0022: \u0022honeypot-https\u0022, \u0022correlation_flags\u0022: null, \u0022correlation_flags_labels_fr\u0022: null, \u0022sensor_role\u0022: \u0022threat_intelligence\u0022, \u0022sensor_role_label_fr\u0022: \u0022Renseignement menaces\u0022, \u0022confidence_hint_fr\u0022: null, \u0022protocol_details\u0022: {\u0022payload_preview\u0022: \u0022\\u0016\\u0003\\u0001\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0003\\u0003\u07af\u06a8\ufffd\\\u0022Y\ufffd\\u0005\u069c\ufffd\\n\ufffd\ufffd\\u0010\ufffd\u06e7U-\ufffd|\ufffd\\u001av-\ufffd\\u0013d\ufffdA ?\\u0018\ufffd\ufffd\ufffd\\u000bOI\ufffd\ufffd\ufffd\\u0000\\u001d\ufffd\ufffd\u069c\ufffda\ufffd\\u0011IJ\ufffd\ufffd\\\\1\ufffd9e\\u0000\\u0014\\u0013\\u0002\\u0013\\u0001\\u0013\\u0003\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\\u0000\ufffd\\u0001\\u0000\\u0000\ufffd\\u0000\\r\\u0000\\u001c\\u0000\\u001a\\u0002\\u0001\\u0002\\u0003\\u0004\\u0001\\u0004\\u0003\\u0005\\u0001\\u0005\\u0003\\u0006\\u0001\\u0006\\u0003\\b\\u0004\\b\\u0005\u0022, \u0022tls_ja3\u0022: \u0022fb5d143e512cc02eea154ad3cd798f4c\u0022, \u0022tls_ja4\u0022: \u00227767ba336293fd5e5b34c4a82fa1399a\u0022, \u0022port\u0022: 8443, \u0022service\u0022: \u0022https\u0022, \u0022service_label_fr\u0022: \u0022HTTPS\u0022}, \u0022attack_vector\u0022: \u0022http flood \u00b7 via HTTPS:8443 \u00b7 (tentative d\u0027exploit)\u0022, \u0022evidence_snippet\u0022: \u0022\ufffd\ufffd\u07af\u06a8\ufffd\\\u0022Y\ufffd\u069c\ufffd\\n\ufffd\ufffd\ufffd\u06e7U-\ufffd|\ufffdv-\ufffdd\ufffdA ?\ufffd\ufffd\ufffdOI\ufffd\ufffd\ufffd\ufffd\ufffd\u069c\ufffda\ufffdIJ\ufffd\ufffd\\\\1\ufffd9e\ufffd,\ufffd+\u0329\ufffd0\ufffd\/\u0328\ufffd\ufffd\u0022, \u0022target_port_label\u0022: \u00228443 \u00b7 HTTPS\u0022, \u0022emulator_service\u0022: \u0022https\u0022, \u0022confidence_reason\u0022: \u0022Confiance 100 % \u2014 3 signal(aux) capteur\u0022, \u0022confidence_factors_fr\u0022: \u0022Confiance 100 % \u2014 Score WAF 8\u0022, \u0022campaign_hint_fr\u0022: null, \u0022attack_phases_timeline_fr\u0022: [{\u0022key\u0022: \u0022recon\u0022, \u0022label_fr\u0022: \u0022Reconnaissance\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022probe\u0022, \u0022label_fr\u0022: \u0022Sonde \/ probe\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploit_attempt\u0022, \u0022label_fr\u0022: \u0022Tentative d\u0027exploit\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022post_exploit\u0022, \u0022label_fr\u0022: \u0022Post-exploitation\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022c2\u0022, \u0022label_fr\u0022: \u0022Commande \u0026 contr\u00f4le\u0022, \u0022active\u0022: false, \u0022kind\u0022: \u0022stage\u0022}, {\u0022key\u0022: \u0022exploitation\u0022, \u0022label_fr\u0022: \u0022Exploitation\u0022, \u0022active\u0022: true, \u0022kind\u0022: \u0022chain\u0022, \u0022hint_fr\u0022: null}]}, \u0022meta_truncated\u0022: true, \u0022honeypot_persona\u0022: {\u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022mail_host\u0022: \u0022mail.sensor-1.internal\u0022, \u0022ldap_dc\u0022: \u0022dc.sensor-1.internal\u0022, \u0022k8s_cluster\u0022: \u0022hp-sensor-1\u0022, \u0022domain\u0022: \u0022sensor-1.internal\u0022, \u0022service_role\u0022: \u0022https\u0022, \u0022service_banner\u0022: \u0022honeypot-https\u0022, \u0022service_os\u0022: \u0022linux\u0022, \u0022dst_port\u0022: \u00228443\u0022}, \u0022hostname\u0022: \u0022mail.sensor-1.internal\u0022, \u0022sensor_id\u0022: \u0022sensor-1\u0022, \u0022attack_chain_stage\u0022: \u0022exploitation\u0022, \u0022ban_policy\u0022: \u0022advisory_investigate\u0022, \u0022tags_list\u0022: [\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]}","tls_sni":null,"tls_ja3_hash":null,"tls_ja3":null,"http_version":null,"http_host":null,"http_user_agent":null,"http_referer":null,"tags":"[\u0022http_alt_port\u0022, \u0022net_flood\u0022, \u0022tls_clienthello\u0022]","anomalies":"[]","severity":7,"bytes_in":241}],"total_events":504}